@@ -371,7 +371,7 @@ export class HttpClient {
       // Sanitize the server-returned message before any interpolation into
       // user-facing error strings. Defense-in-depth against a malicious or
       // buggy server scribbling ANSI escape codes / control chars on the
-      // user's terminal. Mirrors the TMS-client hardening (sync-pagq.7).
+      // user's terminal, matching the sanitization in tms-client.ts.
       // Coalesce to '' before sanitizing — some axios error shapes have no
       // `.message` field, and sanitizeForTerminal expects a string.
       const message = sanitizeForTerminal(responseData?.message ?? error.message ?? '');
@@ -441,6 +441,12 @@ export class HttpClient {
     if (headerValue === undefined || headerValue === null) {
       return undefined;
     }
+    // Number('') and Number('   ') are 0, which passes the finite check below
+    // and returns a 0 ms delay — collapsing 429 backoff into a tight retry
+    // loop against an endpoint that is already rate-limiting us.
+    if (headerValue.trim() === '') {
+      return undefined;
+    }
 
     const seconds = Number(headerValue);
     if (!isNaN(seconds) && isFinite(seconds)) {
 
@@ -0,0 +1,19 @@
+import { InvalidArgumentError } from 'commander';
+
+/**
+ * Commander option parser for a bounded positive integer.
+ *
+ * A bare `parseInt` yields NaN for a non-numeric value, and NaN survives the
+ * `??` default chains used downstream — so an invalid `--concurrency` reached
+ * the worker-pool sizing and silently produced zero workers. Rejecting at the
+ * boundary means the user is told instead.
+ */
+export function parsePositiveIntOption(value: string, name: string, max: number): number {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0 || parsed > max) {
+    throw new InvalidArgumentError(
+      `--${name} must be an integer between 1 and ${max}, got '${value}'`,
+    );
+  }
+  return parsed;
+}
@@ -6,6 +6,7 @@ import { ValidationError } from '../../utils/errors.js';
 import { ExitCode } from '../../utils/exit-codes.js';
 import { LOCK_FILE_NAME } from '../../sync/types.js';
 import { sweepStaleBackups as sweepStaleBackupsImpl, DEFAULT_BAK_SWEEP_MAX_AGE_SECONDS } from '../../sync/sync-bak-cleanup.js';
+import { claimGracefulShutdown } from '../../utils/signal-exit.js';
 
 export const STALE_BACKUP_AGE_MS = DEFAULT_BAK_SWEEP_MAX_AGE_SECONDS * 1000;
 
@@ -269,7 +270,7 @@ export class SyncCommand {
       process.exitCode = ExitCode.PartialFailure;
     }
 
-    if (options.autoCommit && !result.dryRun && !result.driftDetected && result.fileResults.length > 0) {
+    if (options.autoCommit && result.success && !result.dryRun && !result.driftDetected && result.fileResults.length > 0) {
       await this.autoCommitTranslations(result, config);
     }
 
@@ -383,7 +384,7 @@ export class SyncCommand {
           backupTracker,
         });
         this.displayResult(result, 'text');
-        if (options.autoCommit && !result.dryRun && !result.driftDetected && result.fileResults.length > 0) {
+        if (options.autoCommit && result.success && !result.dryRun && !result.driftDetected && result.fileResults.length > 0) {
           await this.autoCommitTranslations(result, activeConfig);
         }
       },
@@ -400,6 +401,10 @@ export class SyncCommand {
       debounceMs,
     });
 
+    // Watch mode treats SIGINT/SIGTERM as its normal stop signal and shuts
+    // down successfully, so the CLI's signal-exit must not force a failure code.
+    claimGracefulShutdown();
+
     await new Promise<void>((resolve) => {
       const onStop = (): void => {
         Logger.info('\nStopping watch...');
 
@@ -3,6 +3,7 @@ import { ExitCode } from '../../../utils/exit-codes.js';
 import { ValidationError } from '../../../utils/errors.js';
 import { createSyncCommand, type ServiceDeps } from '../service-factory.js';
 import { emitJsonErrorAndExit } from './sync-options.js';
+import { parsePositiveIntOption } from '../parse-int-option.js';
 
 export function registerSyncRoot(program: Command, deps: ServiceDeps): Command {
   return program
@@ -46,7 +47,8 @@ export function registerSyncRoot(program: Command, deps: ServiceDeps): Command {
     .addOption(new Option('--context').hideHelp())
     .addOption(new Option('--no-context').hideHelp())
     .optionsGroup('Performance:')
-    .option('--concurrency <number>', 'Max parallel locale translations (default: 5)', parseInt)
+    .option('--concurrency <number>', 'Max parallel locale translations (default: 5)', (v) =>
+      parsePositiveIntOption(v, 'concurrency', 100))
     .option('--batch', 'Force batch mode (fastest, no context or instructions)')
     .option(
       '--no-batch',
@@ -61,7 +63,8 @@ export function registerSyncRoot(program: Command, deps: ServiceDeps): Command {
     )
     .optionsGroup('Watch:')
     .option('--watch', 'Watch source files and auto-sync on changes')
-    .option('--debounce <ms>', 'Debounce delay for watch mode (default: 500ms)', parseInt)
+    .option('--debounce <ms>', 'Debounce delay for watch mode (default: 500ms)', (v) =>
+      parsePositiveIntOption(v, 'debounce', 600_000))
     .optionsGroup('Safety:')
     .option('-y, --yes', 'Skip --force confirmation prompt (required when CI=true)')
     .optionsGroup('Output:')
 
