I've run in to something weird here. It looks like with IDM46, the use of token-query is causing two queries to be made where I'd only expect to see one.

Trace (obfuscated a bit):

Code:
[07/11/17 14:03:39.066]:ThingyBLD ST:    Evaluating selection criteria for rule 'BLD_sub_etp_orgsec:- Validate ThingyOrgSecuritySite values for Thingy ID and veto if not available'.
[07/11/17 14:03:39.066]:ThingyBLD ST:      (if-operation match "add|modify") = TRUE.
[07/11/17 14:03:39.066]:ThingyBLD ST:      Expanded variable reference '$lvDomain_Prefix_AccessActionRequest$' to 'MainAccessActionRequest'.
[07/11/17 14:03:39.067]:ThingyBLD ST:      (if-attr '$lvDomain_Prefix_AccessActionRequest$' match "Add|Modify|Terminate") = TRUE.
[07/11/17 14:03:39.067]:ThingyBLD ST:      Expanded variable reference '$lvDomain_Prefix_OrgSecuritySite$' to 'MainOrgSecuritySite'.
[07/11/17 14:03:39.067]:ThingyBLD ST:      (if-op-attr '$lvDomain_Prefix_OrgSecuritySite$' changing) = TRUE.
[07/11/17 14:03:39.067]:ThingyBLD ST:    Rule selected.
[07/11/17 14:03:39.067]:ThingyBLD ST:    Applying rule 'BLD_sub_etp_orgsec:- Validate ThingyOrgSecuritySite values for Thingy ID and veto if not available'.
[07/11/17 14:03:39.068]:ThingyBLD ST:      Action: do-set-local-variable("lvSearchBasedomain",scope="policy",token-global-variable("gcvThingyDomians")).
[07/11/17 14:03:39.068]:ThingyBLD ST:        arg-string(token-global-variable("gcvThingyDomians"))
[07/11/17 14:03:39.068]:ThingyBLD ST:          token-global-variable("gcvThingyDomians")
[07/11/17 14:03:39.068]:ThingyBLD ST:            Token Value: "ThingyMain".
[07/11/17 14:03:39.068]:ThingyBLD ST:          Arg Value: "ThingyMain".
[07/11/17 14:03:39.068]:ThingyBLD ST:      Action: do-set-local-variable("lvSearchDestDN",scope="policy",token-global-variable("gcvThingyDomianOrgPath")).
[07/11/17 14:03:39.069]:ThingyBLD ST:        arg-string(token-global-variable("gcvThingyDomianOrgPath"))
[07/11/17 14:03:39.069]:ThingyBLD ST:          token-global-variable("gcvThingyDomianOrgPath")
[07/11/17 14:03:39.069]:ThingyBLD ST:            Token Value: "com\appsdata\Thingy\domain\main\organization".
[07/11/17 14:03:39.069]:ThingyBLD ST:          Arg Value: "com\appsdata\Thingy\domain\main\organization".
[07/11/17 14:03:39.069]:ThingyBLD ST:      Action: do-set-local-variable("lvSearchAttributeName",scope="policy","ThingyAppRefDataDisplayName").
[07/11/17 14:03:39.070]:ThingyBLD ST:        arg-string("ThingyAppRefDataDisplayName")
[07/11/17 14:03:39.070]:ThingyBLD ST:          token-text("ThingyAppRefDataDisplayName")
[07/11/17 14:03:39.070]:ThingyBLD ST:          Arg Value: "ThingyAppRefDataDisplayName".
[07/11/17 14:03:39.070]:ThingyBLD ST:      Action: do-if().
[07/11/17 14:03:39.070]:ThingyBLD ST:        Evaluating conditions.
[07/11/17 14:03:39.070]:ThingyBLD ST:          (if-operation match "add|modify") = TRUE.
[07/11/17 14:03:39.071]:ThingyBLD ST:        Performing if actions.
[07/11/17 14:03:39.071]:ThingyBLD ST:          Action: do-for-each(arg-node-set(token-xpath("*[@attr-name=$lvDomain_Prefix_OrgSecuritySite]/add-value"))).
[07/11/17 14:03:39.071]:ThingyBLD ST:            arg-node-set(token-xpath("*[@attr-name=$lvDomain_Prefix_OrgSecuritySite]/add-value"))
[07/11/17 14:03:39.071]:ThingyBLD ST:              token-xpath("*[@attr-name=$lvDomain_Prefix_OrgSecuritySite]/add-value")
[07/11/17 14:03:39.071]:ThingyBLD ST:              Token Value: {<add-value>}.
