[Connector integrity] Reject duplicate configured CDC source IDs

[seonghobae]

Product / integrity gap

Fresh protected-source inspection on develop@942d164ceb7af497bb28a95f842db96429d1bdc4 shows that CdcSourceFactory.describeConfigured(...) accepts multiple SourceSpec entries with the same source ID and emits multiple status rows without any identity error. XtrmetlProperties.Cdc.sources likewise has no uniqueness invariant.

A configured source ID is operator-facing identity. Allowing duplicate IDs makes status/configuration describe two authorities under one name and leaves future multi-source execution semantics dependent on list order rather than an explicit invariant.

RCA

• Immediate cause: describeConfigured(...) iterates the supplied list without tracking previously observed IDs.
• Technical root cause: source-list validation checks only each SourceSpec in isolation; cross-entry identity uniqueness is not modeled.
• Control failure: CdcSourceFactoryTest covers registered/scaffold/unknown type classification but no duplicate configured identities.
• Impact: duplicate configuration can produce ambiguous operator status today and becomes unsafe execution authority if the documented multi-source roadmap is activated later.

Distinct remedies / feasibility

1. Preferred — fail closed at the factory/configuration boundary. Reject a repeated non-blank source ID before emitting a second status row, with a stable error that contains only the duplicated ID.
2. Alternative — Bean Validation custom uniqueness constraint. Feasible but broader because the current configuration-properties class does not otherwise use cross-entry validation and would add binding/lifecycle scope.
3. Reject — silently first/last wins. That makes list order choose authority.
4. Reject — auto-renaming duplicates. That changes configured identity and breaks operator intent.

No secret, schema migration, provider dependency, or cross-repository authority is required.

TDD acceptance

1. Add a dedicated production-boundary test before production changes.
2. Two entries with the same source ID must fail deterministically rather than produce ambiguous rows.
3. Unique IDs, repeated connector types under different IDs, disabled entries, unknown types, and current PostgreSQL behavior remain supported.
4. Error text must not include connector configuration/payload/provider diagnostics.
5. Add beginner-readable public Javadoc for the strengthened validation contract.
6. Run focused/full CDC tests and regenerate exact-head CI/security/SBOM/SAST/review evidence before integration.

Writer safety

Use a new direct-develop branch and a dedicated new test class so active connector-discovery PRs #158/#163 are not raced. Re-read live develop, CdcSourceFactory.java, open PR paths, and branch activity immediately before each write.

[seonghobae]

Integrated on protected develop by PR #275. Merge commit d7054ae0ac579b8ce27fe559f937e99be3459a40 changes only CdcSourceFactory and its dedicated identity-contract test, rejecting repeated configured source IDs while preserving repeated connector types under distinct IDs and existing source classification. Closing as completed.