diff --git a/rust/coverage/collect_rust_coverage.rs b/rust/coverage/collect_rust_coverage.rs
index 7fbe08a35b..f13ba09fde 100644
--- a/rust/coverage/collect_rust_coverage.rs
+++ b/rust/coverage/collect_rust_coverage.rs
@@ -129,7 +129,9 @@ fn main() {
         None => debug_log!("RUNFILES_DIR: not set (split coverage postprocessing)"),
     }
 
-    let coverage_output_file = coverage_dir.join("coverage.dat");
+    let coverage_output_file = env::var("COVERAGE_OUTPUT_FILE")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| coverage_dir.join("coverage.dat"));
     let profdata_file = coverage_dir.join("coverage.profdata");
     let llvm_cov_path = env::var("RUST_LLVM_COV").unwrap();
     let llvm_profdata_path = env::var("RUST_LLVM_PROFDATA").unwrap();
@@ -141,15 +143,50 @@ fn main() {
         Some(ref rd) => find_metadata_file(&execroot, rd, &llvm_profdata_path),
         None => execroot.join(&llvm_profdata_path),
     };
-    let test_binary = match runfiles_dir {
-        Some(ref rd) => find_test_binary(&execroot, rd),
-        None => {
-            let bin_dir = config_bin_dir(&execroot, &coverage_dir);
-            let test_binary = execroot
-                .join(bin_dir)
-                .join(env::var("TEST_BINARY").unwrap());
-            debug_log!("Resolved TEST_BINARY to: {}", test_binary.display());
-            test_binary
+    // When the JUnit runner wraps the test, TEST_BINARY points to the runner
+    // and RUST_TEST_BIN holds the actual instrumented binary that llvm-cov needs.
+    //
+    // RUST_TEST_BIN is a runfiles path (workspace-prefixed) and only resolves
+    // against RUNFILES_DIR. When RUNFILES_DIR is gone -- Bazel drops it under
+    // --experimental_split_coverage_postprocessing -- we need the binary's
+    // location relative to the execroot instead. Rather than try to rebuild
+    // that here by stitching the workspace-prefixed runfiles path onto the
+    // bin dir (which mislays the workspace segment and points at a file that
+    // isn't there), read RUST_TEST_BIN_EXECROOT_PATH, which the test rule
+    // already knows exactly.
+    let test_binary = if let Ok(rust_test_bin) = env::var("RUST_TEST_BIN") {
+        debug_log!("Using RUST_TEST_BIN: {}", rust_test_bin);
+        let execroot_path = || {
+            env::var("RUST_TEST_BIN_EXECROOT_PATH")
+                .map(|p| execroot.join(p))
+                .unwrap_or_else(|_| {
+                    let bin_dir = config_bin_dir(&execroot, &coverage_dir);
+                    execroot.join(bin_dir).join(&rust_test_bin)
+                })
+        };
+        match runfiles_dir {
+            Some(ref rd) => {
+                let candidate = rd.join(&rust_test_bin);
+                if candidate.exists() {
+                    candidate
+                } else {
+                    debug_log!("RUST_TEST_BIN missing under RUNFILES_DIR; using execroot path");
+                    execroot_path()
+                }
+            }
+            None => execroot_path(),
+        }
+    } else {
+        match runfiles_dir {
+            Some(ref rd) => find_test_binary(&execroot, rd),
+            None => {
+                let bin_dir = config_bin_dir(&execroot, &coverage_dir);
+                let test_binary = execroot
+                    .join(bin_dir)
+                    .join(env::var("TEST_BINARY").unwrap());
+                debug_log!("Resolved TEST_BINARY to: {}", test_binary.display());
+                test_binary
+            }
         }
     };
     let profraw_files: Vec<PathBuf> = fs::read_dir(coverage_dir)
@@ -199,7 +236,8 @@ fn main() {
         .arg("-format=lcov")
         .arg("-instr-profile")
         .arg(&profdata_file)
-        .arg("-ignore-filename-regex=.*external/.+")
+        .arg(r"-ignore-filename-regex=.*external[/\\].+")
+        .arg(r"-ignore-filename-regex=.*rustc[/\\].+")
         .arg("-ignore-filename-regex=/tmp/.+")
         .arg(format!("-path-equivalence=.,{}", execroot.display()))
         .arg(test_binary)
@@ -234,7 +272,8 @@ fn main() {
         coverage_output_file,
         report_str
             .replace("#/proc/self/cwd/", "")
-            .replace(&execroot.display().to_string(), ""),
+            .replace(&execroot.display().to_string(), "")
+            .replace('\\', "/"),
     )
     .unwrap();
 
diff --git a/rust/private/rust.bzl b/rust/private/rust.bzl
index 54178d739f..275d63ddb3 100644
--- a/rust/private/rust.bzl
+++ b/rust/private/rust.bzl
@@ -420,6 +420,22 @@ def get_rust_test_flags(attr):
 
     return rust_flags
 
+def _is_junit_enabled(ctx):
+    """Resolve whether the JUnit XML wrapper should be applied to this test.
+
+    Tri-state, mirroring `experimental_use_cc_common_link`:
+      * `experimental_junit = 1`  -> always wrap this target.
+      * `experimental_junit = 0`  -> never wrap this target.
+      * `experimental_junit = -1` (default) -> defer to the
+        `//rust/settings:experimental_emit_junit_xml` build setting.
+    """
+    junit_attr = ctx.attr.experimental_junit
+    if junit_attr == 1:
+        return True
+    if junit_attr == 0:
+        return False
+    return ctx.attr._experimental_emit_junit_xml[BuildSettingInfo].value
+
 def _rust_test_impl(ctx):
     """The implementation of the `rust_test` rule.
 
@@ -619,6 +635,39 @@ def _rust_test_impl(ctx):
         env["CC_CODE_COVERAGE_SCRIPT"] = ctx.executable._collect_cc_coverage.path
     components = "{}/{}".format(ctx.label.workspace_root, ctx.label.package).split("/")
     env["CARGO_MANIFEST_DIR"] = "/".join([c for c in components if c])
+
+    if _is_junit_enabled(ctx):
+        test_bin_short = output.short_path
+        if test_bin_short.startswith("../"):
+            rust_test_bin_rloc = test_bin_short[len("../"):]
+        else:
+            rust_test_bin_rloc = ctx.workspace_name + "/" + test_bin_short
+        env["RUST_TEST_BIN"] = rust_test_bin_rloc
+
+        # RUST_TEST_BIN above is a runfiles path and only resolves against
+        # RUNFILES_DIR. Coverage postprocessing may run with RUNFILES_DIR
+        # unset (--experimental_split_coverage_postprocessing), so also hand
+        # over the binary's execroot-relative path directly instead of making
+        # collect_coverage reconstruct it.
