https://bugs.openldap.org/show_bug.cgi?id=9538
--- Comment #3 from Ondřej Kuzník ondra@mistotebe.net --- Discussing this with Howard, the intention is that non-write ops never get a CSN associated with them. If they cause a write, e.g. account lockouts from ppolicy, that should be self-contained in its own operation. We should be able to proceed on that basis, looking to fix any other code that violates this if issues come up.
I'll see if that gets us any further.