I haven’t experimented with any “automatically grant trust level” settings.
But AFAIK trust_level_3 is revocable.. That is, after the “grace” period, if the qualifications aren’t met the account is removed from the group.
I believe the grace period is two weeks.
I’ll look at some code as soon as I can, but my guess is the problem involves referencing different timestamp fields.