<b>Escape these five characters or fail validation</b>

<b>Escape these five characters or fail validation</b>

Raw ampersands and angle brackets in URLs break XML parsing. The entry, sometimes the whole file, is rejected.

Must be entity-escaped inside <code>&lt;loc&gt;</code>:
— <code>&amp;</code> → <code>&amp;amp;</code>
— <code>'</code> → <code>&amp;apos;</code>
— <code>"</code> → <code>&amp;quot;</code>
— <code>&gt;</code> → <code>&amp;gt;</code>
— <code>&lt;</code> → <code>&amp;lt;</code>

Also required:
— ✅ URLs percent-encode non-ASCII (use the IDN/punycode or %-form).
— ✅ Absolute URLs only, including scheme and host.
— ✅ The <code>&lt;loc&gt;</code> ≤ 2,048 characters.

Checklist:
Step 1 — Run the file through an XML validator, not just a sitemap linter.
Step 2 — Grep for raw <code>&amp;</code> in loc values — common in URLs with query strings.

Definition of done: the file parses as well-formed XML with zero entity errors.