[07/11/17 14:03:39.072]:ThingyBLD ST:              Arg Value: {<add-value>}.
[07/11/17 14:03:39.072]:ThingyBLD ST:            Performing actions for local-variable(current-node) = <add-value>.
[07/11/17 14:03:39.072]:ThingyBLD ST:              Action: do-trace-message(level="1","ORGSECURITYSITE Current Node is "+token-local-variable("current-node")).
[07/11/17 14:03:39.072]:ThingyBLD ST:                arg-string("ORGSECURITYSITE Current Node is "+token-local-variable("current-node"))
[07/11/17 14:03:39.072]:ThingyBLD ST:                  token-text("ORGSECURITYSITE Current Node is ")
[07/11/17 14:03:39.073]:ThingyBLD ST:                  token-local-variable("current-node")
[07/11/17 14:03:39.073]:ThingyBLD ST:                    Token Value: "Site Name - Site Thing".
[07/11/17 14:03:39.073]:ThingyBLD ST:                  Arg Value: "ORGSECURITYSITE Current Node is Site Name - Site Thing".
[07/11/17 14:03:39.073]:ThingyBLD ST:ORGSECURITYSITE Current Node is Site Name - Site Thing
[07/11/17 14:03:39.073]:ThingyBLD ST:              Action: do-set-local-variable("lvSearchAttributeValue",scope="policy",token-local-variable("current-node")).
[07/11/17 14:03:39.074]:ThingyBLD ST:                arg-string(token-local-variable("current-node"))
[07/11/17 14:03:39.074]:ThingyBLD ST:                  token-local-variable("current-node")
[07/11/17 14:03:39.074]:ThingyBLD ST:                    Token Value: "Site Name - Site Thing".
[07/11/17 14:03:39.074]:ThingyBLD ST:                  Arg Value: "Site Name - Site Thing".
[07/11/17 14:03:39.074]:ThingyBLD ST:              Action: do-set-local-variable("lvDataObjectNodeSet",scope="policy",arg-node-set(token-query(class-name="OrgAppRefData",datastore="src",arg-dn(token-local-variable("lvSearchDestDN")),arg-match-attr("$lvSearchAttributeName$",token-local-variable("lvSearchAttributeValue")),"ThingyAppRefDataID"))).
[07/11/17 14:03:39.075]:ThingyBLD ST:                arg-node-set(token-query(class-name="OrgAppRefData",datastore="src",arg-dn(token-local-variable("lvSearchDestDN")),arg-match-attr("$lvSearchAttributeName$",token-local-variable("lvSearchAttributeValue")),"ThingyAppRefDataID"))
[07/11/17 14:03:39.075]:ThingyBLD ST:                  token-query(class-name="OrgAppRefData",datastore="src",arg-dn(token-local-variable("lvSearchDestDN")),arg-match-attr("$lvSearchAttributeName$",token-local-variable("lvSearchAttributeValue")),"ThingyAppRefDataID")
[07/11/17 14:03:39.076]:ThingyBLD ST:                    arg-dn(token-local-variable("lvSearchDestDN"))
[07/11/17 14:03:39.076]:ThingyBLD ST:                      token-local-variable("lvSearchDestDN")
[07/11/17 14:03:39.076]:ThingyBLD ST:                        Token Value: "com\appsdata\Thingy\domain\main\organization".
[07/11/17 14:03:39.076]:ThingyBLD ST:                      Arg Value: "com\appsdata\Thingy\domain\main\organization".
[07/11/17 14:03:39.077]:ThingyBLD ST:                    Expanded variable reference '$lvSearchAttributeName$' to 'ThingyAppRefDataDisplayName'.
[07/11/17 14:03:39.077]:ThingyBLD ST:                    arg-match-attr("$lvSearchAttributeName$",token-local-variable("lvSearchAttributeValue"))
[07/11/17 14:03:39.077]:ThingyBLD ST:                      Expanded variable reference '$lvSearchAttributeName$' to 'ThingyAppRefDataDisplayName'.
[07/11/17 14:03:39.077]:ThingyBLD ST:                      arg-string(token-local-variable("lvSearchAttributeValue"))
[07/11/17 14:03:39.077]:ThingyBLD ST:                        token-local-variable("lvSearchAttributeValue")
[07/11/17 14:03:39.078]:ThingyBLD ST:                          Token Value: "Site Name - Site Thing".
[07/11/17 14:03:39.078]:ThingyBLD ST:                        Arg Value: "Site Name - Site Thing".
