@@ -110,32 +110,25 @@ def sync(source, destination, language, *, skip_missing_resources=False):
     catalogs = active_catalogs(config)
     downloaded = source / language / "LC_MESSAGES"
     skipped = set()
-    filtered_config = configparser.ConfigParser(interpolation=None)
     if skip_missing_resources:
-        filtered_config.read(config, encoding="utf-8")
+        resources = configparser.ConfigParser(interpolation=None)
+        resources.read(config, encoding="utf-8")
         # Check every missing download before modifying the repository. Missing
         # translations of existing resources (or API errors) must still fail.
-        for section in filtered_config.sections():
+        for section in resources.sections():
             if section == "main":
                 continue
             path = Path(PurePosixPath(
-                filtered_config[section]["source_file"]
+                resources[section]["source_file"]
             ).relative_to("pot").with_suffix(".po"))
             if not (downloaded / path).is_file() and not resource_exists(section):
                 skipped.add(path)
-                if not (destination / path).is_file():
-                    filtered_config.remove_section(section)
                 print(f"Skipped unavailable Transifex resource: {section} ({path})")
     incoming = [path for path in catalogs if path not in skipped]
     require_catalogs(downloaded, incoming)
     if not incoming:
         raise ValueError("No PO catalogs downloaded; refusing to sync")
-    # Keep existing translations of temporarily unavailable resources. New
-    # resources without a PO must not enter the config used by the merge job.
-    catalogs = [
-        path for path in catalogs
-        if path not in skipped or (destination / path).is_file()
-    ]
+    # Keep existing translations of temporarily unavailable resources.
     obsolete = set(tracked_catalogs(destination)) - set(catalogs)
 
     for path in incoming:
@@ -146,16 +139,17 @@ def sync(source, destination, language, *, skip_missing_resources=False):
         (destination / path).unlink(missing_ok=True)
         print(f"Removed obsolete catalog: {path}")
     (destination / ".tx").mkdir(exist_ok=True)
-    if skipped:
-        with (destination / ".tx/config").open("w", encoding="utf-8") as stream:
-            filtered_config.write(stream)
-    else:
-        shutil.copyfile(config, destination / ".tx/config")
+    shutil.copyfile(config, destination / ".tx/config")
 
 
 def merge(source, destination):
-    # Ignore stale PO files even if a source checkout still contains them.
-    catalogs = active_catalogs(source / ".tx/config")
+    # The config includes new resources whose translations are not available
+    # yet. Merge only tracked catalogs, ignoring stale files outside the config.
+    catalogs = sorted(
+        set(active_catalogs(source / ".tx/config")) & set(tracked_catalogs(source))
+    )
+    if not catalogs:
+        raise ValueError(f"No source catalogs in {source}")
     targets = tracked_catalogs(destination)
     if not targets:
         raise ValueError(f"No target catalogs in {destination}")
 
@@ -32,7 +32,9 @@ sphinx-intl create-txconfig
 sphinx-intl update-txconfig-resources -p pot -d . --transifex-organization-name python-doc --transifex-project-name python-newest
 
 # Pull translations into the temporary LANGUAGE/LC_MESSAGES directory.
-tx pull -l "${LANGUAGE}" -t --use-git-timestamps
+if ! tx pull -l "${LANGUAGE}" -t --use-git-timestamps; then
+  echo "tx pull failed; validating downloaded catalogs before continuing." >&2
+fi
 
 # Validate the download before copying catalogs or removing obsolete files.
 # Newly generated POTs may not have a Transifex resource yet.
 
@@ -1,4 +1,5 @@
 import json
+import os
 from pathlib import Path
 import shutil
 import subprocess
@@ -196,6 +197,10 @@ def test_incomplete_download_does_not_change_repository(self):
     def test_sync_skips_unregistered_resource_and_picks_it_up_later(self):
         catalogs = ["bugs.po", "c-api/pyexpat.po"]
         write_config(self.source, catalogs)
+        config = self.source / ".tx/config"
+        original = config.read_bytes().replace(b"host =", b"host        =")
+        original = b"# Preserve tx formatting\n" + original
+        config.write_bytes(original)
         download = self.source / "ja/LC_MESSAGES"
         write_po(download, "bugs.po", "新しい訳")
         obsolete = write_po(self.destination, "removed.po", "古い訳")
@@ -208,11 +213,9 @@ def test_sync_skips_unregistered_resource_and_picks_it_up_later(self):
         self.assertFalse(obsolete.exists())
         self.assertFalse((self.destination / "c-api/pyexpat.po").exists())
         self.assertEqual(translations.active_catalogs(self.destination / ".tx/config"),
-                         [Path("bugs.po")])
-        translations.require_catalogs(
-            self.destination, translations.active_catalogs(self.destination / ".tx/config")
-        )
-        # The generated source config remains complete for subsequent runs.
+                         [Path(path) for path in catalogs])
+        self.assertEqual((self.destination / ".tx/config").read_bytes(), original)
+        # Both configs remain complete for subsequent runs.
         self.assertEqual(translations.active_catalogs(self.source / ".tx/config"),
                          [Path(path) for path in catalogs])
         write_po(download, "c-api/pyexpat.po", "追加された訳")
@@ -222,6 +225,7 @@ def test_sync_skips_unregistered_resource_and_picks_it_up_later(self):
         exists.assert_not_called()
         self.assertEqual((download / "c-api/pyexpat.po").read_bytes(),
                          (self.destination / "c-api/pyexpat.po").read_bytes())
+        self.assertEqual((self.destination / ".tx/config").read_bytes(), original)
 
