diff --git a/ceo/HEARTBEAT.md b/ceo/HEARTBEAT.md
index 4276044..85d57ec 100644
--- a/ceo/HEARTBEAT.md
+++ b/ceo/HEARTBEAT.md
@@ -85,6 +85,12 @@ This repo (`/paperclip/privilegedescalation/agents`) is the canonical source of
     LAST_SHA=$(cat /paperclip/privilegedescalation/agents/ceo/.last-synced-sha 2>/dev/null || echo "")
     CURRENT_SHA=$(git -C /paperclip/privilegedescalation/agents rev-parse HEAD)
 
+If `LAST_SHA` is non-empty, verify it still exists in the local history (it may be gone after a force-push or shallow clone):
+
+    if [ -n "$LAST_SHA" ] && \! git -C /paperclip/privilegedescalation/agents cat-file -e "$LAST_SHA" 2>/dev/null; then
+      LAST_SHA=""  # unreachable — treat as full resync
+    fi
+
 If `LAST_SHA` is empty or equals `CURRENT_SHA`, skip to step 5. Otherwise:
 
     git -C /paperclip/privilegedescalation/agents diff "$LAST_SHA".."$CURRENT_SHA" --name-only