The Event Service allows user-specified Executors to be supplied in a number of places.  But its specification does not contain all the information needed to know what kind of Executor might be appropriate:

* For the distributingExecutor parameter to the EventClient constructor (used to call handleNotification on listeners), it should be specified that the EventClient will only submit one job at a time to this Executor.  So users don't have to worry about listeners being thread-safe with respect to one another, or about notifications being handled out of order because of parallelism.

* Likewise for the leaseScheduler parameter it might be specified that the EventClient will only submit one job at a time, though this is probably obvious.

* For the executor parameter to FetchingEventRelay, it should again be specified that the FetchingEventRelay will only submit one job at a time, and more importantly that the behaviour will be unspecified if Executor.execute throws an exception, in particular RejectedExecutionException.