     def test_sync_preserves_existing_po_for_unavailable_resource(self):
         catalogs = ["bugs.po", "c-api/pyexpat.po"]
@@ -236,6 +240,8 @@ def test_sync_preserves_existing_po_for_unavailable_resource(self):
         self.assertEqual(old.read_bytes(), before)
         self.assertEqual(translations.active_catalogs(self.destination / ".tx/config"),
                          [Path(path) for path in catalogs])
+        self.assertEqual((self.destination / ".tx/config").read_bytes(),
+                         (self.source / ".tx/config").read_bytes())
 
     def test_skip_does_not_hide_incomplete_download_or_api_failure(self):
         write_config(self.source, ["bugs.po", "new.po", "missing.po"])
@@ -305,11 +311,66 @@ def test_config_cannot_escape_catalog_directory(self):
         with self.assertRaises(ValueError):
             translations.active_catalogs(self.source / ".tx/config")
 
+    def test_update_validates_after_pull_failure(self):
+        scripts = self.source / "scripts"
+        scripts.mkdir()
+        update = scripts / "update.sh"
+        shutil.copyfile(Path(translations.__file__).with_name("update.sh"), update)
+        doc = self.source / "cpython/Doc"
+        doc.mkdir(parents=True)
+        (doc / "conf.py").touch()
+        executables = self.root / "bin"
+        executables.mkdir()
+        validation_log = self.root / "validation.log"
+        commands = {
+            "sphinx-build": "exit 0",
+            "sphinx-intl": "exit 0",
+            "tx": "exit 1",
+            "python": 'printf "%s\\n" "$@" > "$VALIDATION_LOG"\n'
+                      'exit "$VALIDATION_STATUS"',
+        }
+        for name, body in commands.items():
+            executable = executables / name
+            executable.write_text("#!/bin/sh\n" + body + "\n", encoding="utf-8")
+            executable.chmod(0o755)
+        for status in (0, 42):
+            with self.subTest(validation_status=status):
+                validation_log.unlink(missing_ok=True)
+                result = subprocess.run(
+                    ["sh", str(update)], capture_output=True, text=True,
+                    env={**os.environ, "PATH": f"{executables}:{os.environ['PATH']}",
+                         "VALIDATION_LOG": str(validation_log),
+                         "VALIDATION_STATUS": str(status)},
+                )
+                self.assertEqual(result.returncode, status, result.stderr)
+                self.assertIn("tx pull failed", result.stderr)
+                arguments = validation_log.read_text().splitlines()
+                self.assertEqual(arguments[1], "sync")
+                self.assertIn("--skip-missing-resources", arguments)
+
+    def test_merge_refuses_empty_source_and_missing_tracked_po(self):
+        subprocess.run(["git", "init", "--quiet", str(self.source)], check=True)
+        write_config(self.source, ["new.po", "bugs.po"])
+        write_po(self.destination, "bugs.po", "既存の訳")
+        self.track()
+        with mock.patch.object(translations.subprocess, "run",
+                               wraps=subprocess.run) as run:
+            with self.assertRaisesRegex(ValueError, "No source catalogs"):
+                translations.merge(self.source, self.destination)
+            missing = write_po(self.source, "bugs.po", "新しい訳")
+            subprocess.run(["git", "-C", str(self.source), "add", "."], check=True)
+            missing.unlink()
+            with self.assertRaises(FileNotFoundError):
+                translations.merge(self.source, self.destination)
+        self.assertFalse(any(call.args[0][0] == "pomerge" for call in run.call_args_list))
+
     @unittest.skipUnless(shutil.which("pomerge"), "pomerge is required")
     def test_merge_uses_current_translation_across_renamed_paths(self):
-        write_config(self.source, ["builtins/functions.po"])
+        subprocess.run(["git", "init", "--quiet", str(self.source)], check=True)
+        write_config(self.source, ["builtins/functions.po", "c-api/pyexpat.po"])
         write_po(self.source, "builtins/functions.po", "新しい訳")
         write_po(self.source, "library/functions.po", "古い訳")
+        subprocess.run(["git", "-C", str(self.source), "add", "."], check=True)
         old = write_po(self.destination, "library/functions.po", "以前の訳")
         self.track()