[Connector integrity] Reject duplicate ETL target connector IDs after scaffold-retirement lane stabilizes

[seonghobae]

Product/security integrity gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 has the same silent replacement pattern now being repaired for CDC in #200/#201 at a separate ETL registry boundary:

public final void register(TargetConnector connector) {
    byId.put(connector.id(), connector);
}

TargetConnectorRegistry is a production Spring component and connector ID is the lookup/catalog authority. A later in-process registration with the same ID silently replaces the earlier target implementation. This is distinct from #200, which intentionally scopes itself to CDC registries.

Status: known_gap, source mutation defer_until_trigger while active Qlik scaffold-retirement PR #156 owns TargetConnectorRegistry and its catalog/config surface. Do not race #156 or broaden #200/#201.

RCA

• Immediate cause: ordinary LinkedHashMap.put replacement semantics.
• Technical root cause: target connector identity uniqueness is not an explicit validated registry invariant.
• Control failure: current tests exercise lookup/catalog behavior but do not prove duplicate or blank IDs fail closed.
• Risk: registration order can silently change which implementation owns a configured connector ID, making execution/discovery authority ambiguous. This becomes more material as scaffold connectors are removed or real provider plugins are introduced.

Bounded remediation after #156 stabilizes/integrates

1. Re-read the exact protected/current registry after Qlik retirement and preserve its accepted connector set/order.
2. Add fail-first tests against the real TargetConnectorRegistry requiring null/blank IDs and duplicate IDs to fail before mutation.
3. Use explicit validation plus putIfAbsent or an equivalent deterministic duplicate check; never silently choose first/last or add priority semantics without an ADR.
4. Keep errors bounded to the non-secret connector ID; never include config maps, credentials, payloads, endpoints or provider exception text.
5. Preserve unique registration order and existing lookup/catalog behavior.

Acceptance

• duplicate target IDs cannot replace a registered implementation;
• blank/null connector or connector ID fails deterministically before registry mutation;
• unique connectors remain discoverable in deterministic order;
• the final registry/catalog agrees with [Product gap] Eliminate production scaffold-only connector implementations #153/fix(connectors): remove Qlik scaffold from production registry #156 and does not resurrect retired scaffolds;
• focused/full ETL tests plus current dependency/SBOM/SAST/security checks pass;
• non-vacuous owned-production coverage under [Quality gate] Make JaCoCo fail closed when production class selection is empty #162/fix(coverage): make JaCoCo production gate non-vacuous #164 or an equivalent accepted control includes the changed registry boundary;
• canonical connector-support/security/traceability documentation records the invariant when docs: establish canonical commercial architecture baseline #149/[Documentation] Close canonical architecture coverage and live traceability gaps #159 is safe;
• accepted literal-source and applicable independent-review gates pass before merge.

Relationship: #153 connector scaffold lifecycle; #156 Qlik registry retirement; #200/#201 analogous CDC identity repair; #159 canonical traceability.