Bad form replying to myself, I know, but...
.... which claims, in slapd.conf comments, that "Only one
proxyattrset definition may appear for any cache set".
Which was completely the wrong quote. It should have read:
"A given attribute may only appear in one proxyattrset"