I'm using salesforce Entitlements and Cases in our org. I'm stamping the a field called "Triage Violation D/T" via a field update as part of an Entitlements Violation Action. This works flawlessly when things get violated, and can be pulled into a base report when it actually was violated. My support team triages a case (identify products and other details) which fires another field update on a field called "Triage D/T". This works flawless too. 

I'm trying to setup another Workflow which is using Time-Dependent actions, 2 email alerts. One should fire after 1 hour from the Rule Trigger Date, and the second email will fire 4 hours after the Rule Trigger Date.  The point of this is to let management know when things get violated and are still outstanding 1hr and 4 hours after the voilation has occured (not been resolved, aka no Triage D/T). This effectively gives support a buffer to finish the triage before management gets the email. The time stamping still allows management to see what was violated at any point in time. I've got the below Workflow setup on the case with the following Rule Criteria:

Evaluation Criteria: When a record is created, or when a record is edited and did not previously meet the rule criteria

(Case: Case Record Type EQUALS Support)

AND

(Case: Triage Violation D/T NOT EQUAL TO null)

AND

(Case: Triage D/T EQUALS null)

The alerts work great if I manually modify the the case fields "Triage Violation D/T" to any value, and leave "Triage D/T" blank. I check the Monitoring Time-Based Workflow section of setup and everything is firing correctly. 

But, when I let the whole system take its natural course, creating the case and letting the violation happen without triaging the case nothing queues up for the email alerts? I know its not the Entitlements Violation Actions Field Update as it is firing fine on all my test cases (Triage Violation D/T), so thats not the problem. I even had the Field Update set to "Re-evaluate Workflow Rules after Field Change" to TRUE. Anyone have an idea of whats going on? I'm guessing im missing one simple switch somewhere?

Seeing is believing:

The Triage Workflow:

The Entitlement Milestone Action:

The Field Update from the Milestone: