Scenario:

I want to trigger discrete delta changes (modifies) from the source
event (add, sync or modify) that are sequenced after the actual source
event.

Input event is not yet associated.

<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.5.4.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<input>
<add cached-time="20160823075500.917Z" class-name="User"
event-id="123456789#20160819095605#person#2096:aabbccdd-1234-5678-abcd-0
01122334455"
qualified-src-dn="O=IDV\OU=Data\OU=Users\OU=Student\CN=012345"
src-dn="\IDV-T-TREE\IDV\Data\Users\Student\012345" src-entry-id="12345"
timestamp="1471938900#82">
<add-attr attr-name="Given Name">
<value timestamp="1471938900#82" type="string">Test</value>
</add-attr>
<add-attr attr-name="Surname">
<value timestamp="1471938900#81" type="string">User</value>
</add-attr>
</add>
</input>
</nds>

Service ST:Applying policy:
%+C%14Csub-etp-User-Student-InitialPassword%-C.
Service ST: Applying to add #1.
Service ST: Evaluating selection criteria for rule 'Generate Initial
Student Password Phrase'.
Service ST: (if-class-name equal "User") = TRUE.

Service ST: (if-attr 'employeeType' equal "student") = TRUE.
Service ST: (if-src-attr 'nspmDistributionPassword' not-available)
= TRUE.
Rule selected.
Applying rule 'Generate Student Password Phrase from mapping table'.'

<Irrelevant logic snipped>

Service ST: Action:
do-set-dest-password(when="after",token-local-variable("strPassPhrase"))
..
Service ST: arg-string(token-local-variable("strPassPhrase"))
Service ST: token-local-variable("strPassPhrase")
Service ST: Token Value: "-- suppressed --".
Service ST: Arg Value: "-- suppressed --".
Service ST:Policy returned:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.5.4.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<input>
<add cached-time="20160823075500.917Z" class-name="User"
event-id="123456789#20160819095605#person#2096:aabbccdd-1234-5678-abcd-0
01122334455"
qualified-src-dn="O=IDV\OU=Data\OU=Users\OU=Student\CN=012345"
src-dn="\IDV-T-TREE\IDV\Data\Users\Student\012345" src-entry-id="12345"
timestamp="1471938900#82">
<add-attr attr-name="Given Name">
<value timestamp="1471938900#82" type="string">Test</value>
</add-attr>
<add-attr attr-name="Surname">
<value timestamp="1471938900#81" type="string">User</value>
</add-attr>
<password><!-- content suppressed --></password>
</add>
</input>
</nds>

Why doesn't this generate a separate modify when I use when="after"?