+        env["RUST_TEST_BIN_EXECROOT_PATH"] = output.path
+
+        junit_runner = ctx.actions.declare_file(ctx.label.name + "_junit_runner" + toolchain.binary_ext)
+        ctx.actions.symlink(
+            output = junit_runner,
+            target_file = ctx.executable._junit_runner,
+            is_executable = True,
+        )
+
+        original_default_info = providers[0]
+        runner_runfiles = ctx.attr._junit_runner[DefaultInfo].default_runfiles
+        test_bin_runfiles = ctx.runfiles(files = [output])
+        merged_runfiles = original_default_info.default_runfiles.merge(runner_runfiles).merge(test_bin_runfiles)
+        providers[0] = DefaultInfo(
+            files = original_default_info.files,
+            runfiles = merged_runfiles,
+            executable = junit_runner,
+        )
+
     providers.append(RunEnvironmentInfo(
         environment = env,
         inherited_environment = ctx.attr.env_inherit,
@@ -1026,6 +1075,33 @@ _RUST_TEST_ATTRS = {
             E.g. `bazel test //src:rust_test --test_arg=foo::test::test_fn`.
         """),
     ),
+    "experimental_junit": attr.int(
+        doc = (
+            "Experimental. Whether to wrap the test binary with a runner that emits a " +
+            "JUnit XML report parsed from the test's `libtest` output. " +
+            "Possible values: [-1, 0, 1]. " +
+            "-1 means use the value of the " +
+            "`--@rules_rust//rust/settings:experimental_emit_junit_xml` build setting to determine. " +
+            "0 means do not wrap the test (run it directly). " +
+            "1 means wrap the test and emit JUnit XML."
+        ),
+        values = [-1, 0, 1],
+        default = -1,
+    ),
+    "_experimental_emit_junit_xml": attr.label(
+        default = Label("//rust/settings:experimental_emit_junit_xml"),
+        doc = "The build setting consulted when `experimental_junit = -1`.",
+    ),
+    "_junit_runner": attr.label(
+        default = Label("//util/junit_runner"),
+        executable = True,
+        # Built for the exec platform, like the other test-support tools
+        # (process_wrapper, collect_coverage). This keeps the runner off the
+        # target configuration, so it doesn't inherit target-only settings such
+        # as a custom #[global_allocator] or cc_common.link, which it has no way
+        # to satisfy and which would otherwise fail to link.
+        cfg = "exec",
+    ),
 } | _COVERAGE_ATTRS | _EXPERIMENTAL_USE_CC_COMMON_LINK_ATTRS
 
 rust_library = rule(
diff --git a/rust/runfiles/BUILD.bazel b/rust/runfiles/BUILD.bazel
index 695fa918f9..ad5cbe2854 100644
--- a/rust/runfiles/BUILD.bazel
+++ b/rust/runfiles/BUILD.bazel
@@ -16,6 +16,13 @@ rust_test(
     name = "runfiles_test",
     crate = ":runfiles",
     data = ["data/sample.txt"],
+    # These tests inspect the process's own runfiles -- the manifest layout and
+    # the repo mapping that rlocation! resolves against. The junit wrapper runs
+    # the test as a child under the wrapper's runfiles, which is a different
+    # ambient environment than the one being asserted on, so the runfiles
+    # library's own tests need to run unwrapped. Force off even if the
+    # //rust/settings:experimental_emit_junit_xml build setting is enabled.
+    experimental_junit = 0,
 )
 
 rust_doc(
diff --git a/rust/settings/BUILD.bazel b/rust/settings/BUILD.bazel
index d497a55b30..9b91114ccb 100644
--- a/rust/settings/BUILD.bazel
+++ b/rust/settings/BUILD.bazel
@@ -13,6 +13,7 @@ load(
     "default_allocator_library",
     "error_format",
     "experimental_compile_rustdoc_tests",
+    "experimental_emit_junit_xml",
     "experimental_link_std_dylib",
     "experimental_use_allocator_libraries_with_mangled_symbols",
     "experimental_use_cc_common_link",
@@ -86,6 +87,8 @@ clippy_error_format()
 
 experimental_compile_rustdoc_tests()
 
+experimental_emit_junit_xml()
+
 experimental_link_std_dylib()
 
 experimental_use_cc_common_link()
diff --git a/rust/settings/settings.bzl b/rust/settings/settings.bzl
index 4365d29e07..c7373365e6 100644
--- a/rust/settings/settings.bzl
+++ b/rust/settings/settings.bzl
@@ -272,6 +272,23 @@ def experimental_link_std_dylib():
         build_setting_default = False,
     )
 
+def experimental_emit_junit_xml():
+    """A flag to control whether `rust_test` targets emit JUnit XML test reports.
+
+    When enabled, each `rust_test` is wrapped with a runner that parses the test
+    binary's `libtest` output and writes a JUnit XML report to the path named by the
+    `$XML_OUTPUT_FILE` environment variable that `bazel test` provides. When
+    `$XML_OUTPUT_FILE` is unset (for example under `bazel run`), the runner execs the
+    test binary directly and adds no overhead.
+
+    This flag is off by default. Individual targets may override it with the
+    `experimental_junit` attribute on `rust_test`.
+    """
+    bool_flag(
+        name = "experimental_emit_junit_xml",
+        build_setting_default = False,
+    )
+
 def experimental_use_sh_toolchain_for_bootstrap_process_wrapper():
     """A flag to control whether the shell path from a shell toolchain (`@bazel_tools//tools/sh:toolchain_type`) \
     is embedded into the bootstrap process wrapper for the `.sh` file.
diff --git a/test/junit/BUILD.bazel b/test/junit/BUILD.bazel
new file mode 100644
index 0000000000..c5ca206c16
--- /dev/null
+++ b/test/junit/BUILD.bazel
@@ -0,0 +1,19 @@
+load("//rust:defs.bzl", "rust_test")
+
+# Force the JUnit wrapper on regardless of the
+# //rust/settings:experimental_emit_junit_xml build setting, so this coverage
+# runs even when the (default-off) setting is not enabled.
+rust_test(
+    name = "junit_test",
+    srcs = ["lib.rs"],
+    edition = "2021",
+    experimental_junit = 1,
+)
+
+# Force the JUnit wrapper off regardless of the build setting.
+rust_test(
+    name = "no_junit_test",
+    srcs = ["lib.rs"],
+    edition = "2021",
+    experimental_junit = 0,
+)
diff --git a/test/junit/lib.rs b/test/junit/lib.rs
new file mode 100644
index 0000000000..38b2fa80fa
--- /dev/null
+++ b/test/junit/lib.rs
@@ -0,0 +1,11 @@
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn test_passing() {
+        assert_eq!(2 + 2, 4);
+    }
+
+    #[test]
+    #[ignore]
+    fn test_ignored() {}
+}
diff --git a/test/unit/emit_junit_xml/BUILD.bazel b/test/unit/emit_junit_xml/BUILD.bazel
new file mode 100644
index 0000000000..f31eae2a7c
--- /dev/null
+++ b/test/unit/emit_junit_xml/BUILD.bazel
@@ -0,0 +1,4 @@
+load(":emit_junit_xml_test.bzl", "emit_junit_xml_test_suite")
+
+############################ UNIT TESTS #############################
+emit_junit_xml_test_suite(name = "emit_junit_xml_test_suite")
diff --git a/test/unit/emit_junit_xml/emit_junit_xml_test.bzl b/test/unit/emit_junit_xml/emit_junit_xml_test.bzl
new file mode 100644
index 0000000000..31a2f31367
--- /dev/null
+++ b/test/unit/emit_junit_xml/emit_junit_xml_test.bzl
@@ -0,0 +1,117 @@
+"""Analysis tests for the experimental JUnit XML wrapper on `rust_test`.
