Ken:
Excellent help, thanks. I'm an LDAP house mostly (I provide for "outside" accounts strictly through hand creation), and have never used password salts (I'm embarrassed to say). But what I'm hearing is that we should be able to depend on course imports to bring in users as needed, eh? Yes, most courses will come in "reset," but some must make the trip with student content. We have a "teacher community" course (probably similar to the one housing the forums in moodle.org) which I'm bringing in with everything. That should bring in most all of the teachers at least.
As for the course #'s, yeah, that's what I figured. Since my goal is to shed dead content, I may attempt an upgrade after removing all the courses identified as dead from the "opt-in" migration feedback, just to preserve the #'s. But then, I've already warned everybody, so I'll try that only if I have the time.
Beyond simple links, I do have an MNET/SSO Mahara install which concerns me, but as long as LDAP picks up the same credentials, they should be able to wander in there and find their stuff -- same unique identifier comin' across. Any flaws in my thinking there? That, of course, has yet to be tested...
As for the "big bucks," well, I spect you know how that goes. I'm a former math teacher-turned-district tech resource teacher on an ordinary 10 month teacher calendar who just believes in this enough to make it work. There are a few things more important than money. (I'm not sure this is one of them, but then, we're goin' with that... )
Thanks again.