diff --git a/.changeset/fix-bashrc-merge-bash-in-bash-issue.md b/.changeset/fix-bashrc-merge-bash-in-bash-issue.md
new file mode 100644
index 0000000..0d0cf15
--- /dev/null
+++ b/.changeset/fix-bashrc-merge-bash-in-bash-issue.md
@@ -0,0 +1,5 @@
+---
+bump: patch
+---
+
+fix: .bashrc merge algorithm corrupted multi-line shell constructs (issue #66)
diff --git a/Dockerfile b/Dockerfile
index ebf63dd..84fccf9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -134,14 +134,28 @@ COPY --from=lean-stage --chown=sandbox:sandbox /home/sandbox/.bashrc /tmp/.bashr
 COPY --from=rocq-stage --chown=sandbox:sandbox /home/sandbox/.bashrc /tmp/.bashrc-rocq
 
 # Merge bashrc configurations: take the essentials bashrc as base,
-# then append unique lines from each language stage
+# then append sections from each language stage that are not yet present.
+# Uses section-header deduplication (checks for unique "# <Tool> configuration"
+# comment) to avoid corrupting multi-line shell constructs (if/fi blocks) that
+# would break when individual lines like bare "fi" are deduplicated.
 RUN cp /home/sandbox/.bashrc /tmp/.bashrc-base && \
     for lang_bashrc in /tmp/.bashrc-python /tmp/.bashrc-go /tmp/.bashrc-rust \
       /tmp/.bashrc-java /tmp/.bashrc-kotlin /tmp/.bashrc-ruby /tmp/.bashrc-php \
       /tmp/.bashrc-perl /tmp/.bashrc-swift /tmp/.bashrc-lean /tmp/.bashrc-rocq; do \
       if [ -f "$lang_bashrc" ]; then \
+        in_new_section=0; \
+        section_header=""; \
         while IFS= read -r line; do \
-          if [ -n "$line" ] && ! grep -qxF "$line" /tmp/.bashrc-base 2>/dev/null; then \
+          if echo "$line" | grep -qE '^# .+ configuration$'; then \
+            section_header="$line"; \
+            if grep -qxF "$section_header" /tmp/.bashrc-base 2>/dev/null; then \
+              in_new_section=0; \
+            else \
+              in_new_section=1; \
+              echo "" >> /tmp/.bashrc-base; \
+              echo "$section_header" >> /tmp/.bashrc-base; \
+            fi; \
+          elif [ "$in_new_section" = "1" ]; then \
             echo "$line" >> /tmp/.bashrc-base; \
           fi; \
         done < "$lang_bashrc"; \
diff --git a/docs/case-studies/issue-66/CASE-STUDY.md b/docs/case-studies/issue-66/CASE-STUDY.md
new file mode 100644
index 0000000..50d8fe2
--- /dev/null
+++ b/docs/case-studies/issue-66/CASE-STUDY.md
@@ -0,0 +1,219 @@
+# Case Study: Issue #66 — bash syntax error when running `bash` inside `bash`
+
+## Executive Summary
+
+Running `bash` (or `sh`, `zsh`) inside an already-running bash session in the sandbox container produces a fatal syntax error:
+
+```
+bash: /home/sandbox/.bashrc: line 167: syntax error: unexpected end of file
+```
+
+**Root cause**: The `.bashrc` merge algorithm in the Dockerfile used line-level deduplication. It skipped any line already present in the base `.bashrc`. Since the base `.bashrc` already contains several standalone `fi` lines (closing Ubuntu's built-in `if` blocks), the `fi` that closes the Perlbrew `if [ -n "$PS1" ]; then ... fi` block was silently discarded, leaving an unclosed `if` — which produces the "unexpected end of file" syntax error every time bash starts.
+
+**Secondary finding**: SDKMAN's `.bashrc` snippet used bash-specific `[[ ]]` double-bracket syntax and `source` instead of POSIX `.`, which would fail when `.bashrc` is sourced under `/bin/sh` (dash on Ubuntu).