@@ -10,12 +10,9 @@ import { buildTranslationOptions as buildBaseLegacy, resolveGlossaryId } from '.
  * flags — the shape all translate handlers (text, file, directory, document)
  * agreed on. Produces the same field set regardless of handler.
  *
- * Previously each handler called `buildTranslationOptions` (in translate-utils)
- * directly and then layered its own downstream shaping. That layering has been
- * extracted into `applySharedTmAndGlossary` so the shared surface area is
- * centralized; handlers only retain handler-specific shaping (custom
- * instructions, style id, XML tag handling, multi-target stripping of
- * `targetLang`, etc.).
+ * Shared downstream shaping lives in `applySharedTmAndGlossary`; handlers
+ * keep only handler-specific shaping (custom instructions, style id, XML tag
+ * handling, multi-target stripping of `targetLang`, etc.).
  *
  * Intentional drift NOT folded in:
  *  - `SyncCommand` builds `TranslateOptions` from resolved config, not CLI
@@ -48,7 +45,7 @@ export interface SharedTmAndGlossaryDeps {
  * default onto a base `TranslationParams`-compatible object. Mutates `base`
  * in place so handlers can compose additional downstream shaping.
  *
- * Consolidates 5 copies of the same block across text + file handlers. All
+ * Shared by the text + file handlers. All
  * validation (required `--from`, TM-requires-quality_optimized, extended-lang
  * constraints) remains in the caller so per-handler error messages are
  * preserved; this helper is called only after validation passes.
 
@@ -40,6 +40,7 @@ import { registerDetect } from './commands/register-detect.js';
 import { registerDescribe } from './commands/register-describe.js';
 import { validateApiUrl } from '../utils/validate-url.js';
 import { resolveEndpoint } from '../utils/resolve-endpoint.js';
+import { installSignalExit } from '../utils/signal-exit.js';
 
 // Get __dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
@@ -352,6 +353,10 @@ program.on('command:*', (operands: string[]) => {
   process.exit(ExitCode.InvalidInput);
 });
 
+// Own process termination on signals, so no component's cleanup handler has to
+// call process.exit() and thereby preempt the others.
+installSignalExit();
+
 // Show help and exit 0 if no arguments provided
 if (!process.argv.slice(2).length) {
   program.outputHelp();
 
@@ -21,8 +21,35 @@ const STRING_ARRAY_RE =
 
 const ARRAY_ITEM_RE = /<item>([\s\S]*?)<\/item>/g;
 
+const XML_ENTITY_RE = /&(?:#x([0-9a-fA-F]+)|#(\d+)|(amp|lt|gt|quot|apos));/g;
+
+/**
+ * Decodes XML entities in a single pass, so a literal `&amp;lt;` decodes to
+ * `&lt;` rather than collapsing all the way to `<`.
+ */
+function decodeXmlEntities(value: string): string {
+  return value.replace(XML_ENTITY_RE, (match, hex: string | undefined, dec: string | undefined, named: string | undefined) => {
+    if (hex !== undefined) {
+      const code = Number.parseInt(hex, 16);
+      return code >= 0 && code <= 0x10ffff ? String.fromCodePoint(code) : match;
+    }
+    if (dec !== undefined) {
+      const code = Number.parseInt(dec, 10);
+      return code >= 0 && code <= 0x10ffff ? String.fromCodePoint(code) : match;
+    }
+    switch (named) {
+      case 'amp': return '&';
+      case 'lt': return '<';
+      case 'gt': return '>';
+      case 'quot': return '"';
+      case 'apos': return "'";
+      default: return match;
+    }
+  });
+}
+
 function unescapeAndroid(value: string): string {
-  return value.replace(/\\(\\|'|"|n|t|r)/g, (_match, ch: string) => {
+  const withoutBackslashEscapes = value.replace(/\\(\\|'|"|n|t|r)/g, (_match, ch: string) => {
     switch (ch) {
       case '\\': return '\\';
       case "'": return "'";
@@ -33,6 +60,7 @@ function unescapeAndroid(value: string): string {
       default: return ch;
     }
   });
+  return decodeXmlEntities(withoutBackslashEscapes);
 }
 
