For an incremental with entity attributes, on the first try, it's going from a change entry, and has the group id and member id. If it fails, the second time it's going from the error history, and an entity attribute provisioner doesn't provision groups, so there is no group id for the event. Thus, even though it wants to recalc the entity, it ignores the membership attribute since it needs the group for that, and doesn't compare it to notice it needs to update.

I also notice that there is a method GrouperProvisionerTargetDaoAdapter.setExceptionForMembershipsWhenGroupOrEntityAttributes() which is supposed to propagate entity errors to the memberships. It populates the error message but not the error code, so they are not always detected as error conditions in other methods.