+
+---
+
+## 1. Data Collection
+
+### 1.1 Error Reproduction
+
+The reported error:
+
+```
+konard@MacBook-Pro-Konstantin ~ % $ --isolated docker --image konard/sandbox:1.3.14 -- bash
+$ bash
+bash: /home/sandbox/.bashrc: line 167: syntax error: unexpected end of file
+```
+
+This error occurs when:
+1. Container starts → `entrypoint.sh` sources `~/.bashrc` (works, because `entrypoint.sh` is already running bash)
+2. User runs `bash` → new bash process starts, tries to source `~/.bashrc`
+3. `~/.bashrc` has a syntax error (unclosed `if`) → bash reports it and aborts
+
+The same error occurs with any interactive bash invocation: `bash`, `bash -i`, `bash --login`, `sh`.
+
+### 1.2 .bashrc Generation
+
+The `~/.bashrc` for the sandbox user is not a static file — it is constructed at Docker image build time by the Dockerfile's merge step (lines 136–152 in root `Dockerfile`, lines 155–171 in `ubuntu/24.04/full-sandbox/Dockerfile`).
+
+The merge algorithm:
+1. Takes the essentials-sandbox `.bashrc` as the base
+2. For each of 11 language stages (python, go, rust, java, kotlin, ruby, php, perl, swift, lean, rocq), reads each line of that language's `.bashrc`
+3. Appends each line **only if it is not already present** in the base (`grep -qxF "$line"`)
+
+### 1.3 How the Bug Manifests
+
+Ubuntu's `/etc/skel/.bashrc` (which forms the starting `.bashrc`) already contains multiple standalone `fi` lines at the top level:
+
+```bash
+if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
+    debian_chroot=$(cat /etc/debian_chroot)
+fi   ← standalone 'fi' in base
+
+if [ "$TERM" = "xterm-color" ] ...; then
+    color_prompt=yes
+fi   ← standalone 'fi' in base
+```
+
+The Perl stage adds this block to its `.bashrc`:
+
+```bash
+# Perlbrew configuration
+if [ -n "$PS1" ]; then
+  export PERLBREW_ROOT="$HOME/.perl5"
+  [ -f "$PERLBREW_ROOT/etc/bashrc" ] && source "$PERLBREW_ROOT/etc/bashrc"
+fi   ← this 'fi' gets deduplicated!
+```
+
+When the merge algorithm processes Perl's `.bashrc`, it reaches the closing `fi`. The `grep -qxF "fi"` check finds that `fi` is **already in the base** (from Ubuntu's `if` blocks). So the `fi` is **skipped**. The result in the merged `.bashrc`:
+
+```bash
+# Perlbrew configuration
+if [ -n "$PS1" ]; then            ← if block opens
+  export PERLBREW_ROOT="$HOME/.perl5"
+  [ -f "$PERLBREW_ROOT/etc/bashrc" ] && source "$PERLBREW_ROOT/etc/bashrc"
+                                  ← fi was SKIPPED by deduplication!
+```
+
+This unclosed `if` causes bash to report:
+```
+bash: /home/sandbox/.bashrc: line N: syntax error: unexpected end of file
+```
+
+### 1.4 Experiment Reproduction
+
+A reproducible test is available at `experiments/test-bashrc-merge.sh`. Running it confirms:
+
+```
+Old algorithm produces syntax error:
+/tmp/.bashrc-merged: line 57: syntax error: unexpected end of file
+  -> SYNTAX ERROR (bug reproduced!)
+
+Lines skipped (already in base):
+  SKIPPED: 'fi'   ← Perlbrew's closing fi was lost
+```
+
+---
+
+## 2. Root Cause Analysis
+
+### 2.1 Primary Root Cause: Line-Level Deduplication Breaks Multi-Line Constructs
+
+The merge algorithm treats each line in isolation. Shell `if/fi` blocks span **multiple lines** with structural relationships between them. A closing `fi` has meaning only in the context of its opening `if`. Line-level deduplication cannot preserve this relationship.
+
+Any line that appears as a "structural token" in shell syntax — `fi`, `done`, `esac`, `}` — is a deduplication collision hazard if such a token already exists elsewhere in the base file.
