Normally in a merge, the engine gets the App data (via a query) or the
IDV data, and then queries the other side, per the query.

Now assume you have a stupid API (Looking at you Workday) that does not
let you filter attributes, instead it returns EVERY attribute for any
query? Then assume you convert the SOAP to XDS each time and do not do
additional filtering.

So if your filter had 3 attributes, but your API returns 12 every time,
on a merge, the engne would get the 3 from IDV properly (It honours the
filter), 12 from the App (does not per se honour the filter properly)
and then on the merge comes the question.

Would the 9 extra attrs inn the App get sent to IDV on the merge? In
principle if the engine did a second pass of validating the attrs in
flow after the merge, but if it relies on the Query returning only the
proper data, then you might get extra.

I am seeing that extra, which makes me think it might now. Curious if
anyone else knows or has thoughts.

IDM 4.5.4 I think at the moment, but this should be pretty low level
behavior that I doubt they have updated much.