This comes from stgao's observation in (go/audit-configuration-for-dynamic-refs) :

'There is a potential race condition here:
1. Audit App scan ref 1000.
2. A dev landed a new commit X in ref 1000.
3. Release eng cut a new branch, and ref becomes "old" as defined here.
4. Audit App scan again: if we ignore ref 1000, we would miss commit X there.

One potential solution is: for "old" refs here, still scan them if they are only 1 day old for example.'