+
+**Affected code:**
+- `Dockerfile` lines 136–152
+- `ubuntu/24.04/full-sandbox/Dockerfile` lines 155–171
+
+### 2.2 Secondary Issue: Bash-Specific Syntax in `.bashrc`
+
+The SDKMAN install sections in `java/install.sh`, `kotlin/install.sh`, and `full-sandbox/install.sh` write:
+
+```bash
+[[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ]] && source "$HOME/.sdkman/bin/sdkman-init.sh"
+```
+
+Both `[[ ]]` (extended test) and `source` are **bash extensions not available in POSIX sh**. On Ubuntu 24.04, `/bin/sh` is `dash`. If `.bashrc` is sourced from a `sh` or `dash` script, this line would fail:
+
+```
+/bin/sh: 1: [[: not found
+```
+
+The POSIX-compatible equivalent is:
+```bash
+[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ] && . "$HOME/.sdkman/bin/sdkman-init.sh"
+```
+
+**Affected files:**
+- `ubuntu/24.04/java/install.sh` line 30
+- `ubuntu/24.04/kotlin/install.sh` line 31
+- `ubuntu/24.04/full-sandbox/install.sh` line 188
+
+---
+
+## 3. Timeline
+
+1. **Image build**: Dockerfile merge step runs, `fi` from Perlbrew block is deduplicated away → `.bashrc` has unclosed `if`
+2. **Container start**: `entrypoint.sh` sources `.bashrc` via `. "$HOME/.bashrc"`. This apparently succeeds because `entrypoint.sh` is a plain script (non-interactive bash), and `.bashrc` starts with `case $- in *i*) ;; *) return;; esac` — so it **returns early** before reaching the unclosed `if` block
+3. **User runs `bash`**: New interactive bash session starts, does NOT return early (interactive), reaches the `if [ -n "$PS1" ]; then` block without its `fi`, hits end-of-file → syntax error
+
+This explains why the container appears to start fine, but running `bash` inside it fails.
+
+---
+
+## 4. Solution
+
+### 4.1 Fix 1: Section-Header Deduplication in Merge Algorithm
+
+Instead of deduplicating line-by-line, the algorithm now deduplicates by **section header** — the unique `# <Tool> configuration` comment that introduces each language's `.bashrc` block.
+
+The new algorithm:
+- Reads each language's `.bashrc`
+- When it encounters a line matching `^# .+ configuration$`, checks if this header is already in the base
+- If the header is NOT present: appends the header and all subsequent lines until the next section header
+- If the header IS present: skips the entire section (no deduplication of individual structural tokens)
+
+This preserves all multi-line constructs intact and handles cross-language deduplication correctly (e.g., both `java/install.sh` and `kotlin/install.sh` write `# SDKMAN configuration` — the second occurrence is correctly skipped as a whole).
+
+**Files changed:**
+- `Dockerfile` (merge RUN step)
+- `ubuntu/24.04/full-sandbox/Dockerfile` (merge RUN step)
+
+### 4.2 Fix 2: POSIX-Compatible SDKMAN Syntax
+
+Replace `[[ -s ... ]] && source` with `[ -s ... ] && .` in all three install scripts.
+
+**Files changed:**
+- `ubuntu/24.04/java/install.sh`
+- `ubuntu/24.04/kotlin/install.sh`
+- `ubuntu/24.04/full-sandbox/install.sh`
+
+### 4.3 Verification
+
+An automated test at `experiments/test-bashrc-merge-fix.sh` verifies:
+
+1. The old algorithm produces a syntax error (bug confirmed)
+2. The new algorithm produces a valid `.bashrc` (fix confirmed)
+3. SDKMAN section appears exactly once (kotlin dedup works)
+4. Perlbrew `if/fi` block is complete and balanced
+5. No `[[ ]]` bash-specific syntax in the merged output
+
+Running the test:
+```bash
+bash experiments/test-bashrc-merge-fix.sh
+```
+
+Expected output: `ALL TESTS PASSED - Fix is verified!` (13/13 passing)
+
+---
+
+## 5. Why `entrypoint.sh` Was Not Affected
+
+The `.bashrc` starts with:
+
+```bash
+case $- in
+    *i*) ;;
+      *) return;;
+esac
+```
+
+This guard returns early for non-interactive shells. `entrypoint.sh` is not an interactive shell, so it returns before reaching the broken `if [ -n "$PS1" ]` block. This is why the container started fine — the broken `.bashrc` was never fully executed.
