Why does the first instance fail?

11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.5.10.20070918 ">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<output>
<instance class-name="Group" qualified-src-dn="O=cml\CN=BDGRP"
src-dn="\CML_DEV\cml\BDGRP" src-entry-id="34651"/>
<instance class-name="Group" qualified-src-dn="O=cml\CN=TestOneJims"
src-dn="\CML_DEV\cml\TestOneJims" src-entry-id="35794">
<association state="associated">\CML_DEV\cml\TestOneJims</association>
</instance>
<status level="success"></status>
</output>
</nds>
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Token Value: {<instance>
@class-name = "Group" @qualified-src-dn = "O=cml\CN=BDGRP" @src-dn =
"\CML_DEV\cml\BDGRP" @src-entry-id = "34651",<instance> @class-name =
"Group" @qualified-src-dn = "O=cml\CN=TestOneJims" @src-dn =
"\CML_DEV\cml\TestOneJims" @src-entry-id = "35794"}.
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Arg Value: {<instance>
@class-name = "Group" @qualified-src-dn = "O=cml\CN=BDGRP" @src-dn =
"\CML_DEV\cml\BDGRP" @src-entry-id = "34651",<instance> @class-name =
"Group" @qualified-src-dn = "O=cml\CN=TestOneJims" @src-dn =
"\CML_DEV\cml\TestOneJims" @src-entry-id = "35794"}.
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Action:
do-for-each(arg-node-set(token-local-variable("lv-addgroups"))).
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
arg-node-set(token-local-variable("lv-addgroups"))
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
token-local-variable("lv-addgroups")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Token Value: {<instance>
@class-name = "Group" @qualified-src-dn = "O=cml\CN=BDGRP" @src-dn =
"\CML_DEV\cml\BDGRP" @src-entry-id = "34651",<instance> @class-name =
"Group" @qualified-src-dn = "O=cml\CN=TestOneJims" @src-dn =
"\CML_DEV\cml\TestOneJims" @src-entry-id = "35794"}.
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Arg Value: {<instance>
@class-name = "Group" @qualified-src-dn = "O=cml\CN=BDGRP" @src-dn =
"\CML_DEV\cml\BDGRP" @src-entry-id = "34651",<instance> @class-name =
"Group" @qualified-src-dn = "O=cml\CN=TestOneJims" @src-dn =
"\CML_DEV\cml\TestOneJims" @src-entry-id = "35794"}.
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Performing actions for
local-variable(current-node) = <instance> @class-name = "Group"
@qualified-src-dn = "O=cml\CN=BDGRP" @src-dn = "\CML_DEV\cml\BDGRP"
@src-entry-id = "34651".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Action:
do-trace-message(level="3","Adding to Group
"+token-local-variable("current-node")).
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: arg-string("Adding to
Group "+token-local-variable("current-node"))
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: token-text("Adding to
Group ")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
token-local-variable("current-node")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Token Value: "".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Arg Value: "Adding to
Group ".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:Adding to Group
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Action:
do-add-src-attr-value("Group
Membership",token-local-variable("current-node")).
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
arg-string(token-local-variable("current-node"))
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
token-local-variable("current-node")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Token Value: "".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Arg Value: "".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Action:
do-add-src-attr-value("Security
Equals",token-local-variable("current-node")).
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
arg-string(token-local-variable("current-node"))
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
token-local-variable("current-node")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Token Value: "".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Arg Value: "".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Performing actions for
local-variable(current-node) = <instance> @class-name = "Group"
@qualified-src-dn = "O=cml\CN=TestOneJims" @src-dn =
"\CML_DEV\cml\TestOneJims" @src-entry-id = "35794".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Action:
do-trace-message(level="3","Adding to Group
"+token-local-variable("current-node")).
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: arg-string("Adding to
Group "+token-local-variable("current-node"))
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: token-text("Adding to
Group ")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
token-local-variable("current-node")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Token Value:
"\CML_DEV\cml\TestOneJims".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Arg Value: "Adding to
Group \CML_DEV\cml\TestOneJims".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:Adding to Group
\CML_DEV\cml\TestOneJims
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Action:
do-add-src-attr-value("Group
Membership",token-local-variable("current-node")).
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
arg-string(token-local-variable("current-node"))
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
token-local-variable("current-node")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Token Value:
"\CML_DEV\cml\TestOneJims".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Arg Value:
"\CML_DEV\cml\TestOneJims".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Action:
do-add-src-attr-value("Security
Equals",token-local-variable("current-node")).
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
arg-string(token-local-variable("current-node"))
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
token-local-variable("current-node")
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Token Value:
"\CML_DEV\cml\TestOneJims".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Arg Value:
"\CML_DEV\cml\TestOneJims".
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Evaluating selection
criteria for rule 'User: cml-LocationCode Changing'.
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: (if-op-attr
'cml_LocationCode' changing) = FALSE.
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Rule rejected.
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST: Direct command from policy
11:47:39 5AA864E0 Drvrs: eDirGroupLoopBack ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.5.10.20070918 ">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<modify class-name="User" dest-dn="\CML_DEV\cml\AD\TWHITE"
dest-entry-id="35790" event-id="EDIR#20080319164739#1#1">
<association>\CML_DEV\cml\AD\TWHITE</association>
<modify-attr attr-name="Group Membership">
<add-value>
<value type="dn"/>
</add-value>
</modify-attr>
<modify-attr attr-name="Security Equals">
<add-value>
<value type="dn"/>
</add-value>
</modify-attr>
<modify-attr attr-name="Group Membership">
<add-value>
<value type="dn">\CML_DEV\cml\TestOneJims</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Security Equals">
<add-value>
<value type="dn">\CML_DEV\cml\TestOneJims</value>
</add-value>
</modify-attr>
</modify>
</input>
</nds>


<actions>
<do-set-local-variable name="lv-cmllocationcode" scope="policy">
<arg-string>
<token-attr name="cml-LocationCode"/>
<token-text xml:space="preserve">|</token-text>
<token-op-attr name="jobCode"/>
</arg-string>
</do-set-local-variable>
<do-set-local-variable name="lv-addgroups" scope="policy">
<arg-node-set>
<token-query class-name="Group" datastore="src" scope="subtree">
<arg-match-attr name="cml-LocationCode">
<arg-value name="cml_loccode" type="string">
<token-local-variable name="lv-cmllocationcode"/>
</arg-value>
</arg-match-attr>
<arg-string>
<token-src-dn/>
</arg-string>
</token-query>
</arg-node-set>
</do-set-local-variable>
<do-for-each>
<arg-node-set>
<token-local-variable name="lv-addgroups"/>
</arg-node-set>
<arg-actions>
<do-trace-message level="3">
<arg-string>
<token-text xml:space="preserve">Adding to Group </token-text>
<token-local-variable name="current-node"/>
</arg-string>
</do-trace-message>
<do-add-src-attr-value name="Group Membership">
<arg-value type="dn">
<token-local-variable name="current-node"/>
</arg-value>
</do-add-src-attr-value>
<do-add-src-attr-value name="Security Equals">
<arg-value type="dn">
<token-local-variable name="current-node"/>
</arg-value>
</do-add-src-attr-value>
</arg-actions>
</do-for-each>
</actions>