diff --git a/.build/README.md b/.build/README.md
index c62424d89411..6c3c4922111e 100644
--- a/.build/README.md
+++ b/.build/README.md
@@ -4,6 +4,29 @@ Building and Testing with the helper sripts
 Information on building and testing beyond the use of ant.
 All scripts also print help if the first argument is `-h`.
 
+`build-jars.sh`, `check-code.sh` and `run-tests.sh` accept `-s` (`--summary`).
+That prints a summary of the failures in place of the full ant output, and keeps
+the full output in a log file under the build directory.  The scripts name that
+file when a run fails.
+
+Building JARs
+-------------
+
+Build in docker:
+
+    .build/docker/build-jars.sh
+
+
+Build without docker:
+
+    .build/build-jars.sh
+
+
+Remove the artifacts of a previous build first:
+
+    .build/build-jars.sh --clean
+
+
 Code Checks and Lints
 ---------------------
 
@@ -150,6 +173,19 @@ Debugging test scripts:
     DEBUG=true .build/docker/run-tests.sh -a test
 
 
+Testing the helper scripts
+--------------------------
+
+The tests of the helper scripts need no JDK build.  A stub `ant` and a stub `docker`
+replay canned output, so each suite runs in seconds.
+
+Run them:
+
+    python3 -m unittest discover -s .build/sh/test    # the log summarizers
+    .build/sh/test/stub-ant-cases.sh                  # .build/*.sh
+    .build/sh/test/stub-docker-cases.sh               # .build/docker/*.sh
+
+
 Running Sonar analysis (experimental)
 -------------------------------------
 
diff --git a/.build/build-jars.sh b/.build/build-jars.sh
index cf2b91b08201..e61fb617b2f2 100755
--- a/.build/build-jars.sh
+++ b/.build/build-jars.sh
@@ -17,6 +17,25 @@
 
 # temporary between CASSANDRA-18133 and CASSANDRA-18594
 
+print_help() {
+  echo "Usage: $0 [-c|--clean] [-s|--summary] [-h|--help]"
+  echo "   -c, --clean    Remove locally created artifacts (ant clean) before building"
+  echo "   -s, --summary  Print a summary of failures instead of the full ant output"
+  echo "   -h, --help     Print help"
+}
+
+# arguments, with defaults
+clean=false
+summary=false
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -c|--clean)   clean=true; shift ;;
+    -s|--summary) summary=true; shift ;;
+    -h|--help)    print_help; exit 0 ;;
+    *)            echo >&2 "Unknown argument $1"; print_help >&2; exit 1 ;;
+  esac
+done
+
 # variables, with defaults
 [ "x${CASSANDRA_DIR}" != "x" ] || CASSANDRA_DIR="$(readlink -f $(dirname -- "$0")/..)"
 
@@ -24,7 +43,15 @@
 command -v ant >/dev/null 2>&1 || { echo >&2 "ant needs to be installed"; exit 1; }
 [ -d "${CASSANDRA_DIR}" ] || { echo >&2 "Directory ${CASSANDRA_DIR} must exist"; exit 1; }
 [ -f "${CASSANDRA_DIR}/build.xml" ] || { echo >&2 "${CASSANDRA_DIR}/build.xml must exist"; exit 1; }
+[ -f "${CASSANDRA_DIR}/.build/sh/_run-ant.sh" ] || { echo >&2 "${CASSANDRA_DIR}/.build/sh/_run-ant.sh must exist"; exit 1; }
+
+# defines run_ant(), which reads ${CASSANDRA_DIR} and ${summary}
+# shellcheck source=.build/sh/_run-ant.sh
+. "${CASSANDRA_DIR}/.build/sh/_run-ant.sh"
 
 # execute
-ant -f "${CASSANDRA_DIR}/build.xml" jar
+if ${clean}; then
+  run_ant clean
+fi
+run_ant jar
 exit $?
diff --git a/.build/check-code.sh b/.build/check-code.sh
index 4a540a653d4d..f79c6df81b2b 100755
--- a/.build/check-code.sh
+++ b/.build/check-code.sh
@@ -15,6 +15,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+print_help() {
+  echo "Usage: $0 [-s|--summary] [-h|--help]"
+  echo "   -s, --summary  Print a summary of failures instead of the full ant output"
+  echo "   -h, --help     Print help"
+}
+
+# arguments, with defaults
+summary=false
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -s|--summary) summary=true; shift ;;
+    -h|--help)    print_help; exit 0 ;;
+    *)            echo >&2 "Unknown argument $1"; print_help >&2; exit 1 ;;
+  esac
+done
+
 # variables, with defaults
 [ "x${CASSANDRA_DIR}" != "x" ] || { CASSANDRA_DIR="$(dirname -- "$0")/.."; }
 
@@ -22,7 +38,17 @@
 command -v ant >/dev/null 2>&1 || { echo >&2 "ant needs to be installed"; exit 1; }
 [ -d "${CASSANDRA_DIR}" ] || { echo >&2 "Directory ${CASSANDRA_DIR} must exist"; exit 1; }
 [ -f "${CASSANDRA_DIR}/build.xml" ] || { echo >&2 "${CASSANDRA_DIR}/build.xml must exist"; exit 1; }
+[ -f "${CASSANDRA_DIR}/.build/sh/_run-ant.sh" ] || { echo >&2 "${CASSANDRA_DIR}/.build/sh/_run-ant.sh must exist"; exit 1; }
+
+# defines run_ant(), which reads ${CASSANDRA_DIR} and ${summary}
+# shellcheck source=.build/sh/_run-ant.sh
+. "${CASSANDRA_DIR}/.build/sh/_run-ant.sh"
 