[07/11/17 14:03:39.078]:ThingyBLD ST:                    arg-string("ThingyAppRefDataID")
[07/11/17 14:03:39.078]:ThingyBLD ST:                      token-text("ThingyAppRefDataID")
[07/11/17 14:03:39.078]:ThingyBLD ST:                      Arg Value: "ThingyAppRefDataID".
[07/11/17 14:03:39.078]:ThingyBLD ST:                    Query from policy
[07/11/17 14:03:39.079]:ThingyBLD ST:                    
<nds dtdversion="4.0" ndsversion="8.x">
  <source>
    <product edition="Advanced" version="4.6.0.0">DirXML</product>
    <contact>NetIQ Corporation</contact>
  </source>
  <input>
    <query class-name="OrgAppRefData" dest-dn="com\appsdata\Thingy\domain\main\organization" scope="subtree">
      <search-class class-name="OrgAppRefData"/>
      <search-attr attr-name="ThingyAppRefDataDisplayName">
        <value type="string">Site Name - Site Thing</value>
      </search-attr>
      <read-attr attr-name="ThingyAppRefDataID"/>
    </query>
  </input>
</nds>
[07/11/17 14:03:39.079]:ThingyBLD ST:                    Pumping XDS to eDirectory.
[07/11/17 14:03:39.080]:ThingyBLD ST:                    Performing operation query for com\appsdata\Thingy\domain\main\organization.
[07/11/17 14:03:39.080]:ThingyBLD ST:                    --JCLNT-- \ORGIDV\com\services\IDM\IDV\ThingyBLD : Duplicating : context = 851771525, tempContext = 851772775
[07/11/17 14:03:39.083]:ThingyBLD ST:                    --JCLNT-- \ORGIDV\com\services\IDM\IDV\ThingyBLD : Calling free on tempContext = 851772775
[07/11/17 14:03:39.084]:ThingyBLD ST:                    Query from policy result
[07/11/17 14:03:39.084]:ThingyBLD ST:                    
<nds dtdversion="4.0" ndsversion="8.x">
  <source>
    <product edition="Advanced" version="4.6.0.0">DirXML</product>
    <contact>NetIQ Corporation</contact>
  </source>
  <output>
    <instance class-name="OrgAppRefData" qualified-src-dn="O=com\OU=appsdata\OU=Thingy\OU=domain\OU=main\OU=organization\OrgAppRefDataCN=595764" src-dn="\ORGIDV\com\appsdata\Thingy\domain\main\organization\595764" src-entry-id="5442480">
      <attr attr-name="ThingyAppRefDataID">
        <value timestamp="1499763849#4" type="string">595764</value>
      </attr>
    </instance>
    <status level="success"></status>
  </output>
</nds>
[07/11/17 14:03:39.085]:ThingyBLD ST:                    arg-dn(token-local-variable("lvSearchDestDN"))
[07/11/17 14:03:39.085]:ThingyBLD ST:                      token-local-variable("lvSearchDestDN")
[07/11/17 14:03:39.085]:ThingyBLD ST:                        Token Value: "com\appsdata\Thingy\domain\main\organization".
[07/11/17 14:03:39.085]:ThingyBLD ST:                      Arg Value: "com\appsdata\Thingy\domain\main\organization".
[07/11/17 14:03:39.086]:ThingyBLD ST:                    Expanded variable reference '$lvSearchAttributeName$' to 'ThingyAppRefDataDisplayName'.
[07/11/17 14:03:39.086]:ThingyBLD ST:                    arg-match-attr("$lvSearchAttributeName$",token-local-variable("lvSearchAttributeValue"))
[07/11/17 14:03:39.086]:ThingyBLD ST:                      Expanded variable reference '$lvSearchAttributeName$' to 'ThingyAppRefDataDisplayName'.
[07/11/17 14:03:39.086]:ThingyBLD ST:                      arg-string(token-local-variable("lvSearchAttributeValue"))
[07/11/17 14:03:39.086]:ThingyBLD ST:                        token-local-variable("lvSearchAttributeValue")
[07/11/17 14:03:39.087]:ThingyBLD ST:                          Token Value: "Site Name - Site Thing".
[07/11/17 14:03:39.087]:ThingyBLD ST:                        Arg Value: "Site Name - Site Thing".
[07/11/17 14:03:39.087]:ThingyBLD ST:                    arg-string("ThingyAppRefDataID")
[07/11/17 14:03:39.087]:ThingyBLD ST:                      token-text("ThingyAppRefDataID")
[07/11/17 14:03:39.087]:ThingyBLD ST:                      Arg Value: "ThingyAppRefDataID".