+
+These verify which executable `rust_test` selects across the tri-state
+`experimental_junit` attribute and the
+`//rust/settings:experimental_emit_junit_xml` build setting. They run in the
+analysis phase only (no test binary is executed): a wrapped target exposes the
+`<name>_junit_runner` executable, an unwrapped target exposes the plain test
+binary.
+"""
+
+load("@bazel_skylib//lib:unittest.bzl", "analysistest", "asserts")
+load("//rust:defs.bzl", "rust_test")
+
+_JUNIT_RUNNER_MARKER = "_junit_runner"
+
+_FLAG = str(Label("//rust/settings:experimental_emit_junit_xml"))
+
+def _executable_basename(env):
+    tut = analysistest.target_under_test(env)
+    return tut[DefaultInfo].files_to_run.executable.basename
+
+def _wrapped_test_impl(ctx):
+    env = analysistest.begin(ctx)
+    basename = _executable_basename(env)
+    asserts.true(
+        env,
+        _JUNIT_RUNNER_MARKER in basename,
+        "expected the JUnit runner to wrap the test, but the executable was {}".format(basename),
+    )
+    return analysistest.end(env)
+
+def _unwrapped_test_impl(ctx):
+    env = analysistest.begin(ctx)
+    basename = _executable_basename(env)
+    asserts.false(
+        env,
+        _JUNIT_RUNNER_MARKER in basename,
+        "expected the test to run unwrapped, but the executable was {}".format(basename),
+    )
+    return analysistest.end(env)
+
+wrapped_test = analysistest.make(_wrapped_test_impl)
+unwrapped_test = analysistest.make(_unwrapped_test_impl)
+wrapped_with_flag_test = analysistest.make(
+    _wrapped_test_impl,
+    config_settings = {_FLAG: True},
+)
+unwrapped_with_flag_test = analysistest.make(
+    _unwrapped_test_impl,
+    config_settings = {_FLAG: True},
+)
+
+def emit_junit_xml_test_suite(name):
+    """Defines the JUnit-gating analysis-test suite.
+
+    Args:
+        name: name of the resulting `test_suite`.
+    """
+    rust_test(
+        name = "attr_on",
+        srcs = ["lib.rs"],
+        edition = "2021",
+        experimental_junit = 1,
+    )
+    rust_test(
+        name = "attr_off",
+        srcs = ["lib.rs"],
+        edition = "2021",
+        experimental_junit = 0,
+    )
+    rust_test(
+        name = "attr_default",
+        srcs = ["lib.rs"],
+        edition = "2021",
+    )
+
+    # experimental_junit = 1 -> always wrapped, whatever the build setting is.
+    wrapped_test(
+        name = "attr_on_wraps_test",
+        target_under_test = ":attr_on",
+    )
+    wrapped_with_flag_test(
+        name = "attr_on_wraps_with_flag_test",
+        target_under_test = ":attr_on",
+    )
+
+    # experimental_junit = 0 -> never wrapped, whatever the build setting is.
+    unwrapped_test(
+        name = "attr_off_unwrapped_test",
+        target_under_test = ":attr_off",
+    )
+    unwrapped_with_flag_test(
+        name = "attr_off_unwrapped_with_flag_test",
+        target_under_test = ":attr_off",
+    )
+
+    # experimental_junit = -1 (default) -> defers to the build setting.
+    unwrapped_test(
+        name = "default_off_without_flag_test",
+        target_under_test = ":attr_default",
+    )
+    wrapped_with_flag_test(
+        name = "default_on_with_flag_test",
+        target_under_test = ":attr_default",
+    )
+
+    native.test_suite(
+        name = name,
+        tests = [
+            ":attr_on_wraps_test",
+            ":attr_on_wraps_with_flag_test",
+            ":attr_off_unwrapped_test",
+            ":attr_off_unwrapped_with_flag_test",
+            ":default_off_without_flag_test",
+            ":default_on_with_flag_test",
+        ],
+    )
diff --git a/test/unit/emit_junit_xml/lib.rs b/test/unit/emit_junit_xml/lib.rs
new file mode 100644
index 0000000000..6dfe3a2c33
--- /dev/null
+++ b/test/unit/emit_junit_xml/lib.rs
@@ -0,0 +1,7 @@
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn trivial() {
+        assert_eq!(2 + 2, 4);
+    }
+}
diff --git a/util/junit_runner/BUILD.bazel b/util/junit_runner/BUILD.bazel
new file mode 100644
index 0000000000..dc86326ba9
--- /dev/null
+++ b/util/junit_runner/BUILD.bazel
@@ -0,0 +1,22 @@
+load("//rust:defs.bzl", "rust_binary", "rust_test")
+
+rust_binary(
+    name = "junit_runner",
+    srcs = ["junit_runner.rs"],
+    edition = "2021",
+    rustc_flags = select({
+        "@platforms//os:linux": ["-Cstrip=debuginfo"],
+        "@platforms//os:macos": ["-Cstrip=symbols"],
+        "//conditions:default": [],
+    }),
+    visibility = ["//visibility:public"],
+)
+
+rust_test(
+    name = "junit_runner_test",
+    srcs = ["junit_runner.rs"],
+    edition = "2021",
+    # The runner must not wrap its own unit tests. Force off regardless of the
+    # //rust/settings:experimental_emit_junit_xml build setting.
