diff --git a/.github/workflows/sovereign-ci.yml b/.github/workflows/sovereign-ci.yml
index e1d7fd8..c3f8291 100644
--- a/.github/workflows/sovereign-ci.yml
+++ b/.github/workflows/sovereign-ci.yml
@@ -106,12 +106,20 @@ jobs:
             [ "$repo" = "${{ inputs.repo }}" ] && continue
             # Remove stale partial clones (file instead of dir)
             if [ -e "$repo" ] && [ ! -d "$repo" ]; then rm -f "$repo"; fi
+            # Validate cached clone. If HEAD missing or fetch fails, nuke + re-clone.
+            # Silent `|| true` on fetch previously masked broken caches (bashrs#197).
             if [ -d "$repo" ]; then
-              # Pull latest to avoid stale cached versions
-              git -C "$repo" fetch --depth 1 origin main 2>/dev/null && git -C "$repo" reset --hard FETCH_HEAD 2>/dev/null || true
-            else
+              if ! git -C "$repo" rev-parse HEAD >/dev/null 2>&1; then
+                echo "::warning::$repo cache invalid (no HEAD) — re-cloning"
+                rm -rf "$repo"
+              elif ! (git -C "$repo" fetch --depth 1 origin main 2>&1 && git -C "$repo" reset --hard FETCH_HEAD >/dev/null 2>&1); then
+                echo "::warning::$repo fetch failed — re-cloning"
+                rm -rf "$repo"
+              fi
+            fi
+            if [ ! -d "$repo" ]; then
               for attempt in 1 2 3; do
-                git clone --depth 1 --quiet "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
+                git clone --depth 1 "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
                 rm -rf "$repo"  # Clean failed clone before retry
                 echo "::warning::Retry $attempt for $repo clone"
                 sleep 2
@@ -226,12 +234,20 @@ jobs:
             [ "$repo" = "${{ inputs.repo }}" ] && continue
             # Remove stale partial clones (file instead of dir)
             if [ -e "$repo" ] && [ ! -d "$repo" ]; then rm -f "$repo"; fi
+            # Validate cached clone. If HEAD missing or fetch fails, nuke + re-clone.
+            # Silent `|| true` on fetch previously masked broken caches (bashrs#197).
             if [ -d "$repo" ]; then
-              # Pull latest to avoid stale cached versions
-              git -C "$repo" fetch --depth 1 origin main 2>/dev/null && git -C "$repo" reset --hard FETCH_HEAD 2>/dev/null || true
-            else
+              if ! git -C "$repo" rev-parse HEAD >/dev/null 2>&1; then
+                echo "::warning::$repo cache invalid (no HEAD) — re-cloning"
+                rm -rf "$repo"
+              elif ! (git -C "$repo" fetch --depth 1 origin main 2>&1 && git -C "$repo" reset --hard FETCH_HEAD >/dev/null 2>&1); then
+                echo "::warning::$repo fetch failed — re-cloning"
+                rm -rf "$repo"
+              fi
+            fi
+            if [ ! -d "$repo" ]; then
               for attempt in 1 2 3; do
-                git clone --depth 1 --quiet "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
+                git clone --depth 1 "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
                 rm -rf "$repo"  # Clean failed clone before retry
                 echo "::warning::Retry $attempt for $repo clone"
                 sleep 2
@@ -349,12 +365,20 @@ jobs:
             [ "$repo" = "${{ inputs.repo }}" ] && continue
             # Remove stale partial clones (file instead of dir)
             if [ -e "$repo" ] && [ ! -d "$repo" ]; then rm -f "$repo"; fi
+            # Validate cached clone. If HEAD missing or fetch fails, nuke + re-clone.