[07/11/17 14:03:39.088]:ThingyBLD ST:                    Query from policy
[07/11/17 14:03:39.088]:ThingyBLD ST:                    
<nds dtdversion="4.0" ndsversion="8.x">
  <source>
    <product edition="Advanced" version="4.6.0.0">DirXML</product>
    <contact>NetIQ Corporation</contact>
  </source>
  <input>
    <query class-name="OrgAppRefData" dest-dn="com\appsdata\Thingy\domain\main\organization" scope="subtree">
      <search-class class-name="OrgAppRefData"/>
      <search-attr attr-name="ThingyAppRefDataDisplayName">
        <value type="string">Site Name - Site Thing</value>
      </search-attr>
      <read-attr attr-name="ThingyAppRefDataID"/>
    </query>
  </input>
</nds>
[07/11/17 14:03:39.089]:ThingyBLD ST:                    Pumping XDS to eDirectory.
[07/11/17 14:03:39.089]:ThingyBLD ST:                    Performing operation query for com\appsdata\Thingy\domain\main\organization.
[07/11/17 14:03:39.089]:ThingyBLD ST:                    --JCLNT-- \ORGIDV\com\services\IDM\IDV\ThingyBLD : Duplicating : context = 851771525, tempContext = 851771893
[07/11/17 14:03:39.092]:ThingyBLD ST:                    --JCLNT-- \ORGIDV\com\services\IDM\IDV\ThingyBLD : Calling free on tempContext = 851771893
[07/11/17 14:03:39.092]:ThingyBLD ST:                    Query from policy result
[07/11/17 14:03:39.093]:ThingyBLD ST:                    
<nds dtdversion="4.0" ndsversion="8.x">
  <source>
    <product edition="Advanced" version="4.6.0.0">DirXML</product>
    <contact>NetIQ Corporation</contact>
  </source>
  <output>
    <instance class-name="OrgAppRefData" qualified-src-dn="O=com\OU=appsdata\OU=Thingy\OU=domain\OU=main\OU=organization\OrgAppRefDataCN=595764" src-dn="\ORGIDV\com\appsdata\Thingy\domain\main\organization\595764" src-entry-id="5442480">
      <attr attr-name="ThingyAppRefDataID">
        <value timestamp="1499763849#4" type="string">595764</value>
      </attr>
    </instance>
    <status level="success"></status>
  </output>
</nds>
[07/11/17 14:03:39.094]:ThingyBLD ST:                  Token Value: {<instance> @class-name = "OrgAppRefData" @qualified-src-dn = "O=com\OU=appsdata\OU=Thingy\OU=domain\OU=main\OU=organization\OrgAppRefDataCN=595764" @src-dn = "\ORGIDV\com\appsdata\Thingy\domain\main\organization\595764" @src-entry-id = "5442480"}.
[07/11/17 14:03:39.094]:ThingyBLD ST:                  Arg Value: {<instance> @class-name = "OrgAppRefData" @qualified-src-dn = "O=com\OU=appsdata\OU=Thingy\OU=domain\OU=main\OU=organization\OrgAppRefDataCN=595764" @src-dn = "\ORGIDV\com\appsdata\Thingy\domain\main\organization\595764" @src-entry-id = "5442480"}.
[07/11/17 14:03:39.095]:ThingyBLD ST:              Action: do-if().
[07/11/17 14:03:39.095]:ThingyBLD ST:                Evaluating conditions.
[07/11/17 14:03:39.095]:ThingyBLD ST:                  (if-xpath true "count($lvDataObjectNodeSet) = 1") = TRUE.
[07/11/17 14:03:39.095]:ThingyBLD ST:                Performing if actions.
[07/11/17 14:03:39.095]:ThingyBLD ST:                  Action: do-set-local-variable("lvThingyAppRefDataID",scope="policy",token-xpath("$lvDataObjectNodeSet//attr[@attr-name='ThingyAppRefDataID']/value/.")).
[07/11/17 14:03:39.096]:ThingyBLD ST:                    arg-string(token-xpath("$lvDataObjectNodeSet//attr[@attr-name='ThingyAppRefDataID']/value/."))
[07/11/17 14:03:39.096]:ThingyBLD ST:                      token-xpath("$lvDataObjectNodeSet//attr[@attr-name='ThingyAppRefDataID']/value/.")
[07/11/17 14:03:39.096]:ThingyBLD ST:                        Token Value: "595764".
[07/11/17 14:03:39.096]:ThingyBLD ST:                      Arg Value: "595764".
