CLAIM-2026-09-21-03

Git resolves a name as a ref before treating it as an object id, so a branch named with the 40-hex pinned SHA is checked out instead of the pinned commit, with only a "refname is ambiguous" warning.

Why it matters

This is standard documented git behaviour, not a git bug. Any tool that pins by SHA and checks out by name inherits it.

Sources

• airsecurity2026pluginshe