[void-ptr974]

Motivation

AuditorElector.shutdown() queues manager cleanup behind the blocking election task on the same single-thread executor. A follower waiting for leadership therefore prevents cleanup until the hardcoded ten-second timeout interrupts the worker.

That interruption does not establish task completion. Election can return and construct/start an Auditor while resources are being closed, and concurrent shutdown callers can return before the first caller finishes cleanup.

Changes

• Gate election, Auditor construction and startup against a shared stopping state. Let admitted construction/startup finish without interruption; close a successfully constructed Auditor even if shutdown prevents it from starting.
• Run cleanup independently of the election executor. Close the manager first, then interrupt any remaining election wait and await actual executor termination before shutting down the Auditor and owned BookKeeper client.
• Make the native ZooKeeper manager release its follower latch on close and coordinate vote creation with close, preventing a vote from being created after cleanup. Closing before fallback interruption also avoids interrupting an in-flight vote creation before its path is recorded.
• Share cleanup completion across concurrent and repeated shutdown calls. Interrupted waiters finish waiting for cleanup before receiving interruption, while shutdown requests from the election/cleanup thread avoid waiting for themselves.
• Preserve externally owned clients (ownBkc=false) and the existing log-only handling of close failures, while still attempting subsequent supported close operations.

Validation

29 tests passed: 16 new elector lifecycle tests, 5 new ZooKeeper manager tests, and the existing AuditorBookieTest (5) and AutoRecoveryMainTest (3). Checkstyle, Apache Rat, Spotless and SpotBugs passed.

JAVA_HOME=/path/to/jdk-17 mvn -ntp -P'!mac,!cargo-zigbuild' \
  -pl bookkeeper-server -am checkstyle:check test \
  -Dtest=AuditorElectorTest,ZkLedgerAuditorManagerTest,AuditorBookieTest,AutoRecoveryMainTest \
  -Dsurefire.failIfNoSpecifiedTests=false -Dspotbugs.skip \
  -DtestRetryCount=0 -DredirectTestOutputToFile=true

Static checks used the same module/profile selection:

mvn -ntp -P'!mac,!cargo-zigbuild' -pl bookkeeper-server -am \
  apache-rat:check spotless:check spotbugs:check -DskipTests

The native build profiles were disabled for these local Java lifecycle checks on macOS. The full project test suite was not run locally.

Scope

Manager implementations must follow the documented cancellation contract: close() may wait for admitted metadata operations, but must return independently of the election invocation; remaining waits must respond to close or interruption. This does not terminate arbitrary uninterruptible waits in external implementations; the Pulsar manager requires its own fix.

Completion covers election exit and the existing supported close operations. This change does not add failure-unwinding inside Auditor constructors or strengthen Auditor.shutdown()'s internal handling of close failures.