Major Description
Harpoon into the head of the great whale I have been chasing for a couple weeks now.
ChaosMonkey test was exposing this.
Turns out the problem was the solr cmd distrib executor - when closing the leader CoreContainer, we would close the zkController while updates can still flow through the distrib executor. The result was that we would send updates from the leader briefly even though there was a new leader.
I had suspected something similar to this at one point in the hunt and started adding some defensive state checks that we wanted to add anyway. I don't think they caught all of this issue due to the limited tightness one of the state checks can get to (checking the cloudstate leader from a replica against the leader indicated by the request).
So the answer is to finally work out how to stop the solr cmd distrib executor - because we need to stop it before closing zkController and giving up our role as leader.
I've worked that all out and the issue no longer seems to be a problem.