+    experimental_junit = 0,
+)
diff --git a/util/junit_runner/junit_runner.rs b/util/junit_runner/junit_runner.rs
new file mode 100644
index 0000000000..122f6cd03b
--- /dev/null
+++ b/util/junit_runner/junit_runner.rs
@@ -0,0 +1,1072 @@
+use std::collections::HashMap;
+use std::env;
+use std::fs;
+use std::io::{BufRead, BufReader, Write};
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use std::sync::mpsc;
+use std::sync::{Arc, Mutex};
+use std::thread;
+use std::time::{Duration, Instant};
+
+fn resolve_runfiles(rlocation_path: &str) -> PathBuf {
+    if let Ok(manifest) = env::var("RUNFILES_MANIFEST_FILE") {
+        if let Ok(contents) = fs::read_to_string(&manifest) {
+            let prefix = format!("{} ", rlocation_path);
+            for line in contents.lines() {
+                if let Some(abs_path) = line.strip_prefix(&prefix) {
+                    let p = PathBuf::from(abs_path);
+                    if p.exists() {
+                        return p;
+                    }
+                }
+            }
+        }
+    }
+
+    if let Ok(dir) = env::var("RUNFILES_DIR") {
+        let candidate = PathBuf::from(&dir).join(rlocation_path);
+        if candidate.exists() {
+            return candidate;
+        }
+    }
+
+    if let Ok(dir) = env::var("TEST_SRCDIR") {
+        let candidate = PathBuf::from(&dir).join(rlocation_path);
+        if candidate.exists() {
+            return candidate;
+        }
+    }
+
+    eprintln!(
+        "ERROR: junit_runner: cannot resolve runfiles path: {}",
+        rlocation_path
+    );
+    eprintln!(
+        "  RUNFILES_MANIFEST_FILE={:?}",
+        env::var("RUNFILES_MANIFEST_FILE").ok()
+    );
+    eprintln!("  RUNFILES_DIR={:?}", env::var("RUNFILES_DIR").ok());
+    eprintln!("  TEST_SRCDIR={:?}", env::var("TEST_SRCDIR").ok());
+    std::process::exit(1);
+}
+
+fn exec_passthrough(test_bin: &PathBuf, args: &[String]) -> ! {
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::CommandExt;
+        let err = Command::new(test_bin).args(args).exec();
+        eprintln!("ERROR: junit_runner: exec failed: {}", err);
+        std::process::exit(1);
+    }
+
+    #[cfg(not(unix))]
+    {
+        let status = Command::new(test_bin)
+            .args(args)
+            .status()
+            .unwrap_or_else(|e| {
+                eprintln!("ERROR: junit_runner: failed to spawn test binary: {}", e);
+                std::process::exit(1);
+            });
+        std::process::exit(status.code().unwrap_or(1));
+    }
+}
+
+fn nocapture_in_args(args: &[String]) -> bool {
+    args.iter().any(|a| a == "--nocapture")
+}
+
+/// True when libtest would run with output capture disabled: either the
+/// `--nocapture` flag or the `RUST_TEST_NOCAPTURE` env var set to anything but
+/// "0", matching libtest's own precedence. In that mode libtest interleaves
+/// each test's own output into its result line, so the pretty output can no
+/// longer be parsed back into per-test results and we step aside instead of
+/// writing a broken report.
+fn wants_nocapture(args: &[String]) -> bool {
+    nocapture_in_args(args) || matches!(env::var("RUST_TEST_NOCAPTURE"), Ok(v) if v != "0")
+}
+
+#[derive(Debug, PartialEq)]
+struct TestResult {
+    name: String,
+    status: String,
+}
+
+/// The counts libtest prints on its `test result:` summary line.
+#[derive(Debug, PartialEq)]
+struct Summary {
+    passed: usize,
+    failed: usize,
+    ignored: usize,
+}
+
+struct ParsedOutput {
+    results: Vec<TestResult>,
+    failures: HashMap<String, String>,
+    suite_time: f64,
+    /// `None` if libtest never printed its summary line, which is our main
+    /// signal that the binary didn't finish running as a test harness.
+    summary: Option<Summary>,
+}
+
+/// A `---- <name> stdout ----` (or `stderr`) banner that opens a failure
+/// detail block; returns the test name it belongs to.
+fn failure_header(line: &str) -> Option<&str> {
+    let inner = line.strip_prefix("---- ")?;
+    inner
+        .strip_suffix(" stdout ----")
+        .or_else(|| inner.strip_suffix(" stderr ----"))
+}
+
+fn record_failure(failures: &mut HashMap<String, String>, name: &str, lines: &[String]) {
+    let body = lines.join("\n").trim_end().to_string();
+    // A test can have both stdout and stderr blocks; keep both.
+    match failures.get_mut(name) {
+        Some(existing) => {
+            existing.push('\n');
+            existing.push_str(&body);
+        }
+        None => {
+            failures.insert(name.to_string(), body);
+        }
+    }
+}
+
+fn parse_libtest_output(output: &str) -> ParsedOutput {
+    let mut results = Vec::new();
+    let mut failures = HashMap::new();
+    let mut current_failure: Option<String> = None;
+    let mut failure_lines: Vec<String> = Vec::new();
+    let mut suite_time = 0.0;
+    let mut summary = None;
+
+    for line in output.lines() {
+        // A new detail banner both opens a block and closes the previous one.
+        if let Some(name) = failure_header(line) {
+            if let Some(prev) = current_failure.take() {
+                record_failure(&mut failures, &prev, &failure_lines);
+            }
+            current_failure = Some(name.to_string());
+            failure_lines.clear();
+            continue;
+        }
+
+        if let Some(name) = &current_failure {
+            // A detail block runs until the trailing `failures:` name list, the
+            // `test result:` summary, or a bare `----` terminator (older
+            // libtest). Everything else is part of the captured output/panic.
+            // Note we must not stop the block until here, or the summary line
+            // gets swallowed and we lose the run totals entirely.
+            if line == "failures:" || line.starts_with("test result: ") {
+                record_failure(&mut failures, name, &failure_lines);
+                current_failure = None;
+                failure_lines.clear();
+                // fall through so the summary line is still parsed below
+            } else if line.starts_with("----") {
+                record_failure(&mut failures, name, &failure_lines);
+                current_failure = None;
+                failure_lines.clear();
+                continue;
+            } else {
+                // Drop the blank line libtest prints right after the banner.
+                if !(line.trim().is_empty() && failure_lines.is_empty()) {
+                    failure_lines.push(line.to_string());
+                }
+                continue;
+            }
+        }
+
+        // A per-test result: "test <name> ... ok|FAILED|ignored|bench"
+        if line.starts_with("test ") && line.contains(" ... ") {
+            if let Some(result) = parse_test_result_line(line) {
+                results.push(result);
+                continue;
+            }
+        }
+
+        // The run summary: "test result: ok. N passed; M failed; ..."
+        if line.starts_with("test result: ") {
+            if let Some(time) = parse_suite_time(line) {
+                suite_time = time;
+            }
+            if let Some(counts) = parse_suite_counts(line) {
+                summary = Some(counts);
+            }
+        }
+    }
+
+    if let Some(name) = &current_failure {
+        record_failure(&mut failures, name, &failure_lines);
+    }
+
+    ParsedOutput {
+        results,
+        failures,
+        suite_time,
+        summary,
+    }
+}
+
+fn parse_test_result_line(line: &str) -> Option<TestResult> {
+    // Format: "test <name> ... <status>"
+    // The name can contain spaces in some edge cases, but typically doesn't.
+    // We split on " ... " to separate name from status.
+    let after_test = line.strip_prefix("test ")?;
+    let sep_pos = after_test.find(" ... ")?;
+    // `#[should_panic]` tests print as `test <name> - should panic ... <status>`,
+    // but the `---- <name> stdout ----` failure banner uses the bare name. Strip
+    // the suffix so the testcase name is right and the failure-body lookup in
+    // build_junit_xml (keyed on the bare name) matches.
+    let raw_name = &after_test[..sep_pos];
+    let name = raw_name.strip_suffix(" - should panic").unwrap_or(raw_name);
+    let rest = &after_test[sep_pos + " ... ".len()..];
+
+    // Status is the first word of rest. `#[ignore = "reason"]` prints
+    // `... ignored, <reason>`, so that first token carries a trailing comma;
+    // strip it before matching or the test is silently dropped from the report.