 function escapeAndroid(value: string): string {
@@ -41,9 +69,11 @@ function escapeAndroid(value: string): string {
     .replace(/\n/g, '\\n')
     .replace(/'/g, "\\'")
     .replace(/"/g, '\\"')
+    // & must precede < and >, or the entities produced below get re-escaped
+    // into &amp;lt; — which compounds on every subsequent sync run.
+    .replace(/&/g, '&amp;')
     .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/&/g, '&amp;');
+    .replace(/>/g, '&gt;');
 }
 
 export class AndroidXmlFormatParser implements FormatParser {
@@ -229,16 +259,30 @@ export class AndroidXmlFormatParser implements FormatParser {
   }
 
   private decodeValue(raw: string): string {
-    const cdataMatch = /^<!\[CDATA\[([\s\S]*)\]\]>$/.exec(raw);
-    if (cdataMatch) {
-      return cdataMatch[1]!;
+    if (raw.startsWith('<![CDATA[')) {
+      // Concatenate adjacent sections: escapeForReconstruct splits on "]]>"
+      // into `]]]]><![CDATA[>`, so a literal "]]>" spans two sections.
+      const sectionRe = /<!\[CDATA\[([\s\S]*?)\]\]>/g;
+      let joined = '';
+      let consumedTo = 0;
+      let match: RegExpExecArray | null;
+      while ((match = sectionRe.exec(raw)) !== null) {
+        if (match.index !== consumedTo) break;
+        joined += match[1]!;
+        consumedTo = match.index + match[0].length;
+      }
+      if (consumedTo === raw.length) return joined;
     }
     return unescapeAndroid(raw);
   }
 
   private escapeForReconstruct(originalInner: string, translation: string): string {
     if (/^<!\[CDATA\[/.test(originalInner)) {
-      return `<![CDATA[${translation}]]>`;
+      // A translation containing "]]>" would close the section early and the
+      // remainder would be parsed as XML. Splitting into adjacent CDATA
+      // sections keeps the text literal without escaping it.
+      const safe = translation.replace(/]]>/g, ']]]]><![CDATA[>');
+      return `<![CDATA[${safe}]]>`;
     }
     return escapeAndroid(translation);
   }
 
@@ -1,13 +1,18 @@
 import type { ExtractedEntry, FormatParser, TranslatedEntry } from './format.js';
 import { detectIndent } from './util/detect-indent.js';
 
+/** JSON.parse rejects a leading BOM, which editors on Windows add routinely. */
+function stripBom(content: string): string {
+  return content.replace(/^\uFEFF/, '');
+}
+
 export class ArbFormatParser implements FormatParser {
   readonly name = 'ARB (Flutter)';
   readonly configKey = 'arb';
   readonly extensions = ['.arb'];
 
   extract(content: string): ExtractedEntry[] {
-    const data = JSON.parse(content) as Record<string, unknown>;
+    const data = JSON.parse(stripBom(content)) as Record<string, unknown>;
     const entries: ExtractedEntry[] = [];
 
     for (const key of Object.keys(data)) {
@@ -41,7 +46,7 @@ export class ArbFormatParser implements FormatParser {
   }
 
   reconstruct(content: string, entries: TranslatedEntry[]): string {
-    const data = JSON.parse(content) as Record<string, unknown>;
+    const data = JSON.parse(stripBom(content)) as Record<string, unknown>;
     const indent = detectIndent(content);
     const trailingNewline = content.endsWith('\n');
 
@@ -83,7 +88,7 @@ export class ArbFormatParser implements FormatParser {
   }
 
   extractContext(content: string, key: string): string | undefined {
-    const data = JSON.parse(content) as Record<string, unknown>;
+    const data = JSON.parse(stripBom(content)) as Record<string, unknown>;
     const metaKey = `@${key}`;
     const meta = data[metaKey];
     if (typeof meta === 'object' && meta !== null) {
 
@@ -12,7 +12,7 @@ export class IosStringsFormatParser implements FormatParser {
 
   extract(content: string): ExtractedEntry[] {
     const entries: ExtractedEntry[] = [];
-    const lines = content.split('\n');
+    const lines = content.split(/\r?\n/);
     let pendingComment: string | undefined;
 
     for (let i = 0; i < lines.length; i++) {
@@ -67,18 +67,13 @@ export class IosStringsFormatParser implements FormatParser {
     return entries;
   }
 
-  // Intentionally NOT migrated to PendingCommentBuffer: deferred alongside po
-  // because the forward-only helper interface was frozen at the toml +
-  // properties shape and not re-opened. ios-strings is a plausible future
-  // migration once the helper grows a shape that also accommodates po's
-  // backtrack idiom.
   reconstruct(content: string, entries: TranslatedEntry[]): string {
     const translations = new Map<string, string>();
     for (const entry of entries) {
       translations.set(entry.key, entry.translation);
     }
 
-    const lines = content.split('\n');
+    const lines = content.split(/\r?\n/);
     const result: string[] = [];
     let pendingComments: string[] = [];
     let inBlockComment = false;