+            # Silent `|| true` on fetch previously masked broken caches (bashrs#197).
             if [ -d "$repo" ]; then
-              # Pull latest to avoid stale cached versions
-              git -C "$repo" fetch --depth 1 origin main 2>/dev/null && git -C "$repo" reset --hard FETCH_HEAD 2>/dev/null || true
-            else
+              if ! git -C "$repo" rev-parse HEAD >/dev/null 2>&1; then
+                echo "::warning::$repo cache invalid (no HEAD) — re-cloning"
+                rm -rf "$repo"
+              elif ! (git -C "$repo" fetch --depth 1 origin main 2>&1 && git -C "$repo" reset --hard FETCH_HEAD >/dev/null 2>&1); then
+                echo "::warning::$repo fetch failed — re-cloning"
+                rm -rf "$repo"
+              fi
+            fi
+            if [ ! -d "$repo" ]; then
               for attempt in 1 2 3; do
-                git clone --depth 1 --quiet "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
+                git clone --depth 1 "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
                 rm -rf "$repo"  # Clean failed clone before retry
                 echo "::warning::Retry $attempt for $repo clone"
                 sleep 2
@@ -466,12 +490,20 @@ jobs:
             [ "$repo" = "${{ inputs.repo }}" ] && continue
             # Remove stale partial clones (file instead of dir)
             if [ -e "$repo" ] && [ ! -d "$repo" ]; then rm -f "$repo"; fi
+            # Validate cached clone. If HEAD missing or fetch fails, nuke + re-clone.
+            # Silent `|| true` on fetch previously masked broken caches (bashrs#197).
             if [ -d "$repo" ]; then
-              # Pull latest to avoid stale cached versions
-              git -C "$repo" fetch --depth 1 origin main 2>/dev/null && git -C "$repo" reset --hard FETCH_HEAD 2>/dev/null || true
-            else
+              if ! git -C "$repo" rev-parse HEAD >/dev/null 2>&1; then
+                echo "::warning::$repo cache invalid (no HEAD) — re-cloning"
+                rm -rf "$repo"
+              elif ! (git -C "$repo" fetch --depth 1 origin main 2>&1 && git -C "$repo" reset --hard FETCH_HEAD >/dev/null 2>&1); then
+                echo "::warning::$repo fetch failed — re-cloning"
+                rm -rf "$repo"
+              fi
+            fi
+            if [ ! -d "$repo" ]; then
               for attempt in 1 2 3; do
-                git clone --depth 1 --quiet "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
+                git clone --depth 1 "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
                 rm -rf "$repo"  # Clean failed clone before retry
                 echo "::warning::Retry $attempt for $repo clone"
                 sleep 2
@@ -584,12 +616,20 @@ jobs:
             [ "$repo" = "${{ inputs.repo }}" ] && continue
             # Remove stale partial clones (file instead of dir)
             if [ -e "$repo" ] && [ ! -d "$repo" ]; then rm -f "$repo"; fi
+            # Validate cached clone. If HEAD missing or fetch fails, nuke + re-clone.
+            # Silent `|| true` on fetch previously masked broken caches (bashrs#197).
             if [ -d "$repo" ]; then
-              # Pull latest to avoid stale cached versions
-              git -C "$repo" fetch --depth 1 origin main 2>/dev/null && git -C "$repo" reset --hard FETCH_HEAD 2>/dev/null || true
-            else
+              if ! git -C "$repo" rev-parse HEAD >/dev/null 2>&1; then
+                echo "::warning::$repo cache invalid (no HEAD) — re-cloning"
+                rm -rf "$repo"
+              elif ! (git -C "$repo" fetch --depth 1 origin main 2>&1 && git -C "$repo" reset --hard FETCH_HEAD >/dev/null 2>&1); then
+                echo "::warning::$repo fetch failed — re-cloning"
+                rm -rf "$repo"
+              fi
+            fi
+            if [ ! -d "$repo" ]; then
               for attempt in 1 2 3; do
-                git clone --depth 1 --quiet "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
+                git clone --depth 1 "https://github.com/paiml/$repo.git" "$repo" 2>&1 && break
                 rm -rf "$repo"  # Clean failed clone before retry
                 echo "::warning::Retry $attempt for $repo clone"
                 sleep 2