+
+When the user runs `bash` explicitly, it starts an interactive session (because `bash` inherits the TTY). The interactive shell does NOT return early, executes the full `.bashrc`, and hits the unclosed `if` at the end of file.
+
+This also explains the issue title: "We should not run `bash` inside `bash`" — the entrypoint was already bash, and starting another bash exposed the broken `.bashrc`.
+
+---
+
+## 6. References
+
+- [Issue #66: We should not run bash inside bash](https://github.com/link-foundation/sandbox/issues/66)
+- [PR #67: Fix .bashrc merge algorithm and SDKMAN POSIX syntax](https://github.com/link-foundation/sandbox/pull/67)
+- [Bash manual: Bash startup files](https://www.gnu.org/software/bash/manual/bash.html#Bash-Startup-Files)
+- [POSIX Shell Grammar](https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html)
+- [experiments/test-bashrc-merge.sh](../../experiments/test-bashrc-merge.sh) — bug reproduction
+- [experiments/test-bashrc-merge-fix.sh](../../experiments/test-bashrc-merge-fix.sh) — fix verification
diff --git a/experiments/test-bashrc-merge-fix.sh b/experiments/test-bashrc-merge-fix.sh
new file mode 100755
index 0000000..8dc152e
--- /dev/null
+++ b/experiments/test-bashrc-merge-fix.sh
@@ -0,0 +1,266 @@
+#!/usr/bin/env bash
+# Experiment: Verify the .bashrc merge fix works correctly (issue #66)
+# Simulates the Dockerfile merge algorithm (both old and new) and checks for syntax errors.
+
+set -u
+
+PASS=0
+FAIL=0
+WORKDIR=$(mktemp -d)
+trap "rm -rf $WORKDIR" EXIT
+
+pass() { echo "  [PASS] $1"; PASS=$((PASS+1)); }
+fail() { echo "  [FAIL] $1"; FAIL=$((FAIL+1)); }
+
+echo "=== Issue #66: .bashrc merge fix verification ==="
+echo ""
+
+# ─────────────────────────────────────────────────
+# 1. Create realistic base .bashrc (like Ubuntu /etc/skel/.bashrc after essentials)
+# ─────────────────────────────────────────────────
+cat > "$WORKDIR/.bashrc-base" << 'EOF'
+# ~/.bashrc: executed by bash(1) for non-login shells.
+
+# If not running interactively, don't do anything
+case $- in
+    *i*) ;;
+      *) return;;
+esac
+
+# don't put duplicate lines or lines starting with space in the history.
+HISTCONTROL=ignoreboth
+
+# check the window size after each command
+shopt -s checkwinsize
+
+# set a fancy prompt
+if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
+    debian_chroot=$(cat /etc/debian_chroot)
+fi
+
+if [ "$TERM" = "xterm-color" ] || [ "$256color" = "${TERM#*-}" ]; then
+    color_prompt=yes
+fi
+
+if [ "$color_prompt" = yes ]; then
+    PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
+fi
+
+# Alias definitions
+if [ -f ~/.bash_aliases ]; then
+    . ~/.bash_aliases
+fi
+
+# Deno configuration
+export DENO_INSTALL="$HOME/.deno"
+export PATH="$DENO_INSTALL/bin:$PATH"
+
+# NVM configuration
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
+EOF
+
+echo "Base .bashrc syntax:"
+bash -n "$WORKDIR/.bashrc-base" 2>&1 && pass "Base .bashrc is valid" || fail "Base .bashrc is invalid"
+echo ""
+
+# ─────────────────────────────────────────────────
+# 2. Create language-specific .bashrc files (simulating what install.sh scripts produce)
+# ─────────────────────────────────────────────────
+
+# Python (adds pyenv section)
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-python"
+cat >> "$WORKDIR/.bashrc-python" << 'EOF'
+
+# Pyenv configuration
+export PYENV_ROOT="$HOME/.pyenv"
+export PATH="$PYENV_ROOT/bin:$PATH"