+    let status = rest.split_whitespace().next()?.trim_end_matches(',');
+    match status {
+        "ok" | "FAILED" | "ignored" | "bench" => Some(TestResult {
+            name: name.to_string(),
+            status: status.to_string(),
+        }),
+        _ => None,
+    }
+}
+
+fn parse_suite_time(line: &str) -> Option<f64> {
+    // Format: "test result: ok. N passed; M failed; K ignored; ... finished in X.XXXs"
+    let finished_marker = "finished in ";
+    let pos = line.find(finished_marker)?;
+    let after = &line[pos + finished_marker.len()..];
+    let time_str = after.strip_suffix('s')?;
+    time_str.parse::<f64>().ok()
+}
+
+fn parse_suite_counts(line: &str) -> Option<Summary> {
+    // "test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; ..."
+    // Each ';'-separated clause ends in "<N> <label>"; pick out the three we
+    // care about. "measured"/"filtered out" are left alone on purpose.
+    let mut passed = None;
+    let mut failed = None;
+    let mut ignored = None;
+    for clause in line.split(';') {
+        let tokens: Vec<&str> = clause.split_whitespace().collect();
+        if tokens.len() < 2 {
+            continue;
+        }
+        let count = tokens[tokens.len() - 2].parse::<usize>();
+        let label = tokens[tokens.len() - 1];
+        if let Ok(count) = count {
+            match label {
+                "passed" => passed = Some(count),
+                "failed" => failed = Some(count),
+                "ignored" => ignored = Some(count),
+                _ => {}
+            }
+        }
+    }
+    Some(Summary {
+        passed: passed?,
+        failed: failed?,
+        ignored: ignored?,
+    })
+}
+
+/// Pull a one-line summary out of a libtest failure block for the `message`
+/// attribute, keeping the full block for the element body. Handles both the
+/// current `panicked at <loc>:\n<message>` layout and the older
+/// `panicked at '<message>', <loc>` one; falls back to the first non-empty
+/// line for failures that aren't panics (e.g. returned `Err`).
+fn extract_failure_message(body: &str) -> String {
+    let lines: Vec<&str> = body.lines().collect();
+    for (i, line) in lines.iter().enumerate() {
+        let Some((_, after)) = line.split_once("panicked at ") else {
+            continue;
+        };
+        // Old format keeps the message inline in single quotes.
+        if let Some(start) = after.find('\'') {
+            if let Some(end) = after[start + 1..].rfind('\'') {
+                let msg = &after[start + 1..start + 1 + end];
+                if !msg.is_empty() {
+                    return msg.to_string();
+                }
+            }
+        }
+        // New format puts the message on the following line(s).
+        if let Some(next) = lines[i + 1..].iter().find(|l| !l.trim().is_empty()) {
+            return next.trim().to_string();
+        }
+    }
+    lines
+        .iter()
+        .map(|l| l.trim())
+        .find(|l| !l.is_empty())
+        .unwrap_or("test failed")
+        .to_string()
+}
+
+fn xml_escape(s: &str) -> String {
+    let mut result = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => result.push_str("&amp;"),
+            '<' => result.push_str("&lt;"),
+            '>' => result.push_str("&gt;"),
+            '"' => result.push_str("&quot;"),
+            '\'' => result.push_str("&apos;"),
+            // Characters outside the XML 1.0 Char production (ANSI colour
+            // escapes, NUL, other C0 control bytes) cannot appear in a
+            // well-formed document even as numeric references, so drop them;
+            // otherwise a single escape byte in captured output makes the whole
+            // report unparseable and the suite fails to upload.
+            c if is_xml_illegal(c) => {}
+            _ => result.push(c),
+        }
+    }
+    result
+}
+
+/// True for characters disallowed by the XML 1.0 `Char` production. Tab,
+/// newline and carriage return are the only control characters permitted.
+fn is_xml_illegal(c: char) -> bool {
+    let u = c as u32;
+    (u < 0x20 && u != 0x09 && u != 0x0A && u != 0x0D) || u == 0xFFFE || u == 0xFFFF
+}
+
+struct Report<'a> {
+    binary_name: &'a str,
+    parsed: &'a ParsedOutput,
+    stdout: &'a str,
+    stderr: &'a str,
+    /// Set when the binary itself misbehaved (crashed, or exited non-zero
+    /// without failing a test), as opposed to an ordinary test failure.
+    harness_error: Option<&'a str>,
+}
+
+fn build_junit_xml(report: &Report) -> String {
+    let results = &report.parsed.results;
+    let n_fail = results.iter().filter(|r| r.status == "FAILED").count();
+    let n_skip = results.iter().filter(|r| r.status == "ignored").count();
+    let n_err = usize::from(report.harness_error.is_some());
+
+    let suite = xml_escape(report.binary_name);
+    let mut xml = String::new();
+    xml.push_str("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
+    xml.push_str("<testsuites>\n");
+    xml.push_str(&format!(
+        "<testsuite name=\"{}\" tests=\"{}\" failures=\"{}\" skipped=\"{}\" errors=\"{}\" time=\"{:.3}\">\n",
+        suite,
+        results.len() + n_err,
+        n_fail,
+        n_skip,
+        n_err,
+        report.parsed.suite_time,
+    ));
+
+    for r in results {
+        let name = xml_escape(&r.name);
+        match r.status.as_str() {
+            "FAILED" => {
+                let body = report
+                    .parsed
+                    .failures
+                    .get(&r.name)
+                    .map_or("", |s| s.as_str());
+                let message = extract_failure_message(body);
+                xml.push_str(&format!(
+                    "<testcase name=\"{}\" classname=\"{}\" status=\"run\">\n",
+                    name, suite,
+                ));
+                xml.push_str(&format!(
+                    "<failure message=\"{}\">{}</failure>\n",
+                    xml_escape(&message),
+                    xml_escape(body),
+                ));
+                xml.push_str("</testcase>\n");
+            }
+            "ignored" => {
+                xml.push_str(&format!(
+                    "<testcase name=\"{}\" classname=\"{}\" status=\"run\">\n",
+                    name, suite,
+                ));
+                xml.push_str("<skipped/>\n");
+                xml.push_str("</testcase>\n");
+            }
+            _ => {
+                xml.push_str(&format!(
+                    "<testcase name=\"{}\" classname=\"{}\" status=\"run\"/>\n",
+                    name, suite,
+                ));
+            }
+        }
+    }
+
+    if let Some(error) = report.harness_error {
+        xml.push_str(&format!(
+            "<testcase name=\"{} (test harness)\" classname=\"{}\" status=\"run\">\n",
+            suite, suite,
+        ));
+        xml.push_str(&format!("<error message=\"{}\"/>\n", xml_escape(error)));
+        xml.push_str("</testcase>\n");
+    }
+
+    if !report.stdout.is_empty() {
+        xml.push_str(&format!(
+            "<system-out>{}</system-out>\n",
+            xml_escape(report.stdout)
+        ));
+    }
+    if !report.stderr.is_empty() {
+        xml.push_str(&format!(
+            "<system-err>{}</system-err>\n",
+            xml_escape(report.stderr)
+        ));
+    }
+
+    xml.push_str("</testsuite>\n");
+    xml.push_str("</testsuites>\n");
+    xml
+}
+
+/// Warn (loudly, but without failing the run) when our parse of the output
+/// disagrees with the totals libtest reported. If this fires, the format we
+/// scrape has probably shifted and the report can't be trusted.
