Yes, it's really messy.
Thanks, I know.
actually my desperate need for this made me overcome my laziness. i compiled the slapd from source, run the tests, immediately after the test045 copied the slapd.1. ...slapd.3.conf files. this made me understand what is really going on there.
my understanding is that i need to run two instances of slapd on master (master + proxy) proxy is pulling down changes from master and stores them in it's backend (ldap backend pointing to slave server) all the rest is question of acl's.
can you correct me please, if i'm wrong. trying to implement it right now.
You can do it in one slapd configuration/instance.