+eval "$(pyenv init --path)"
+eval "$(pyenv init -)"
+EOF
+
+# Go (adds Go section)
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-go"
+cat >> "$WORKDIR/.bashrc-go" << 'EOF'
+
+# Go configuration
+export GOROOT="$HOME/.go"
+export GOPATH="$HOME/.go/path"
+export PATH="$GOROOT/bin:$GOPATH/bin:$PATH"
+EOF
+
+# Java (adds SDKMAN section with fixed POSIX syntax)
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-java"
+cat >> "$WORKDIR/.bashrc-java" << 'EOF'
+
+# SDKMAN configuration
+export SDKMAN_DIR="$HOME/.sdkman"
+[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ] && . "$HOME/.sdkman/bin/sdkman-init.sh"
+EOF
+
+# Kotlin (same SDKMAN section - should be SKIPPED by merge as already present)
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-kotlin"
+cat >> "$WORKDIR/.bashrc-kotlin" << 'EOF'
+
+# SDKMAN configuration
+export SDKMAN_DIR="$HOME/.sdkman"
+[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ] && . "$HOME/.sdkman/bin/sdkman-init.sh"
+EOF
+
+# Perl (adds Perlbrew section WITH if/fi block - this was the bug trigger)
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-perl"
+cat >> "$WORKDIR/.bashrc-perl" << 'EOF'
+
+# Perlbrew configuration
+if [ -n "$PS1" ]; then
+  export PERLBREW_ROOT="$HOME/.perl5"
+  [ -f "$PERLBREW_ROOT/etc/bashrc" ] && . "$PERLBREW_ROOT/etc/bashrc"
+fi
+EOF
+
+echo "Language .bashrc files syntax:"
+for f in python go java kotlin perl; do
+    bash -n "$WORKDIR/.bashrc-$f" 2>&1 && pass "$f .bashrc is valid" || fail "$f .bashrc is invalid"
+done
+echo ""
+
+# ─────────────────────────────────────────────────
+# 3. TEST OLD (BROKEN) ALGORITHM
+# ─────────────────────────────────────────────────
+echo "=== Testing OLD merge algorithm (expected to FAIL) ==="
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-old-merged"
+
+for lang_bashrc in "$WORKDIR/.bashrc-python" "$WORKDIR/.bashrc-go" "$WORKDIR/.bashrc-java" \
+                   "$WORKDIR/.bashrc-kotlin" "$WORKDIR/.bashrc-perl"; do
+    if [ -f "$lang_bashrc" ]; then
+        while IFS= read -r line; do
+            if [ -n "$line" ] && ! grep -qxF "$line" "$WORKDIR/.bashrc-old-merged" 2>/dev/null; then
+                echo "$line" >> "$WORKDIR/.bashrc-old-merged"
+            fi
+        done < "$lang_bashrc"
+    fi
+done
+
+echo "Old merge result syntax:"
+bash -n "$WORKDIR/.bashrc-old-merged" 2>&1
+if bash -n "$WORKDIR/.bashrc-old-merged" 2>/dev/null; then
+    fail "Old algorithm unexpectedly produced valid .bashrc (test assumption wrong)"
+else
+    pass "Old algorithm produces syntax error (as expected - bug confirmed)"
+fi
+echo ""
+
+# Show what the old algorithm produced (relevant tail)
+echo "Last 10 lines of old merged .bashrc:"
+tail -10 "$WORKDIR/.bashrc-old-merged"
+echo ""
+
+# ─────────────────────────────────────────────────
+# 4. TEST NEW (FIXED) ALGORITHM
+# ─────────────────────────────────────────────────
+echo "=== Testing NEW merge algorithm (expected to PASS) ==="
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-new-merged"
+
+for lang_bashrc in "$WORKDIR/.bashrc-python" "$WORKDIR/.bashrc-go" "$WORKDIR/.bashrc-java" \
+                   "$WORKDIR/.bashrc-kotlin" "$WORKDIR/.bashrc-perl"; do
+    if [ -f "$lang_bashrc" ]; then
+        in_new_section=0
+        section_header=""
+        while IFS= read -r line; do
+            if echo "$line" | grep -qE '^# .+ configuration$'; then
+                section_header="$line"