-# execute. memory needs to fit within the specified container size, see .jenkins/Jenkinsfile
-ANT_OPTS="-Xmx2g -XX:+PrintClassHistogram -XX:OnOutOfMemoryError='kill -QUIT %p'" ant -f "${CASSANDRA_DIR}/build.xml" check # dependency-check # FIXME dependency-check now requires NVD key downloaded first
+# execute. the check target runs rat-check, checkstyle and checkstyle-test,
+# and depends on _main-jar, build-test and gen-asciidoc. see build.xml
+# memory needs to fit within the specified container size, see .jenkins/Jenkinsfile
+# dependency-check # FIXME dependency-check now requires NVD key downloaded first
+# append, as .build/docker/_docker_run.sh puts -Dbuild.dir=${DIST_DIR} in ANT_OPTS
+export ANT_OPTS="${ANT_OPTS:-} -Xmx2g -XX:+PrintClassHistogram -XX:OnOutOfMemoryError='kill -QUIT %p'"
+run_ant check
 exit $?
diff --git a/.build/docker/_docker_run.sh b/.build/docker/_docker_run.sh
index 41cdae12074f..ee3784c76e45 100755
--- a/.build/docker/_docker_run.sh
+++ b/.build/docker/_docker_run.sh
@@ -18,7 +18,7 @@
 #
 # Creates the artifacts, performing additional QA checks
 #
-# Usage: _docker_run.sh <docker_image_name> <script_to_execute> <java_version>
+# Usage: _docker_run.sh <docker_image_name> <script_to_execute> [<java_version>] [<script arguments…>]
 
 ################################
 #
@@ -41,15 +41,23 @@ java_version_default=`grep 'property\s*name="java.default"' ${cassandra_dir}/bui
 java_version_supported=`grep 'property\s*name="java.supported"' ${cassandra_dir}/build.xml |sed -ne 's/.*value="\([^"]*\)".*/\1/p'`
 
 if [ "$1" == "-h" ]; then
-   echo "$0 [-h] <dockerfile> <run_script> [<java version>]"
-   echo " this script is used by check|build*.sh scripts (in the same directory) as a wrapper delegating the container run of the <dockerfile> and execution of the <run_script>, and using [<java version>] is specified"
-   exit 1
+   echo "$0 [-h] <dockerfile> <run_script> [<java_version>] [<script arguments…>]"
+   echo " this script is used by check|build*.sh scripts (in the same directory) as a wrapper delegating the container run of the <dockerfile> and execution of the <run_script>, using [<java_version>] if it is specified"
+   echo " [<script arguments…>] are passed to <run_script>. an argument that starts with - is never read as the java version"
+   exit 0
 fi
 
 # arguments
 dockerfile=$1
 run_script=$2
-java_version=$3
+shift 2
+# the java version is positional and optional. a leading - marks a run_script argument,
+# so that e.g. `build-jars.sh --clean` is not read as a java version
+java_version=""
+case "${1:-}" in
+  ""|-*) ;;
+  *)     java_version=$1; shift ;;
+esac
 
 # pre-conditions
 command -v docker >/dev/null 2>&1 || { echo >&2 "docker needs to be installed"; exit 1; }
@@ -114,8 +122,12 @@ fi
 
 # Run build script through docker
 random_string="$(LC_ALL=C tr -dc A-Za-z0-9 </dev/urandom | head -c 6 ; echo '')"
-run_script_name=$(echo ${run_script} | sed  's/.sh//' | sed 's/_//')
-container_name="cassandra_${dockerfile/.docker/}_${un_script_name}_jdk${java_version}__${random_string}"
+# a container name accepts [a-zA-Z0-9][a-zA-Z0-9_.-] only, so drop the directory of a
+# run_script such as docker/_build-redhat.sh, then its .sh suffix and its leading _
+run_script_name="${run_script##*/}"
+run_script_name="${run_script_name%.sh}"
+run_script_name="${run_script_name#_}"
+container_name="cassandra_${dockerfile/.docker/}_${run_script_name}_jdk${java_version}__${random_string}"
 
 [ $DEBUG ] && docker_envs="${docker_envs} --env DEBUG=1"
 
@@ -125,7 +137,7 @@ container_name="cassandra_${dockerfile/.docker/}_${un_script_name}_jdk${java_ver
 #  execute the run_script
 docker_command="export ANT_OPTS=\"-Dbuild.dir=\${DIST_DIR} ${CASSANDRA_DOCKER_ANT_OPTS}\" ; \
                 source \${CASSANDRA_DIR}/.build/docker/_set_java.sh ${java_version} ; \
-                \${CASSANDRA_DIR}/.build/${run_script} ${@:4} ; exit \$? "
+                \${CASSANDRA_DIR}/.build/${run_script} ${@} ; exit \$? "
 
 # run without the default seccomp profile
 # re-use the host's maven repository
diff --git a/.build/docker/build-jars.sh b/.build/docker/build-jars.sh
index 990a8e77d787..a00ad5a99149 100755
--- a/.build/docker/build-jars.sh
+++ b/.build/docker/build-jars.sh
@@ -17,6 +17,8 @@
 
 #
 # Build the jars
+#
+# Usage: build-jars.sh [<java version>] [<build-jars.sh arguments…>]
 
-$(dirname -- "$0")/_docker_run.sh debian-build.docker build-jars.sh $1
+$(dirname -- "$0")/_docker_run.sh debian-build.docker build-jars.sh "$@"
 exit $?
diff --git a/.build/docker/check-code.sh b/.build/docker/check-code.sh
index ce0b86be5fa4..502665b7aa95 100755
--- a/.build/docker/check-code.sh
+++ b/.build/docker/check-code.sh
@@ -17,7 +17,9 @@
 
 #
 # Perform code checks
+#
+# Usage: check-code.sh [<java version>] [<check-code.sh arguments…>]
 
 export CASSANDRA_DOCKER_ANT_OPTS="-Ddependency-check.home.base=/tmp"
 
-$(dirname -- "$0")/_docker_run.sh debian-build.docker check-code.sh $1
+$(dirname -- "$0")/_docker_run.sh debian-build.docker check-code.sh "$@"
diff --git a/.build/docker/run-tests.sh b/.build/docker/run-tests.sh
index 20ef5d481413..c16797e94c44 100755
--- a/.build/docker/run-tests.sh
+++ b/.build/docker/run-tests.sh
@@ -37,15 +37,21 @@ _target_test_types="$(grep '^TARGET_TYPES=' "${cassandra_dir}/.build/run-tests.s
 _target_dtest_types="$(cd ${cassandra_dir}; bash <(sed -n "/^TARGET_TYPES=/,/^done$/p" .build/run-python-dtests.sh; echo 'echo ${TARGET_TYPES}'))"
 TARGET_TYPES="${_target_test_types} ${_target_dtest_types}"
 
