Some of those might be okay, I don't know the code well enough. However, the shutdownNow() call in CommitTracker is definitely fatal. I've attached a patch to demonstrate with a test case.
FWIW, the pending.cancel(true), while dangerous, is far less likely to be hit because the task nulls out the pending field as soon as it starts to run. But the shutdownNow() will interrupt the thread even after the field is nulled out, so it's a lot more likely to really hit.