+                if grep -qxF "$section_header" "$WORKDIR/.bashrc-new-merged" 2>/dev/null; then
+                    in_new_section=0
+                else
+                    in_new_section=1
+                    echo "" >> "$WORKDIR/.bashrc-new-merged"
+                    echo "$section_header" >> "$WORKDIR/.bashrc-new-merged"
+                fi
+            elif [ "$in_new_section" = "1" ]; then
+                echo "$line" >> "$WORKDIR/.bashrc-new-merged"
+            fi
+        done < "$lang_bashrc"
+    fi
+done
+
+echo "New merge result syntax:"
+if bash -n "$WORKDIR/.bashrc-new-merged" 2>&1; then
+    pass "New algorithm produces valid .bashrc (bug is fixed)"
+else
+    fail "New algorithm still produces syntax error"
+fi
+echo ""
+
+# Show the full new merged .bashrc
+echo "Full new merged .bashrc:"
+cat -n "$WORKDIR/.bashrc-new-merged"
+echo ""
+
+# ─────────────────────────────────────────────────
+# 5. VERIFY: SDKMAN section appears only once (deduplication works)
+# ─────────────────────────────────────────────────
+echo "=== Checking section deduplication ==="
+SDKMAN_COUNT=$(grep -c "# SDKMAN configuration" "$WORKDIR/.bashrc-new-merged" 2>/dev/null || echo "0")
+if [ "$SDKMAN_COUNT" = "1" ]; then
+    pass "SDKMAN section appears exactly once (kotlin dedup worked)"
+else
+    fail "SDKMAN section count: $SDKMAN_COUNT (expected 1)"
+fi
+
+PERLBREW_COUNT=$(grep -c "# Perlbrew configuration" "$WORKDIR/.bashrc-new-merged" 2>/dev/null || echo "0")
+if [ "$PERLBREW_COUNT" = "1" ]; then
+    pass "Perlbrew section appears exactly once"
+else
+    fail "Perlbrew section count: $PERLBREW_COUNT (expected 1)"
+fi
+
+# ─────────────────────────────────────────────────
+# 6. VERIFY: Perlbrew if/fi block is complete
+# ─────────────────────────────────────────────────
+IF_COUNT=$(grep -c "if \[ -n \"\$PS1\" \]" "$WORKDIR/.bashrc-new-merged" 2>/dev/null || echo "0")
+FI_COUNT=$(grep -c "^fi$" "$WORKDIR/.bashrc-new-merged" 2>/dev/null || echo "0")
+echo ""
+echo "=== if/fi balance check ==="
+echo "  'if [ -n \"\$PS1\" ]' count: $IF_COUNT"
+echo "  Standalone 'fi' count: $FI_COUNT"
+echo "  (Note: fi count includes all if blocks in base .bashrc + Perlbrew)"
+if [ "$IF_COUNT" -le "$FI_COUNT" ]; then
+    pass "if/fi blocks are balanced (every 'if' has a matching 'fi')"
+else
+    fail "if/fi blocks are NOT balanced (unclosed 'if' detected)"
+fi
+
+# ─────────────────────────────────────────────────
+# 7. VERIFY: SDKMAN uses POSIX syntax (no [[ ]])
+# ─────────────────────────────────────────────────
+echo ""
+echo "=== POSIX syntax check ==="
+if grep -q '\[\[' "$WORKDIR/.bashrc-new-merged" 2>/dev/null; then
+    fail "Found bash-specific [[ ]] in merged .bashrc"
+    grep -n '\[\[' "$WORKDIR/.bashrc-new-merged"
+else
+    pass "No bash-specific [[ ]] found in merged .bashrc (POSIX compatible)"
+fi
+
+if grep -q ']] && source' "$WORKDIR/.bashrc-new-merged" 2>/dev/null; then
+    fail "Found 'source' command (should use '.' for POSIX compatibility)"
+else
+    pass "No 'source' command in SDKMAN section (uses '.' for POSIX compat)"
+fi
+
+# ─────────────────────────────────────────────────
+# Summary
+# ─────────────────────────────────────────────────
+echo ""
+echo "=== Summary ==="
+echo "  Tests passed: $PASS"
+echo "  Tests failed: $FAIL"
+echo ""
+if [ "$FAIL" = "0" ]; then
+    echo "ALL TESTS PASSED - Fix is verified!"
+    exit 0
+else
+    echo "SOME TESTS FAILED - Please investigate."