+java_version_default=`grep 'property\s*name="java.default"' ${cassandra_dir}/build.xml 2>/dev/null |sed -ne 's/.*value="\([^"]*\)".*/\1/p'`
+java_version_supported=`grep 'property\s*name="java.supported"' ${cassandra_dir}/build.xml 2>/dev/null |sed -ne 's/.*value="\([^"]*\)".*/\1/p'`
+regx_java_version="(${java_version_supported//,/|})"
+
 print_help() {
   echo ""
-  echo "Usage: $0 [-a|-t|-c|-j|-h] [extra arguments]"
-  echo "   -a Test target type: ${TARGET_TYPES}"
-  echo "   -t Test name regexp to run."
-  echo "   -c Chunk to run in the form X/Y: Run chunk X from a total of Y chunks."
-  echo "   -j Java version. Default java_version is what 'java.default' specifies in build.xml."
-  echo "   [extra arguments] will be passed to downstream scripts."
-  exit 1
+  echo "Usage: $0 [-a|-t|-c|-j|-s|-h] [extra arguments]"
+  echo "   -a, --target <type>   Test target type: ${TARGET_TYPES}"
+  echo "   -t, --test <regexp>   Test name regexp to run."
+  echo "   -c, --chunk <X/Y>     Chunk to run in the form X/Y: Run chunk X from a total of Y chunks."
+  echo "   -j, --java <version>  Java version. Default java_version is what 'java.default' specifies in build.xml."
+  echo "   -s, --summary         Print a summary of failed tests instead of the full ant output."
+  echo "   [extra arguments] are passed to the downstream script, for example -i and -b for"
+  echo "                     .build/run-tests.sh. Both downstream scripts reject an option"
+  echo "                     they do not recognise."
 }
 
 error() {
@@ -54,47 +60,79 @@ error() {
   exit $1
 }
 
-# legacy argument handling
+# legacy argument handling, for the form <target> [<test regexp|chunk>] [<java version>]
 if [[ " ${TARGET_TYPES} " =~ " ${1} " ]]; then
   test_type="-a ${1}"
+  java_version_arg=""
   if [[ -z ${2} ]]; then
     test_list=""
   elif [[ -n ${2} && "${2}" =~ ^[0-9]+/[0-9]+$ ]]; then
     test_list="-c ${2}";
+  elif [[ -z ${3} && "${2}" =~ ^${regx_java_version}$ ]]; then
+    # <target> <java version>, as the sibling docker scripts take it. not a test name regexp
+    test_list=""; java_version_arg="-j ${2}"
   else
     test_list="-t ${2}";
   fi
-  if [[ -n ${3} ]]; then java_version="-j ${3}"; else java_version=""; fi
-  echo "Using deprecated legacy arguments.  Please update to new parameter format: ${test_type} ${test_list} ${java_version}"
-  $0 ${test_type} ${test_list} ${java_version}
+  if [[ -n ${3} ]]; then java_version_arg="-j ${3}"; fi
+  echo "Using deprecated legacy arguments.  Please update to new parameter format: ${test_type} ${test_list} ${java_version_arg}"
+  $0 ${test_type} ${test_list} ${java_version_arg}
   exit $?
 fi
 
+# getopts accepts single characters only, so parse by hand to offer long flags too.
+# an argument this script does not know goes to the downstream script, which rejects
+# any option that it does not know either. see print_help
+_require_arg() {
+  [ -n "${2}" ] || error 1 "Option ${1} requires an argument"
+}
+
 env_vars=""
-while getopts ":a:t:c:e:hj:" opt; do
-  # shellcheck disable=SC2220
-  # Invalid flags check disabled as we'll pass them to other scripts
-  case $opt in
-    a ) test_target="$OPTARG"
+extra_args=""
+summary_arg=""
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -a|--target)
+        _require_arg "$1" "${2:-}"
+        test_target="$2"
         [[ " ${TARGET_TYPES} " =~ " ${test_target/-repeat/} " ]] || error 1 "Invalid test target type '${test_target}'. Valid types: ${TARGET_TYPES}"
+        shift 2
+        ;;
+    -t|--test)
+        _require_arg "$1" "${2:-}"
+        test_name_regexp="$2"; shift 2
         ;;
-    t ) test_name_regexp="$OPTARG"
+    -c|--chunk)
+        _require_arg "$1" "${2:-}"
+        chunk="$2"; shift 2
         ;;
-    c ) chunk="$OPTARG"
+    -j|--java)
+        _require_arg "$1" "${2:-}"
+        java_version="$2"; shift 2
         ;;
-    j ) java_version="$OPTARG"
+    -e|--env)
+        _require_arg "$1" "${2:-}"
+        env_vars="${env_vars} -e $2"; shift 2
         ;;
-    e ) env_vars="${env_vars} -e $OPTARG"
+    -s|--summary)
+        summary_arg="-s"; shift
         ;;
-    h ) print_help
-        exit 0
+    -h|--help)
+        print_help; exit 0
         ;;
-    e)  ;; # Repeat vars are just passed to downstream run-tests-enhaced.sh
-    \?) die "Invalid option: -$OPTARG"
+    *)  extra_args="${extra_args} $1"; shift
         ;;
   esac
 done
 
