The SID history is not syncing despite the having met all the prerequisites in the documentation below.
In the log, when the SID History syncs, you see an "access is denied". All other attributes sync, expect for SID history
Add the target service account (used by the DS Agent service) to the built-in container administrator group on the source domain controller.
The documentation will be updated.