Ok I am posting some traces in this thread. Here is the scenario:

Trace "bender.bad" is the vault server
Trace "cubert.bad" is the connected edirdir server


scenario:

1. account "jeff" exists in vault and connected tree. It is not associated or linked
2. login to jeff in connected tree and change password
3. password syncs to the vault tree and i can login with new password in vault
4. Problem is the vault tree has the dirxml-association on jeff. The
connected system has no dirxml-association at all!

In the connected system jeff has an attribute dirxml-passwordsyncstatus,
as i said no dirxml-association.

interestingly, after this merge i can change passwords in either system
and they are syncing properly. So is dirxml-passwordsyncstatus now used in
place of dirxml-association in some circumstances????