+    exit 1
+fi
diff --git a/experiments/test-bashrc-merge.sh b/experiments/test-bashrc-merge.sh
new file mode 100755
index 0000000..e32cee3
--- /dev/null
+++ b/experiments/test-bashrc-merge.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Experiment: Reproduce the .bashrc merge bug (issue #66)
+# This simulates what the Dockerfile merge algorithm does and shows the syntax error
+
+set -u
+
+WORKDIR=$(mktemp -d)
+trap "rm -rf $WORKDIR" EXIT
+
+echo "=== Simulating .bashrc merge bug ==="
+echo ""
+
+# Create a base .bashrc with some fi lines (simulating Ubuntu's /etc/skel/.bashrc)
+cat > "$WORKDIR/.bashrc-base" << 'BASHRC_BASE'
+# Base .bashrc (simulating Ubuntu /etc/skel/.bashrc)
+# if block 1
+if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
+  debian_chroot=$(cat /etc/debian_chroot)
+fi
+
+# if block 2
+if [ "$TERM" = "xterm-color" ] || [ "$TERM" = "256color" ]; then
+  color_prompt=yes
+fi
+
+# NVM
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
+
+# SDKMAN
+export SDKMAN_DIR="$HOME/.sdkman"
+[[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ]] && source "$HOME/.sdkman/bin/sdkman-init.sh"
+BASHRC_BASE
+
+echo "Base .bashrc (valid):"
+bash -n "$WORKDIR/.bashrc-base" 2>&1 && echo "  -> VALID" || echo "  -> INVALID"
+echo ""
+
+# Create perl's .bashrc (same base plus Perlbrew block)
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-perl"
+cat >> "$WORKDIR/.bashrc-perl" << 'PERL_SECTION'
+
+# Perlbrew configuration
+if [ -n "$PS1" ]; then
+  export PERLBREW_ROOT="$HOME/.perl5"
+  [ -f "$PERLBREW_ROOT/etc/bashrc" ] && source "$PERLBREW_ROOT/etc/bashrc"
+fi
+PERL_SECTION
+
+echo "Perl .bashrc (valid):"
+bash -n "$WORKDIR/.bashrc-perl" 2>&1 && echo "  -> VALID" || echo "  -> INVALID"
+echo ""
+
+# Now simulate the merge algorithm
+echo "=== Running merge algorithm ==="
+cp "$WORKDIR/.bashrc-base" "$WORKDIR/.bashrc-merged"
+
+# Process perl's .bashrc (append unique lines, skip blank lines)
+while IFS= read -r line; do
+  if [ -n "$line" ] && ! grep -qxF "$line" "$WORKDIR/.bashrc-merged" 2>/dev/null; then
+    echo "$line" >> "$WORKDIR/.bashrc-merged"
+  fi
+done < "$WORKDIR/.bashrc-perl"
+
+echo ""
+echo "Merged .bashrc content:"
+cat -n "$WORKDIR/.bashrc-merged"
+echo ""
+
+echo "Merged .bashrc syntax check:"
+bash -n "$WORKDIR/.bashrc-merged" 2>&1 && echo "  -> VALID" || echo "  -> SYNTAX ERROR (bug reproduced!)"
+echo ""
+
+# Show which fi was deduplicated
+echo "=== Showing the fi deduplication issue ==="
+echo "Lines from perl .bashrc that were skipped (already in base):"
+while IFS= read -r line; do
+  if [ -n "$line" ] && grep -qxF "$line" "$WORKDIR/.bashrc-base" 2>/dev/null; then
+    echo "  SKIPPED: '$line'"
+  fi
+done < "$WORKDIR/.bashrc-perl"
+
diff --git a/ubuntu/24.04/full-sandbox/Dockerfile b/ubuntu/24.04/full-sandbox/Dockerfile
index e438e9a..a4cfeb9 100644
--- a/ubuntu/24.04/full-sandbox/Dockerfile
+++ b/ubuntu/24.04/full-sandbox/Dockerfile
@@ -153,14 +153,28 @@ COPY --from=lean-stage --chown=sandbox:sandbox /home/sandbox/.bashrc /tmp/.bashr
 COPY --from=rocq-stage --chown=sandbox:sandbox /home/sandbox/.bashrc /tmp/.bashrc-rocq
 
 # Merge bashrc configurations: take the essentials bashrc as base,
-# then append unique lines from each language stage
+# then append sections from each language stage that are not yet present.
