Read EVERY well-formed key=value token from a comment as raw facts —
no allowlist filter, no warnings, no setting coercion. This is the
device-class selector surface (--where): derived facts a record carries in
its comment (e.g. board=RB5009, version=7.23.1) are real selectors here,
even though they are NOT settings (so parseCommentKv drops them with a
cdb/unknown-option warning). Last token wins on a duplicate bare key. Core
CDB fields (target/identity/group/mac) are layered ON TOP of this map
by the selector and win, so a hand-written group=/target= comment token
can never spoof a first-class field.
Read EVERY well-formed
key=valuetoken from a comment as raw facts — no allowlist filter, no warnings, no setting coercion. This is the device-class selector surface (--where): derived facts a record carries in its comment (e.g.board=RB5009,version=7.23.1) are real selectors here, even though they are NOT settings (so parseCommentKv drops them with acdb/unknown-optionwarning). Last token wins on a duplicate bare key. Core CDB fields (target/identity/group/mac) are layered ON TOP of this map by the selector and win, so a hand-writtengroup=/target=comment token can never spoof a first-class field.