+fn warn_on_count_mismatch(summary: &Summary, results: &[TestResult]) {
+    let passed = results.iter().filter(|r| r.status == "ok").count();
+    let failed = results.iter().filter(|r| r.status == "FAILED").count();
+    let ignored = results.iter().filter(|r| r.status == "ignored").count();
+    if (passed, failed, ignored) != (summary.passed, summary.failed, summary.ignored) {
+        eprintln!(
+            "WARNING: junit_runner: parsed {passed} passed / {failed} failed / {ignored} ignored, \
+             but libtest reported {} / {} / {}; the JUnit report may be incomplete",
+            summary.passed, summary.failed, summary.ignored,
+        );
+    }
+}
+
+fn main() {
+    let rust_test_bin = env::var("RUST_TEST_BIN").unwrap_or_else(|_| {
+        eprintln!("ERROR: junit_runner: RUST_TEST_BIN environment variable not set");
+        std::process::exit(1);
+    });
+
+    let test_bin = resolve_runfiles(&rust_test_bin);
+    let args: Vec<String> = env::args().skip(1).collect();
+
+    // Nothing wants a report (e.g. `bazel run`): get out of the way entirely.
+    let xml_path = match env::var("XML_OUTPUT_FILE") {
+        Ok(path) => path,
+        Err(_) => exec_passthrough(&test_bin, &args),
+    };
+
+    // Under `--nocapture` libtest interleaves each test's own output into its
+    // result line, so the pretty output can't be parsed back into per-test
+    // results without dropping or mislabeling tests. Rather than write a broken
+    // report, step aside and run the test directly; Bazel then falls back to its
+    // own synthetic test.xml and the developer still sees their output.
+    if wants_nocapture(&args) {
+        eprintln!(
+            "WARNING: junit_runner: --nocapture set; skipping the JUnit report \
+             (libtest's output is not machine-parseable in this mode) and running \
+             the test binary directly"
+        );
+        exec_passthrough(&test_bin, &args);
+    }
+
+    let binary_name = test_bin
+        .file_name()
+        .and_then(|n| n.to_str())
+        .unwrap_or("rust_test")
+        .to_string();
+
+    let mut child = Command::new(&test_bin)
+        .args(&args)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap_or_else(|e| {
+            eprintln!("ERROR: junit_runner: failed to spawn test binary: {}", e);
+            std::process::exit(1);
+        });
+
+    let child_stdout = child.stdout.take().expect("stdout was piped");
+    let child_stderr = child.stderr.take().expect("stderr was piped");
+
+    // Read stdout and stderr concurrently, each on its own thread, mirroring
+    // every line through and collecting it into a shared buffer. Both pipes
+    // must be drained at once so a test that floods one can't wedge us while
+    // we read the other. Each reader signals completion on a channel.
+    //
+    // We wait on the test *process* first, then give the readers a short grace
+    // period. A test can leak a child (a mock server, a helper daemon) that
+    // inherits these pipes and outlives it; that child keeps the write end
+    // open, so the pipe never reaches EOF and a naive read blocks until Bazel
+    // kills the run at its test timeout. Once the test process has exited we
+    // already have all of its output, so we stop waiting and move on. Bazel
+    // reaps the leaked processes during normal sandbox teardown, exactly as it
+    // would without this wrapper.
+    let stdout_buf = Arc::new(Mutex::new(Vec::<String>::new()));
+    let stderr_buf = Arc::new(Mutex::new(Vec::<String>::new()));
+    let (done_tx, done_rx) = mpsc::channel();
+
+    // Drain one child pipe: mirror each line to our own std stream and collect
+    // it. Read raw bytes via read_until, not BufRead::lines(). lines() returns
+    // an error on the first non-UTF-8 byte, which aborts the read early: that
+    // drops libtest's trailing summary (so a passing run looks like a harness
+    // crash) and closes the pipe under a still-running child. Decode lossily;
+    // the summary tokens the parser needs are ASCII and survive intact.
+    fn drain(
+        mut reader: impl BufRead,
+        mut mirror: impl Write,
+        buf: &Mutex<Vec<String>>,
+        stream: &str,
+    ) {
+        let mut bytes = Vec::new();
+        loop {
+            bytes.clear();
+            match reader.read_until(b'\n', &mut bytes) {
+                Ok(0) => break,
+                Ok(_) => {
+                    if bytes.last() == Some(&b'\n') {
+                        bytes.pop();
+                        if bytes.last() == Some(&b'\r') {
+                            bytes.pop();
+                        }
+                    }
+                    let text = String::from_utf8_lossy(&bytes);
+                    let _ = writeln!(mirror, "{}", text);
+                    buf.lock().unwrap().push(text.into_owned());
+                }
+                Err(e) => {
+                    eprintln!("WARNING: junit_runner: error reading {}: {}", stream, e);
+                    break;
+                }
+            }
+        }
+    }
+
+    {
+        let stderr_buf = Arc::clone(&stderr_buf);
+        let done_tx = done_tx.clone();
+        thread::spawn(move || {
+            drain(
+                BufReader::new(child_stderr),
+                std::io::stderr(),
+                &stderr_buf,
+                "stderr",
+            );
+            let _ = done_tx.send(());
+        });
+    }
+
+    {
+        let stdout_buf = Arc::clone(&stdout_buf);
+        let done_tx = done_tx.clone();
+        thread::spawn(move || {
+            drain(
+                BufReader::new(child_stdout),
+                std::io::stdout(),
+                &stdout_buf,
+                "stdout",
+            );
+            let _ = done_tx.send(());
+        });
+    }
+    drop(done_tx);
+
+    let status = child.wait().unwrap_or_else(|e| {
+        eprintln!("ERROR: junit_runner: failed to wait for test binary: {}", e);
+        std::process::exit(1);
+    });
+
+    // The test process is gone and its output is already written; let the
+    // readers finish draining, but never block on a leaked child forever.
+    let deadline = Instant::now() + Duration::from_secs(5);
+    for _ in 0..2 {
+        let remaining = deadline.saturating_duration_since(Instant::now());
+        if done_rx.recv_timeout(remaining).is_err() {
+            break;
+        }
+    }
+
+    let stdout_output = stdout_buf.lock().unwrap().join("\n");
+    let stderr_output = stderr_buf.lock().unwrap().join("\n");
+    let parsed = parse_libtest_output(&stdout_output);
+
+    let exit_code = status.code();
+    let exit_desc = exit_code.map_or_else(|| "a signal".to_string(), |c| format!("code {}", c));
+
+    // Separate a misbehaving binary from a test that legitimately failed. No
+    // summary means libtest never finished; a non-zero exit with nothing
+    // marked FAILED means something outside the tests went wrong. In both
+    // cases we'd otherwise hand back an all-green report for a red run.
