Okay, so this gave me the hint I needed. I did need to add a single entry for userAccountControl to my schema and (I think) add an rwm-map for the attribute to my meta configuration. Working now.
Is "UserAccountControl" known in the proxy's schema? > > p. >
