Narrow the source-fact /facts fetch to the query's certnames

2026-10-09 23:47:56 +11:00
parent 0aff1746e2
commit 97ddc378ff
6 changed files with 143 additions and 7 deletions
@@ -251,7 +251,9 @@ matters more.
  `in` an `array`) selects `pdbmux_source` itself, built only from
  `and`/`or`/`not` over `=`, `~` and `in`-`array` on `certname`, `environment`,
  `name` and `value`: it is still fanned out for the real facts it names, and
-  the synthetic records are added after being filtered by the query locally;
+  the synthetic records are added after being filtered by the query locally.
+  Their fetch carries only the query's top-level `and` conjuncts on
+  `certname`, so a single-host lookup stays single-host;
 - the path is `/facts/<name>` for any other fact. The path segment is the same
  outer `name` constraint, so only the fact's own path carries the record;
 - injection is turned off (see `source_fact_enabled`).