+# the dtest targets run .build/run-python-dtests.sh, which has no summary mode.
+# reject the flag here, before any docker work, instead of dropping it silently.
+# test_target can be unset, which would make the match read as an empty pattern
+if [ -n "${summary_arg}" ] && [ -n "${test_target:-}" ] \
+    && [[ " ${_target_dtest_types} " =~ " ${test_target/-repeat/} " ]] ; then
+  error 1 "--summary is not supported for '${test_target}', as run-python-dtests.sh has no summary mode"
+fi
+
 # pre-conditions
 command -v docker >/dev/null 2>&1 || { error 1 "docker needs to be installed"; }
 command -v bc >/dev/null 2>&1 || { error 1 "bc needs to be installed"; }
@@ -110,15 +148,20 @@ test_name_regexp=${test_name_regexp}
 java_version=${java_version}
 
 test_script="run-tests.sh"
-java_version_default=`grep 'property\s*name="java.default"' ${cassandra_dir}/build.xml |sed -ne 's/.*value="\([^"]*\)".*/\1/p'`
-java_version_supported=`grep 'property\s*name="java.supported"' ${cassandra_dir}/build.xml |sed -ne 's/.*value="\([^"]*\)".*/\1/p'`
+
+# the docker scripts legacy argument handling take the java version positionally, this one takes -j
+# catch any unintended extra arguments that came through by mistake
+for extra_arg in ${extra_args} ; do
+    if [[ "${extra_arg}" =~ ^${regx_java_version}$ ]]; then
+        error 1 "Unrecognised argument '${extra_arg}'. Use '-j ${extra_arg}' to set the java version"
+    fi
+done
 
 if [ "x${java_version}" == "x" ] ; then
     echo "Defaulting to java ${java_version_default}"
     java_version="${java_version_default}"
 fi
 
-regx_java_version="(${java_version_supported//,/|})"
 if [[ ! "${java_version}" =~ $regx_java_version ]]; then
     error 1 "Error: Java version is not in ${java_version_supported}, it is set to ${java_version}"
 fi
@@ -290,7 +333,7 @@ logfile="${build_dir}/test/logs/docker_attach_${container_name}.log"
 [ -n "${test_name_regexp}" ] && test_name_regexp_arg="-t ${test_name_regexp}" || split_chunk_arg="-c ${split_chunk}"
 
 docker_command="source \${CASSANDRA_DIR}/.build/docker/_set_java.sh ${java_version} ; \
-            \${CASSANDRA_DIR}/.build/docker/_docker_init_tests.sh -a ${target} ${split_chunk_arg} ${test_name_regexp_arg} ${env_vars} ; exit \$?"
+            \${CASSANDRA_DIR}/.build/docker/_docker_init_tests.sh -a ${target} ${split_chunk_arg} ${test_name_regexp_arg} ${summary_arg} ${env_vars} ${extra_args} ; exit \$?"
 
 # start the container, timeout after 4 hours
 docker_id=$(docker run --name ${container_name} ${docker_flags} ${docker_envs} ${docker_mounts} ${docker_volume_opt} ${image_name} sleep ${docker_timeout_hours}h)
diff --git a/.build/run-ci b/.build/run-ci
index fa07ee645eb8..9125f1818007 100755
--- a/.build/run-ci
+++ b/.build/run-ci
@@ -49,6 +49,7 @@ import time
 from contextlib import contextmanager
 from enum import Enum
 from pathlib import Path
+from urllib.error import HTTPError
 from urllib.request import urlretrieve
 from typing import Optional, Tuple
 
@@ -149,6 +150,13 @@ DEFAULT_DTEST_REPO_BRANCH = "trunk"
 DEFAULT_PROFILE = "skinny"
 DEFAULT_POD_NAME = "cassius-jenkins-0"
 DEFAULT_CONTAINER_NAME = "jenkins"
+# Jenkins API failures that are usually transient, and are retried while polling.
+# jenkins.NotFoundException extends jenkins.JenkinsException, so it needs no entry
+JENKINS_API_ERRORS = (jenkins.JenkinsException, requests.exceptions.ConnectionError)
+# number of consecutive failed polls before the script warns the user
+POLL_FAILURES_BEFORE_WARNING = 10
+# errors urlretrieve raises, including HTTPError (a subclass of OSError) on a missing artifact
+DOWNLOAD_URL_ERRORS = (requests.exceptions.RequestException, IOError)
 LOCAL_RESULTS_BASEDIR = CASSANDRA_DIR / "build/ci/"
 # AWS/GCloud specifics for node_cleaner function, needed for node_cleaner
 AWS_REGION = os.environ.get("AWS_REGION")
@@ -653,30 +661,89 @@ def trigger_jenkins_build(server: jenkins.Jenkins, job_name: str, **build_params
     return server.build_job(job_name, parameters=build_params)
 
 
+def get_build_info(server: jenkins.Jenkins, job_name: str, build_number: int) -> dict:
+    """Returns the Jenkins build info, or an empty dict if the API call failed."""
+    try:
+        return server.get_build_info(job_name, build_number)
+    except JENKINS_API_ERRORS as e:
+        debug(f"Failed get_build_info: {e}")
+        return {}
+
+
+def get_queue_item(server: jenkins.Jenkins, queue_item: int) -> dict:
+    """Returns the Jenkins queue item, or an empty dict if the API call failed."""
+    try:
+        return server.get_queue_item(queue_item)
+    except JENKINS_API_ERRORS as e:
+        debug(f"Failed get_queue_item: {e}")
+        return {}
+
+
+def warn_on_repeated_failures(state: dict, description: str):
+    """Prints a warning every POLL_FAILURES_BEFORE_WARNING consecutive Jenkins API failures."""
+    state["failures"] += 1
+    if 0 == state["failures"] % POLL_FAILURES_BEFORE_WARNING:
+        print(f"\r\033[KWarning: {state['failures']} consecutive Jenkins API failures for {description}."
+              " Still polling. Set DEBUG=1 for details.")
+
+
 def wait_for_build_number(server: jenkins.Jenkins, queue_item: int) -> int:
-    spin_while("Waiting for job build number… ", lambda: ('executable' in server.get_queue_item(queue_item)))
-    build_number = server.get_queue_item(queue_item)['executable']['number']
+    """Waits for Jenkins to start the queued item, and returns its build number."""
+    state = {"build_number": None, "failures": 0}
+
+    def is_started() -> bool:
+        item = get_queue_item(server, queue_item)
+        if not item:
+            warn_on_repeated_failures(state, f"queue item {queue_item}")
+            return False
+        state["failures"] = 0
+        # a queued item can carry "executable": null, so test the value and not the key
+        executable = item.get('executable')
+        if executable is None:
+            return False
+        state["build_number"] = executable['number']
+        return True
+
+    spin_while("Waiting for job build number… ", is_started)
+    build_number = state["build_number"]
     sys.stdout.write("\033[F\033[K")  # Move cursor up one line and clear i
     print(f"\rBuild number: {build_number}\n")
     return build_number
 
 
 def wait_for_build_complete(server: jenkins.Jenkins, job_name: str, build_number: int):
-    """Waits for Jenkins build completion by monitoring the build status."""
-
-    def get_build_info(server: jenkins.Jenkins, job_name: str, build_number: int) -> dict:
-        try:
-            return server.get_build_info(job_name, build_number)
-        except (jenkins.NotFoundException, jenkins.JenkinsException, requests.exceptions.ConnectionError) as e:
-            debug(f"Failed get_build_info: {e}")
-            return {}
+    """
+    Waits for Jenkins build completion by monitoring the build status.
 