+# Uses section-header deduplication (checks for unique "# <Tool> configuration"
+# comment) to avoid corrupting multi-line shell constructs (if/fi blocks) that
+# would break when individual lines like bare "fi" are deduplicated.
 RUN cp /home/sandbox/.bashrc /tmp/.bashrc-base && \
     for lang_bashrc in /tmp/.bashrc-python /tmp/.bashrc-go /tmp/.bashrc-rust \
       /tmp/.bashrc-java /tmp/.bashrc-kotlin /tmp/.bashrc-ruby /tmp/.bashrc-php \
       /tmp/.bashrc-perl /tmp/.bashrc-swift /tmp/.bashrc-lean /tmp/.bashrc-rocq; do \
       if [ -f "$lang_bashrc" ]; then \
+        in_new_section=0; \
+        section_header=""; \
         while IFS= read -r line; do \
-          if [ -n "$line" ] && ! grep -qxF "$line" /tmp/.bashrc-base 2>/dev/null; then \
+          if echo "$line" | grep -qE '^# .+ configuration$'; then \
+            section_header="$line"; \
+            if grep -qxF "$section_header" /tmp/.bashrc-base 2>/dev/null; then \
+              in_new_section=0; \
+            else \
+              in_new_section=1; \
+              echo "" >> /tmp/.bashrc-base; \
+              echo "$section_header" >> /tmp/.bashrc-base; \
+            fi; \
+          elif [ "$in_new_section" = "1" ]; then \
             echo "$line" >> /tmp/.bashrc-base; \
           fi; \
         done < "$lang_bashrc"; \
diff --git a/ubuntu/24.04/full-sandbox/install.sh b/ubuntu/24.04/full-sandbox/install.sh
index d08fda7..447feb3 100644
--- a/ubuntu/24.04/full-sandbox/install.sh
+++ b/ubuntu/24.04/full-sandbox/install.sh
@@ -185,7 +185,7 @@ if [ ! -d "$HOME/.sdkman" ]; then
       echo ''
       echo '# SDKMAN configuration'
       echo 'export SDKMAN_DIR="$HOME/.sdkman"'
-      echo '[[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ]] && source "$HOME/.sdkman/bin/sdkman-init.sh"'
+      echo '[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ] && . "$HOME/.sdkman/bin/sdkman-init.sh"'
     } >> "$HOME/.bashrc"
   fi
 fi
diff --git a/ubuntu/24.04/java/install.sh b/ubuntu/24.04/java/install.sh
index 89616ae..4883265 100644
--- a/ubuntu/24.04/java/install.sh
+++ b/ubuntu/24.04/java/install.sh
@@ -27,7 +27,7 @@ if [ ! -d "$HOME/.sdkman" ]; then
       echo ''
       echo '# SDKMAN configuration'
       echo 'export SDKMAN_DIR="$HOME/.sdkman"'
-      echo '[[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ]] && source "$HOME/.sdkman/bin/sdkman-init.sh"'
+      echo '[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ] && . "$HOME/.sdkman/bin/sdkman-init.sh"'
     } >> "$HOME/.bashrc"
   fi
   log_success "SDKMAN installed and configured"
diff --git a/ubuntu/24.04/kotlin/install.sh b/ubuntu/24.04/kotlin/install.sh
index 6c0acb6..f02b93f 100644
--- a/ubuntu/24.04/kotlin/install.sh
+++ b/ubuntu/24.04/kotlin/install.sh
@@ -28,7 +28,7 @@ if [ ! -d "$HOME/.sdkman" ]; then
       echo ''
       echo '# SDKMAN configuration'
       echo 'export SDKMAN_DIR="$HOME/.sdkman"'
-      echo '[[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ]] && source "$HOME/.sdkman/bin/sdkman-init.sh"'
+      echo '[ -s "$HOME/.sdkman/bin/sdkman-init.sh" ] && . "$HOME/.sdkman/bin/sdkman-init.sh"'
     } >> "$HOME/.bashrc"
   fi
 fi