+    let harness_error = if parsed.summary.is_none() {
+        Some(format!(
+            "test binary exited with {} without printing a libtest summary; \
+             it likely crashed or aborted before finishing",
+            exit_desc,
+        ))
+    } else if exit_code != Some(0) && !parsed.results.iter().any(|r| r.status == "FAILED") {
+        Some(format!(
+            "test binary exited with {} but reported no failing tests",
+            exit_desc,
+        ))
+    } else {
+        None
+    };
+
+    if let Some(summary) = &parsed.summary {
+        warn_on_count_mismatch(summary, &parsed.results);
+    }
+
+    let report = Report {
+        binary_name: &binary_name,
+        parsed: &parsed,
+        stdout: &stdout_output,
+        stderr: &stderr_output,
+        harness_error: harness_error.as_deref(),
+    };
+    let xml = build_junit_xml(&report);
+
+    if let Err(e) = fs::write(&xml_path, xml.as_bytes()) {
+        eprintln!(
+            "WARNING: junit_runner: failed to write XML to {}: {}",
+            xml_path, e
+        );
+    }
+
+    std::process::exit(exit_code.unwrap_or(1));
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn report<'a>(binary_name: &'a str, parsed: &'a ParsedOutput) -> Report<'a> {
+        Report {
+            binary_name,
+            parsed,
+            stdout: "",
+            stderr: "",
+            harness_error: None,
+        }
+    }
+
+    #[test]
+    fn parse_result_line_ok() {
+        assert_eq!(
+            parse_test_result_line("test foo::bar ... ok"),
+            Some(TestResult {
+                name: "foo::bar".into(),
+                status: "ok".into()
+            }),
+        );
+    }
+
+    #[test]
+    fn parse_result_line_failed() {
+        assert_eq!(
+            parse_test_result_line("test my_test ... FAILED"),
+            Some(TestResult {
+                name: "my_test".into(),
+                status: "FAILED".into()
+            }),
+        );
+    }
+
+    #[test]
+    fn parse_result_line_ignored() {
+        assert_eq!(
+            parse_test_result_line("test skipped_test ... ignored"),
+            Some(TestResult {
+                name: "skipped_test".into(),
+                status: "ignored".into()
+            }),
+        );
+    }
+
+    #[test]
+    fn parse_result_line_ignored_with_reason() {
+        // `#[ignore = "reason"]` appends `, <reason>` after the status word.
+        assert_eq!(
+            parse_test_result_line("test skipped_test ... ignored, needs network"),
+            Some(TestResult {
+                name: "skipped_test".into(),
+                status: "ignored".into()
+            }),
+        );
+    }
+
+    #[test]
+    fn parse_result_line_should_panic_suffix_stripped() {
+        // `#[should_panic]` prints `<name> - should panic` in the result line,
+        // while the failure banner uses the bare name.
+        assert_eq!(
+            parse_test_result_line("test tests::boom - should panic ... FAILED"),
+            Some(TestResult {
+                name: "tests::boom".into(),
+                status: "FAILED".into()
+            }),
+        );
+    }
+
+    #[test]
+    fn parse_result_line_bench() {
+        assert_eq!(
+            parse_test_result_line("test bench_thing ... bench"),
+            Some(TestResult {
+                name: "bench_thing".into(),
+                status: "bench".into()
+            }),
+        );
+    }
+
+    #[test]
+    fn parse_result_line_invalid() {
+        assert_eq!(parse_test_result_line("not a test line"), None);
+        assert_eq!(parse_test_result_line("test incomplete"), None);
+        assert_eq!(parse_test_result_line("test bad ... unknown_status"), None);
+    }
+
+    #[test]
+    fn nocapture_flag_detected_in_args() {
+        assert!(nocapture_in_args(&["--nocapture".to_string()]));
+        assert!(nocapture_in_args(&[
+            "some::filter".to_string(),
+            "--nocapture".to_string(),
+        ]));
+        // `--show-output` prints captured output in a trailing section rather
+        // than interleaving it, so it stays parseable and must not trip this.
+        assert!(!nocapture_in_args(&[
+            "some::filter".to_string(),
+            "--show-output".to_string(),
+        ]));
+    }
+
+    #[test]
+    fn parse_suite_time_valid() {
+        let line = "test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 1.234s";
+        assert_eq!(parse_suite_time(line), Some(1.234));
+    }
+
+    #[test]
+    fn parse_suite_time_no_match() {
+        assert_eq!(parse_suite_time("no time here"), None);
+    }
+
+    #[test]
+    fn parse_suite_counts_valid() {
+        let line = "test result: ok. 3 passed; 1 failed; 2 ignored; 0 measured; 0 filtered out; finished in 1.234s";
+        assert_eq!(
+            parse_suite_counts(line),
+            Some(Summary {
+                passed: 3,
+                failed: 1,
+                ignored: 2
+            }),
+        );
+    }
+
+    #[test]
+    fn parse_libtest_output_records_summary() {
+        let output = "\
+running 1 test
+test ok_test ... ok
+
+test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.010s";
+        let parsed = parse_libtest_output(output);
+        assert_eq!(
+            parsed.summary,
+            Some(Summary {
+                passed: 1,
+                failed: 0,
+                ignored: 0
+            }),
+        );
+    }
+
+    #[test]
+    fn parse_libtest_output_no_summary_when_truncated() {
+        // A binary that dies mid-run never prints "test result:".
+        let output = "\
+running 2 tests
+test a ... ok";
+        let parsed = parse_libtest_output(output);
+        assert!(parsed.summary.is_none());
+    }
+
+    #[test]
+    fn parse_libtest_output_mixed() {
+        let output = "\
+running 3 tests
+test pass_test ... ok
+test fail_test ... FAILED
+test skip_test ... ignored
+
+failures:
+
+---- fail_test stdout ----
+assertion failed: false
+----
+
+failures:
+    fail_test
+
+test result: FAILED. 1 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.500s";
+
+        let parsed = parse_libtest_output(output);
+        assert_eq!(parsed.results.len(), 3);
+        assert_eq!(parsed.results[0].status, "ok");
+        assert_eq!(parsed.results[1].status, "FAILED");
+        assert_eq!(parsed.results[2].status, "ignored");
+        assert!(parsed.failures.contains_key("fail_test"));
+        assert!(parsed.failures["fail_test"].contains("assertion failed"));
+        assert!((parsed.suite_time - 0.5).abs() < 0.001);
+    }
+
+    #[test]
+    fn parse_libtest_output_summary_after_failure_block() {
+        // Modern libtest does not print a closing `----` after a failure's
+        // detail block: the block is followed directly by the `failures:` name
+        // list and then `test result:`. The parser must still pick up the
+        // summary here, otherwise a passing-but-failing run looks like a crash.
+        let output = "\
+running 3 tests
+test tests::test_ignored ... ok
+test tests::test_passing ... ok
+test tests::test_failing ... FAILED
+
+failures:
+
+---- tests::test_failing stdout ----
+
+thread 'tests::test_failing' panicked at test/junit/lib.rs:14:9:
+assertion `left == right` failed: arithmetic is broken
+  left: 4
+ right: 5
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+
+
+failures:
+    tests::test_failing
+
+test result: FAILED. 2 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s";
+
+        let parsed = parse_libtest_output(output);
+        let summary = parsed
+            .summary
+            .expect("summary must survive the failure block");
+        assert_eq!(summary.passed, 2);
+        assert_eq!(summary.failed, 1);
+        assert_eq!(summary.ignored, 0);
+
+        // The failure body holds the panic but not the trailing summary lines.