[07/11/17 14:03:39.097]:ThingyBLD ST:                  Action: do-trace-message(level="1","Local variable lvThingyAppRefDataID value is : "+token-local-variable("lvThingyAppRefDataID")).
[07/11/17 14:03:39.097]:ThingyBLD ST:                    arg-string("Local variable lvThingyAppRefDataID value is : "+token-local-variable("lvThingyAppRefDataID"))
[07/11/17 14:03:39.097]:ThingyBLD ST:                      token-text("Local variable lvThingyAppRefDataID value is : ")
[07/11/17 14:03:39.097]:ThingyBLD ST:                      token-local-variable("lvThingyAppRefDataID")
[07/11/17 14:03:39.097]:ThingyBLD ST:                        Token Value: "595764".
[07/11/17 14:03:39.098]:ThingyBLD ST:                      Arg Value: "Local variable lvThingyAppRefDataID value is : 595764".
[07/11/17 14:03:39.098]:ThingyBLD ST:Local variable lvThingyAppRefDataID value is : 595764
[07/11/17 14:03:39.098]:ThingyBLD ST:                  Action: do-add-src-attr-value("$lvDomain_Prefix_OrgSecuritySiteID$",token-local-variable("lvThingyAppRefDataID")).
[07/11/17 14:03:39.098]:ThingyBLD ST:                    Expanded variable reference '$lvDomain_Prefix_OrgSecuritySiteID$' to 'MainOrgSecuritySiteID'.
[07/11/17 14:03:39.099]:ThingyBLD ST:                    arg-string(token-local-variable("lvThingyAppRefDataID"))
[07/11/17 14:03:39.099]:ThingyBLD ST:                      token-local-variable("lvThingyAppRefDataID")
[07/11/17 14:03:39.099]:ThingyBLD ST:                        Token Value: "595764".
[07/11/17 14:03:39.099]:ThingyBLD ST:                      Arg Value: "595764".
[07/11/17 14:03:39.099]:ThingyBLD ST:              Action: do-if().
[07/11/17 14:03:39.099]:ThingyBLD ST:                Evaluating conditions.
[07/11/17 14:03:39.099]:ThingyBLD ST:                  (if-xpath true "count($lvDataObjectNodeSet) != 1") = FALSE.
[07/11/17 14:03:39.100]:ThingyBLD ST:                Performing else actions.
[07/11/17 14:03:39.100]:ThingyBLD ST:          Action: do-for-each(arg-node-set(token-xpath("*[@attr-name=lvDomain_Prefix_OrgSecuritySite]/remove-value"))).
[07/11/17 14:03:39.100]:ThingyBLD ST:            arg-node-set(token-xpath("*[@attr-name=lvDomain_Prefix_OrgSecuritySite]/remove-value"))
[07/11/17 14:03:39.100]:ThingyBLD ST:              token-xpath("*[@attr-name=lvDomain_Prefix_OrgSecuritySite]/remove-value")
[07/11/17 14:03:39.101]:ThingyBLD ST:              Token Value: {}.
[07/11/17 14:03:39.101]:ThingyBLD ST:              Arg Value: {}.
[07/11/17 14:03:39.101]:ThingyBLD ST:      Action: do-if().
[07/11/17 14:03:39.101]:ThingyBLD ST:        Evaluating conditions.
[07/11/17 14:03:39.101]:ThingyBLD ST:          (if-operation equal "sync") = FALSE.
[07/11/17 14:03:39.101]:ThingyBLD ST:        Performing else actions.
There's a bunch of setup, acquiring variables and stuff. In line #47, we see token-query:

Code:
token-query(class-name="OrgAppRefData",datastore="src",arg-dn(token-local-variable("lvSearchDestDN")),arg-match-attr("$lvSearchAttributeName$",token-local-variable("lvSearchAttributeValue")),"ThingyAppRefDataID")
There are some more lines showing variables resolved to values, then the query happens. You can see it "pumping" to eDirectory. You see the query from policy result, and the return document.

Then, you see some variables resolved to values, again, then the query happens again, complete with "pumping" to eDirectory, and a query reply.

Then it carries on like nothing unusual happened. I'm seeing this same sort of thing in multiple drivers (DelimText, Null, SOAP). Customer uses this same sort of construct all over the place, and have a large collection of objects under the \ORGIDV\com\appsdata structure.

It doesn't seem to be hurting anything. You can see that it carries on processing after the 2nd reply. But it does seem inefficient to have two queries happening where only one of them was actually necessary. I can't recall having seen anything like this before, so possibly a (new?) engine bug? Anybody else seeing this?