Okay, so this gave me the hint I needed.  I did need to add a single entry for userAccountControl to my schema and (I think) add an rwm-map for the attribute to my meta configuration.  Working now. 

Is "UserAccountControl" known in the proxy's schema?

p.