-    elapsed_time = spin_while("Waiting for build to complete… ",
-                              lambda: get_build_info(server, job_name, build_number).get('result'))
+    A pipeline latches its result as soon as one stage reports a failed test, while the
+    other stages continue to run. Completion therefore needs `building` to be false, and
+    not only a non-null `result`.
+    """
+    start_time = time.time()
+    state = {"info": {}, "failures": 0, "latched": False}
+
+    def is_complete() -> bool:
+        info = get_build_info(server, job_name, build_number)
+        if not info:
+            warn_on_repeated_failures(state, f"{job_name} build {build_number}")
+            return False
+        state["failures"] = 0
+        state["info"] = info
+        result = info.get('result')
+        # default `building` to True: never read a missing field as finished
+        if info.get('building', True):
+            if result is not None and not state["latched"]:
+                state["latched"] = True
+                minutes, seconds = divmod(int(time.time() - start_time), 60)
+                print(f"\r\033[KBuild latched result {result} after {minutes:02}:{seconds:02}."
+                      " Stages are still running…")
+            return False
+        return result is not None
+
+    elapsed_time = spin_while("Waiting for build to complete… ", is_complete)
 
     minutes, seconds = divmod(elapsed_time, 60)
-    result = get_build_info(server, job_name, build_number)['result']
-    print(f"\r---\nBuild completed after {minutes:02}:{seconds:02} with status: {result}")
+    print(f"\r---\nBuild completed after {minutes:02}:{seconds:02} with status: {state['info'].get('result')}")
 
 
 def spin_while(message="", is_complete=lambda: False) -> int:
@@ -937,38 +1004,51 @@ def delete_remote_junit_files(k8s_client, pod_name: str, kube_ns: str, base_job_
     debug("Remote JUnit XML files cleaned.")
 
 
-def download_results_and_print_summary(k8s_client, pod_name: str, kube_ns: str, build_number: int, ip: str, args):
+def is_transient(error) -> bool:
+    """A 404 means the artifact was never archived, so retrying it only wastes time."""
+    return not (isinstance(error, HTTPError) and 404 == error.code)
 
-    def download_console_log(pod_name: str, container_name: str,  kubeconfig: Optional[str], kubecontext: Optional[str], kube_ns: str, console_log_path: str, local_console_log: Path):
-        max_retries = 5
-        for attempt in range(max_retries):
-            try:
-                run_kubectl_command(kubeconfig, kubecontext, kube_ns,
-                                    ["cp", "-c", container_name, f"{kube_ns}/{pod_name}:{console_log_path}", str(local_console_log)])
 
-                print(f"Console log saved to {local_console_log}.gz\n")
+def retry_call(action, description: str, errors, max_retries: int = 5, delay: int = 5):
+    """
+    Calls action(), and retries it up to max_retries times on `errors`.
+    Raises the last error if every attempt failed.
+    """
+    attempts = max(1, max_retries)
+    last_error = None
+    for attempt in range(attempts):
+        try:
+            return action()
+        except errors as e:
+            last_error = e
+            if not is_transient(e):
                 break
-            except subprocess.CalledProcessError as e:
-                if attempt < max_retries:
-                    debug(f" Failed to download {pod_name}:{console_log_path}: {e}. Retrying ({attempt + 1}/{max_retries})...")
-                    time.sleep(5)  # Wait before retrying
-                else:
-                    raise
+            if attempt < attempts - 1:
+                debug(f" Failed to {description}: {e}. Retrying ({attempt + 1}/{attempts})...")
+                time.sleep(delay)
+    debug(f"Failed to {description}: {last_error}")
+    raise last_error
 
-    def download_archive_tarball(kubeconfig: Optional[str], kubecontext: Optional[str], kube_ns: str, pod_name: str, container_name: str, remote_path: str, local_path, max_retries=5):
-        for attempt in range(max_retries):
-            try:
-                run_kubectl_command(kubeconfig, kubecontext, kube_ns,
-                                    ["cp", "-c", container_name, f"{kube_ns}/{pod_name}:{remote_path}", str(local_path)])
 
-                debug(f"Build Artifacts saved in {local_path}")
-                break
-            except subprocess.CalledProcessError as e:
-                if attempt < max_retries:
-                    debug(f" Failed to download {pod_name}:{remote_path}: {e}. Retrying ({attempt + 1}/{max_retries})...")
-                    time.sleep(5)  # Wait before retrying
-                else:
-                    raise
+def download_results_and_print_summary(k8s_client, pod_name: str, kube_ns: str, build_number: int, ip: str, args):
+
+    def download_console_log(pod_name: str, container_name: str,  kubeconfig: Optional[str], kubecontext: Optional[str], kube_ns: str, console_log_path: str, local_console_log: Path):
+        # this runs in a thread, so it must report its own failure. an escaping
+        # exception would print a traceback and leave the caller reading a missing file
+        try:
+            retry_call(lambda: run_kubectl_command(kubeconfig, kubecontext, kube_ns,
+                                                   ["cp", "-c", container_name, f"{kube_ns}/{pod_name}:{console_log_path}", str(local_console_log)]),
+                       f"download {pod_name}:{console_log_path}", subprocess.CalledProcessError)
+        except subprocess.CalledProcessError as e:
+            print(f"WARNING: could not download the console log {pod_name}:{console_log_path}: {e}")
+            return
+        print(f"Console log saved to {local_console_log}.gz\n")
+
+    def download_archive_tarball(kubeconfig: Optional[str], kubecontext: Optional[str], kube_ns: str, pod_name: str, container_name: str, remote_path: str, local_path, max_retries=5):
+        retry_call(lambda: run_kubectl_command(kubeconfig, kubecontext, kube_ns,
+                                               ["cp", "-c", container_name, f"{kube_ns}/{pod_name}:{remote_path}", str(local_path)]),
+                   f"download {pod_name}:{remote_path}", subprocess.CalledProcessError, max_retries)
+        debug(f"Build Artifacts saved in {local_path}")
 
