Seems like kill -9 or any method to stop ODL should be handled the same as far as the cluster is concerned - meaning a missing ODL is a missing ODL regardless of how it went missing. But if there are differences, and if using a different method than kill -9 uncovers bugs then I think we should change the application tests to use the better method so we can focus on the applications. We should create other tests using kill -9 so we can focus on those tests.

HA should kick in as an end result no matter how a node is stopped. However the path to that result differs a bit.  If a node is killed then one of the other nodes has to time out and start a new election. If a node is shut down gracefully, then the current leader will (try to) transfer leadership  to another node immediately. The former may result in hiccups/disruption during the time out period but the latter should not. 

In the end both need to be tested along with isolating a node (which is similar to killing a node but has different dynamics on rejoin). But I would agree that apps really don't need to test the differences - leave that up to controller suites. So I'd suggest graceful shutdown for apps to hopefully avoid intermittent test failures.

and unfortunately, all of the scenarios are not unrealistic (isolation, sudden failure, graceful restart).