[FLINK-39860][runtime] Reduce ArchUnit violations: production code must not call @VisibleForTesting methods

[spuru9]

What is the purpose of the change

Resolves the 23 frozen violations of the "Production code must not call methods annotated with @VisibleForTesting" ArchUnit rule (ApiAnnotationRules in flink-architecture-tests-production). In every case the annotation is inaccurate — the target method is genuinely called by production code — so removing the marker corrects the API signal. This is an annotation-only change; no visibility or behavioral change.

Brief change log

• Removed @VisibleForTesting from 12 production-called methods (and 2 now-unused imports) across flink-runtime and flink-cep:
  • BlobKey#getHash() — 5 callers (blob integrity checks)
  • TaskExecutorResourceUtils#generateDefaultSlotResourceProfile / #generateTotalAvailableResourceProfile — 4
  • EmbeddedLeaderService#grantLeadership() / #revokeLeadership() — 6
  • SourceOperator#getSourceReader() — 2
  • CopyOnWriteStateMap#snapshotMapArrays(), ExecutionVertex#finishPartitionsIfNeeded(), DataSetMetaInfo#withNumRegisteredPartitions(), RecreateOnResetOperatorCoordinator.QuiesceableContext#quiesce(), MailboxProcessor#isDefaultActionAvailable() — 1 each
  • Lockable.LockableTypeSerializer#getElementSerializer() (flink-cep) — 1
• Moved SourceOperator#getSourceReader() above the // methods for unit tests section (it is now production-used).
• Emptied the rule's violation store (e5126cae-…, 23 → 0). The freeze() wrapper is kept, so the rule now enforces zero such violations going forward.

Verifying this change

This change is covered by the existing architecture tests:

• mvn -pl flink-architecture-tests/flink-architecture-tests-production test -Dtest=ArchitectureTest passes; the rule's violation store is reduced from 23 entries to 0.
• spotless and checkstyle pass on flink-runtime and flink-cep.
• Pure annotation removals — no behavioral change, existing tests unaffected.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): no
• The public API, i.e., is any changed class annotated with @Public(Evolving): no (annotation-only; affected classes are @Internal, no signature/visibility change)
• The serializers: no
• The runtime per-record code paths (performance sensitive): no
• Anything that affects deployment or recovery: no
• The S3 file system connector: no

Documentation

• Does this pull request introduce a new feature? no
• If yes, how is the feature documented? not applicable

Reviewer note

The EmbeddedLeaderService.grant/revokeLeadership() pair (6 sites) is the one judgment call: the annotation was removed because the production-source EmbeddedHaServicesWithLeadershipControl calls these methods. If reviewers prefer annotating that caller instead, the alternative only affects the highavailability portion — happy to switch.

---

• Claude Code

[flinkbot]

CI report:

• 7fcffeb Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build