     def extract_and_rename(archive_path: str, local_results_dir: str, ci_summary_file: str, ci_details_file: str):
         with tarfile.open(archive_path, "r:gz") as tar:
@@ -1026,17 +1106,8 @@ def download_results_and_print_summary(k8s_client, pod_name: str, kube_ns: str,
             os.remove(local_console_log)
 
     def download_url(url, dest, max_retries=5):
-        for attempt in range(max_retries):
-            try:
-                urlretrieve(url, dest)
-                debug(f" saved {dest}")
-                break
-            except (requests.exceptions.RequestException, IOError) as e:
-                if attempt < max_retries:
-                    debug(f" Failed to download {url}: {e}. Retrying ({attempt + 1}/{max_retries})...")
-                    time.sleep(5)  # Wait before retrying
-                else:
-                    raise
+        retry_call(lambda: urlretrieve(url, dest), f"download {url}", DOWNLOAD_URL_ERRORS, max_retries)
+        debug(f" saved {dest}")
 
     local_results_dir = LOCAL_RESULTS_BASEDIR / ip.replace(".", "-") / str(build_number)
     local_results_dir.mkdir(parents=True, exist_ok=True)
@@ -1044,13 +1115,21 @@ def download_results_and_print_summary(k8s_client, pod_name: str, kube_ns: str,
     ci_summary_file = local_results_dir / f"ci_summary_{repo_owner}_{args.branch.replace('/', '-')}_{build_number}.html"
     ci_details_file = local_results_dir / f"results_details_{repo_owner}_{args.branch.replace('/', '-')}_{build_number}.tar.xz"
     if args.url:
-        download_url(f"http://{ip}/job/{base_job_name(args)}/{build_number}/artifact/ci_summary.html", ci_summary_file)
-        download_url(f"http://{ip}/job/{base_job_name(args)}/{build_number}/artifact/results_details.tar.xz", ci_details_file)
+        artifact_url = f"http://{ip}/job/{base_job_name(args)}/{build_number}/artifact"
+        for url, dest in [(f"{artifact_url}/ci_summary.html", ci_summary_file),
+                          (f"{artifact_url}/results_details.tar.xz", ci_details_file)]:
+            try:
+                download_url(url, dest)
+            except DOWNLOAD_URL_ERRORS as e:
+                print(f" Could not download {url}: {e}")
+                print(" A build that was aborted or that failed skips the Summary stage,"
+                      " and archives no artifacts.")
         if (ci_summary_file).exists():
             print(f"CI summary saved as {ci_summary_file}")
         if (ci_details_file).exists():
             print(f"Details file saved as {ci_details_file}")
-        print(" (attach ci_summary….html and results_details….tar.xz to the JIRA ticket)")
+        if (ci_summary_file).exists() or (ci_details_file).exists():
+            print(" (attach ci_summary….html and results_details….tar.xz to the JIRA ticket)")
         print("--- Build Summary ---")
         print_results_summary_ci_summary(ci_summary_file)
     else:
@@ -1085,8 +1164,10 @@ def download_results_and_print_summary(k8s_client, pod_name: str, kube_ns: str,
 
             console_log_thread.join()
             print_results_summary(local_console_log, ci_summary_file)
-        except client.exceptions.ApiException as e:
-            print(f"Failed to tarball artifacts at {archive_path_in_pod} in {pod_name}: {e}")
+        # CalledProcessError comes from the kubectl cp, TarError and OSError from the extract
+        except (client.exceptions.ApiException, subprocess.CalledProcessError, tarfile.TarError, OSError) as e:
+            print(f"Failed to collect the artifacts at {archive_path_in_pod} in {pod_name}: {e}")
+            console_log_thread.join()
 
 
 def cleanup_and_maybe_teardown(kubeconfig: Optional[str], kubecontext: Optional[str], kube_ns: str, tear_down: bool):
diff --git a/.build/run-ci.d/run-ci-test.py b/.build/run-ci.d/run-ci-test.py
index a5e697067fc7..98fc6b754af5 100644
--- a/.build/run-ci.d/run-ci-test.py
+++ b/.build/run-ci.d/run-ci-test.py
@@ -26,13 +26,17 @@
 
 
 import argparse
+import contextlib
+import io
 from pathlib import Path
 import subprocess
 import tempfile
 import unittest
 from unittest.mock import patch, MagicMock
+from urllib.error import HTTPError
 import yaml
 
+import jenkins
 
 # Import the functions from the script
 from run_ci import (
@@ -43,11 +47,24 @@
     get_jenkins,
     trigger_jenkins_build,
     spin_while,
+    retry_call,
+    wait_for_build_number,
+    wait_for_build_complete,
     delete_remote_junit_files,
     cleanup_and_maybe_teardown,
     helm_installation_lock,
 )
 
+
+def quietly(action):
+    """
+    Calls action() with the spinner's output discarded and its sleep skipped.
+    spin_while writes ten cursor-control frames per poll, which floods the test output.
+    """
+    with patch('run_ci.time.sleep'), contextlib.redirect_stdout(io.StringIO()):
+        return action()
+
+
 class TestCIPipeline(unittest.TestCase):
 
     def setUp(self):
@@ -156,18 +173,105 @@ def test_trigger_jenkins_build(self, mock_wait_for_build_number, mock_build_job)
         mock_server = MagicMock()
         mock_build_job.return_value = mock_server.build_job.return_value = 123
         mock_wait_for_build_number.return_value = 456
+        # a MagicMock job_info shows no parameterDefinitions, so this takes the
+        # non-parameter build path, which sleeps for six seconds
         with patch('run_ci.spin_while', side_effect=lambda msg, condition: 0):
-            queue_item = trigger_jenkins_build(mock_server, "test-job", param1="value1")
+            queue_item = quietly(lambda: trigger_jenkins_build(mock_server, "test-job", param1="value1"))
         self.assertEqual(queue_item, 123)
 
     def test_spin_while(self):
-        result = spin_while("Testing", lambda: True)
+        result = quietly(lambda: spin_while("Testing", lambda: True))
         self.assertEqual(result, 0)
 