+        let body = &parsed.failures["tests::test_failing"];
+        assert!(body.contains("arithmetic is broken"));
+        assert!(!body.contains("test result:"));
+        assert!(!body.contains("failures:"));
+        assert_eq!(
+            extract_failure_message(body),
+            "assertion `left == right` failed: arithmetic is broken"
+        );
+    }
+
+    #[test]
+    fn failure_message_new_panic_format() {
+        let body = "\
+thread 'tests::foo' panicked at src/lib.rs:10:5:
+assertion `left == right` failed
+  left: 1
+ right: 2
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace";
+        assert_eq!(
+            extract_failure_message(body),
+            "assertion `left == right` failed"
+        );
+    }
+
+    #[test]
+    fn failure_message_old_panic_format() {
+        let body = "thread 'tests::foo' panicked at 'boom', src/lib.rs:3:5";
+        assert_eq!(extract_failure_message(body), "boom");
+    }
+
+    #[test]
+    fn failure_message_non_panic_fallback() {
+        let body = "the test returned an Err: NotFound";
+        assert_eq!(
+            extract_failure_message(body),
+            "the test returned an Err: NotFound"
+        );
+    }
+
+    #[test]
+    fn xml_escape_special_chars() {
+        assert_eq!(
+            xml_escape("a&b<c>d\"e'f"),
+            "a&amp;b&lt;c&gt;d&quot;e&apos;f"
+        );
+    }
+
+    #[test]
+    fn xml_escape_no_special() {
+        assert_eq!(xml_escape("hello world"), "hello world");
+    }
+
+    #[test]
+    fn xml_escape_strips_illegal_control_chars() {
+        // ANSI colour escape (ESC) and NUL are illegal in XML 1.0 and must be
+        // dropped; tab and newline are legal and must be preserved.
+        assert_eq!(
+            xml_escape("red\u{1b}[31m\u{0}text\tline\n"),
+            "red[31mtext\tline\n"
+        );
+    }
+
+    #[test]
+    fn build_xml_passing_tests() {
+        let parsed = ParsedOutput {
+            results: vec![
+                TestResult {
+                    name: "test_a".into(),
+                    status: "ok".into(),
+                },
+                TestResult {
+                    name: "test_b".into(),
+                    status: "ok".into(),
+                },
+            ],
+            failures: HashMap::new(),
+            suite_time: 1.0,
+            summary: Some(Summary {
+                passed: 2,
+                failed: 0,
+                ignored: 0,
+            }),
+        };
+        let xml = build_junit_xml(&report("my_test", &parsed));
+        assert!(xml.contains("<?xml version=\"1.0\""));
+        assert!(xml.contains("tests=\"2\""));
+        assert!(xml.contains("failures=\"0\""));
+        assert!(xml.contains("skipped=\"0\""));
+        assert!(xml.contains("errors=\"0\""));
+        assert!(xml.contains("<testcase name=\"test_a\""));
+        assert!(xml.contains("<testcase name=\"test_b\""));
+        assert!(!xml.contains("<failure"));
+        assert!(!xml.contains("<skipped/>"));
+    }
+
+    #[test]
+    fn build_xml_with_failure() {
+        let mut failures = HashMap::new();
+        failures.insert(
+            "bad_test".to_string(),
+            "thread 'bad_test' panicked at src/lib.rs:1:1:\nsomething broke".to_string(),
+        );
+        let parsed = ParsedOutput {
+            results: vec![TestResult {
+                name: "bad_test".into(),
+                status: "FAILED".into(),
+            }],
+            failures,
+            suite_time: 0.1,
+            summary: Some(Summary {
+                passed: 0,
+                failed: 1,
+                ignored: 0,
+            }),
+        };
+        let xml = build_junit_xml(&report("my_test", &parsed));
+        assert!(xml.contains("failures=\"1\""));
+        // The panic message becomes the message attr; the full block is the body.
+        assert!(xml.contains("<failure message=\"something broke\">"));
+        assert!(xml.contains("panicked at src/lib.rs"));
+    }
+
+    #[test]
+    fn build_xml_with_ignored() {
+        let parsed = ParsedOutput {
+            results: vec![TestResult {
+                name: "skip_me".into(),
+                status: "ignored".into(),
+            }],
+            failures: HashMap::new(),
+            suite_time: 0.0,
+            summary: Some(Summary {
+                passed: 0,
+                failed: 0,
+                ignored: 1,
+            }),
+        };
+        let xml = build_junit_xml(&report("my_test", &parsed));
+        assert!(xml.contains("skipped=\"1\""));
+        assert!(xml.contains("<skipped/>"));
+    }
+
+    #[test]
+    fn build_xml_escapes_special_chars() {
+        let mut failures = HashMap::new();
+        failures.insert("test<x>".to_string(), "a & b".to_string());
+        let parsed = ParsedOutput {
+            results: vec![TestResult {
+                name: "test<x>".into(),
+                status: "FAILED".into(),
+            }],
+            failures,
+            suite_time: 0.0,
+            summary: Some(Summary {
+                passed: 0,
+                failed: 1,
+                ignored: 0,
+            }),
+        };
+        let xml = build_junit_xml(&report("bin&name", &parsed));
+        assert!(xml.contains("name=\"bin&amp;name\""));
+        assert!(xml.contains("name=\"test&lt;x&gt;\""));
+        assert!(xml.contains("a &amp; b"));
+    }
+
+    #[test]
+    fn build_xml_harness_error() {
+        let parsed = ParsedOutput {
+            results: vec![TestResult {
+                name: "ran_ok".into(),
+                status: "ok".into(),
+            }],
+            failures: HashMap::new(),
+            suite_time: 0.0,
+            summary: None,
+        };
+        let mut r = report("crashy", &parsed);
+        r.harness_error =
+            Some("test binary exited with code 139 without printing a libtest summary");
+        let xml = build_junit_xml(&r);
+        assert!(xml.contains("errors=\"1\""));
+        assert!(xml.contains("tests=\"2\""));
+        assert!(xml.contains("<testcase name=\"crashy (test harness)\""));
+        assert!(xml.contains("<error message=\"test binary exited with code 139"));
+    }
+
+    #[test]
+    fn build_xml_includes_captured_output() {
+        let parsed = ParsedOutput {
+            results: vec![TestResult {
+                name: "t".into(),
+                status: "ok".into(),
+            }],
+            failures: HashMap::new(),
+            suite_time: 0.0,
+            summary: Some(Summary {
+                passed: 1,
+                failed: 0,
+                ignored: 0,
+            }),
+        };
+        let mut r = report("bin", &parsed);
+        r.stderr = "a panic backtrace";
+        let xml = build_junit_xml(&r);
+        assert!(xml.contains("<system-err>a panic backtrace</system-err>"));
+    }
+}