CoPersonRole::reconcileCouMembersGroupMemberships assumes there is only one entry for a given COU, and doesn't check for other roles in the same COU. eg: If there are two Active roles in the same COU, and one is set to Expired, the associated Members:COU group will be removed even though there is still an Active role.