+    def test_wait_for_build_complete_ignores_mid_build_result(self):
+        """A pipeline latches UNSTABLE while later stages still run. That is not completion."""
+        mock_server = MagicMock()
+        mock_server.get_build_info.side_effect = [
+            {'building': True, 'result': None},
+            {'building': True, 'result': 'UNSTABLE'},
+            {'building': True, 'result': 'UNSTABLE'},
+            {'building': False, 'result': 'UNSTABLE'},
+        ]
+        quietly(lambda: wait_for_build_complete(mock_server, "test-job", 456))
+        self.assertEqual(mock_server.get_build_info.call_count, 4)
+
+    def test_wait_for_build_complete_missing_building_field(self):
+        """An absent `building` field must never read as finished."""
+        mock_server = MagicMock()
+        mock_server.get_build_info.side_effect = [
+            {'result': 'SUCCESS'},
+            {'building': False, 'result': 'SUCCESS'},
+        ]
+        quietly(lambda: wait_for_build_complete(mock_server, "test-job", 456))
+        self.assertEqual(mock_server.get_build_info.call_count, 2)
+
+    def test_wait_for_build_complete_survives_api_error(self):
+        mock_server = MagicMock()
+        mock_server.get_build_info.side_effect = [
+            jenkins.JenkinsException("connection reset"),
+            jenkins.JenkinsException("connection reset"),
+            {'building': False, 'result': 'SUCCESS'},
+        ]
+        quietly(lambda: wait_for_build_complete(mock_server, "test-job", 456))
+        self.assertEqual(mock_server.get_build_info.call_count, 3)
+
+    def test_wait_for_build_number_pending_executable(self):
+        """A queued item can carry "executable": null before Jenkins starts it."""
+        mock_server = MagicMock()
+        mock_server.get_queue_item.side_effect = [
+            {'executable': None},
+            {'executable': {'number': 456}},
+        ]
+        self.assertEqual(quietly(lambda: wait_for_build_number(mock_server, 123)), 456)
+
+    def test_retry_call_returns_result(self):
+        self.assertEqual(retry_call(lambda: "downloaded", "download it", IOError, 3, 0), "downloaded")
+
+    def test_retry_call_raises_after_retries(self):
+        attempts = []
+
+        def always_fails():
+            attempts.append(1)
+            raise IOError("connection reset by peer")
+
+        with self.assertRaises(IOError):
+            retry_call(always_fails, "download it", IOError, 3, 0)
+        self.assertEqual(len(attempts), 3)
+
+    def test_retry_call_does_not_retry_a_404(self):
+        """An artifact a build never archived stays absent, so one attempt is enough."""
+        attempts = []
+
+        def not_found():
+            attempts.append(1)
+            raise HTTPError("http://ci/artifact", 404, "Not Found", {}, None)
+
+        with self.assertRaises(HTTPError):
+            retry_call(not_found, "download it", IOError, 5, 0)
+        self.assertEqual(len(attempts), 1)
+
+    def test_retry_call_retries_a_503(self):
+        """A gateway error is transient, unlike a 404."""
+        attempts = []
+
+        def unavailable():
+            attempts.append(1)
+            raise HTTPError("http://ci/artifact", 503, "Service Unavailable", {}, None)
+
+        with self.assertRaises(HTTPError):
+            retry_call(unavailable, "download it", IOError, 3, 0)
+        self.assertEqual(len(attempts), 3)
+
+    def test_retry_call_always_attempts_once(self):
+        """max_retries=0 must not raise None."""
+        with self.assertRaises(IOError):
+            retry_call(lambda: (_ for _ in ()).throw(IOError("nope")), "download it", IOError, 0, 0)
+
     @patch('run_ci.stream.stream')
     def test_delete_remote_junit_files(self, mock_stream):
         mock_k8s_client = MagicMock()
         delete_remote_junit_files(mock_k8s_client, "test-pod", "test-namespace", "test-job", 456)
+        delete_remote_junit_files(mock_k8s_client, "test-pod", "test-namespace", "cassandra-6.0", 456)
         mock_stream.assert_called()
 
     @patch('run_ci.subprocess.run')
diff --git a/.build/run-tests.sh b/.build/run-tests.sh
index 7d6223137701..5de694c7f755 100755
--- a/.build/run-tests.sh
+++ b/.build/run-tests.sh
@@ -31,7 +31,13 @@ set -o pipefail
 # target types
 TARGET_TYPES="build_dtest_jars stress-test fqltool-test sstableloader-test microbench microbench-test test-burn long-test cqlsh-test simulator-dtest test test-cdc test-compression test-oa test-system-keyspace-directory test-latest jvm-dtest jvm-dtest-upgrade jvm-dtest-novnode jvm-dtest-upgrade-novnode"
 
-# pre-conditions
+error() {
+  echo >&2 $2;
+  set -x
+  exit $1
+}
+
+# pre-conditions (error() must be defined above)
 command -v ant >/dev/null 2>&1 || { error 1 "ant needs to be installed"; }
 command -v git >/dev/null 2>&1 || { error 1 "git needs to be installed"; }
 command -v uuidgen >/dev/null 2>&1 || test -f /proc/sys/kernel/random/uuid || { error 1 "uuidgen needs to be installed"; }
@@ -39,39 +45,36 @@ command -v uuidgen >/dev/null 2>&1 || test -f /proc/sys/kernel/random/uuid || {
 [ -f "${CASSANDRA_DIR}/build.xml" ] || { error 1 "${CASSANDRA_DIR}/build.xml must exist"; }
 [ -d "${DIST_DIR}" ] || { mkdir -p "${DIST_DIR}" ; }
 
-
-error() {
-  echo >&2 $2;
-  set -x
-  exit $1
-}
-
 print_help() {
   echo "Usage: $0 [-a|-t|-c|-e|-i|-b|-s|-h]"
-  echo "   -a Test target type: ${TARGET_TYPES}"
-  echo "   -t Test name regexp to run."
-  echo "   -c Chunk to run in the form X/Y: Run chunk X from a total of Y chunks."
-  echo "   -b Specify the base git branch for comparison when determining changed tests to"
-  echo "      repeat. Defaults to ${BASE_BRANCH}. Note that this option is not used when"
-  echo "      the '-a' option is specified."
-  echo "   -s Skip automatic detection of changed tests. Useful when you need to repeat a few ones,"
-  echo "      or when there are too many changed tests the CI env to handle."
-  echo "   -e <key=value> Environment variables to be used in the repeated runs:"
+  echo "   -a, --target <type>  Test target type: ${TARGET_TYPES}"
+  echo "   -t, --test <regexp>  Test name regexp to run."
+  echo "   -c, --chunk <X/Y>    Chunk to run in the form X/Y: Run chunk X from a total of Y chunks."
+  echo "   -b, --base <branch>  Specify the base git branch for comparison when determining changed tests to"
+  echo "                        repeat. Defaults to ${BASE_BRANCH}. Note that this option is not used when"
+  echo "                        the '-a' option is specified."
+  echo "   -e, --env <key=value> Environment variables to be used in the repeated runs:"
   echo "                   -e REPEATED_TESTS_STOP_ON_FAILURE=false"
   echo "                   -e REPEATED_TESTS_COUNT=500"
   echo "                  If you want to specify multiple environment variables simply add multiple -e options."
-  echo "   -i Ignore unknown environment variables"
-  echo "   -h Print help"
+  echo "   -i, --ignore-unknown-env  Ignore unknown environment variables"
+  echo "   -s, --summary        Print a summary of failed tests instead of the full ant output."
+  echo "                        The full output is kept in \${DIST_DIR}/run-tests.log"
+  echo "   -h, --help           Print help"
 }
 
 
-# legacy argument handling
+# legacy argument handling, for the form <target> [<test regexp|chunk>]
 if [[ " ${TARGET_TYPES} " =~ " ${1} " ]]; then
   test_type="-a ${1}"
+  _java_supported=`grep 'property\s*name="java.supported"' ${CASSANDRA_DIR}/build.xml |sed -ne 's/.*value="\([^"]*\)".*/\1/p'`
   if [[ -z ${2} ]]; then
     test_list=""
   elif [[ -n ${2} && "${2}" =~ ^[0-9]+/[0-9]+$ ]]; then
     test_list="-c ${2}";
+  elif [[ "${2}" =~ ^(${_java_supported//,/|})$ ]]; then
+    # this script runs on the java already on the path, so it has no version to switch to
+    error 1 "This script cannot set the java version, it uses the java on the path. Use '.build/docker/run-tests.sh -a ${1} -j ${2}' instead"
   else
     test_list="-t ${2}";
   fi
@@ -84,41 +87,62 @@ fi
 env_vars=""
 has_env_vars=false
 check_env_vars=true
-detect_changed_tests=true
-while getopts "a:t:c:e:ib:shj:" opt; do
-  case $opt in
-    a ) test_target="$OPTARG"
+summary=false
+
+# getopts accepts single characters only, so parse by hand to offer long flags too
+_require_arg() {
+  [ -n "${2}" ] || error 1 "Option ${1} requires an argument"
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -a|--target)
+        _require_arg "$1" "${2:-}"
+        test_target="$2"
         [[ " ${TARGET_TYPES} " =~ " ${test_target/-repeat/} " ]] || error 1 "Invalid test target type '${test_target}'. Valid types: ${TARGET_TYPES}"
+        shift 2
         ;;
-    t ) test_name_regexp="$OPTARG"
+    -t|--test)
+        _require_arg "$1" "${2:-}"
+        test_name_regexp="$2"; shift 2
         ;;
-    c ) chunk="$OPTARG"
+    -c|--chunk)
+        _require_arg "$1" "${2:-}"
+        chunk="$2"; shift 2
         ;;
-    e ) if (! ($has_env_vars)); then
-          env_vars="$OPTARG"
+    -e|--env)
+        _require_arg "$1" "${2:-}"
+        if (! ($has_env_vars)); then
+          env_vars="$2"
         else
-          env_vars="$env_vars|$OPTARG"
+          env_vars="$env_vars|$2"
         fi
         has_env_vars=true
+        shift 2
         ;;
-    b ) BASE_BRANCH="$OPTARG"
+    -b|--base)
+        _require_arg "$1" "${2:-}"
+        BASE_BRANCH="$2"; shift 2
         ;;
-    i ) check_env_vars=false
+    -i|--ignore-unknown-env)
+        check_env_vars=false; shift
         ;;
-    s ) detect_changed_tests=false
+    -s|--summary)
+        summary=true; shift
         ;;
-    h ) print_help
+    -h|--help)
+        print_help
         exit 0
         ;;
-    j ) ;; # To avoid failing on java_version param from docker/run_tests.sh
-    \?) error 1 "Invalid option: -$OPTARG"
+    -j|--java)
+        # accepted and ignored, to avoid failing on the java_version param from docker/run-tests.sh
+        _require_arg "$1" "${2:-}"
+        shift 2
+        ;;
+    *)  error 1 "Invalid option: $1"
         ;;
   esac
 done
-shift $((OPTIND-1))
-if [ "$#" -ne 0 ]; then
-  error 1 "Unexpected arguments"
-fi
 
 # validate environment variables
 if $has_env_vars && $check_env_vars; then
@@ -202,7 +226,7 @@ _build_all_dtest_jars() {
 
     pushd ${TMP_DIR}/cassandra-dtest-jars >/dev/null
     for branch in cassandra-4.1 cassandra-5.0 cassandra-6.0 trunk ; do
-        git clean -qxdff && git reset --hard HEAD  || echo "failed to reset/clean ${TMP_DIR}/cassandra-dtest-jars… continuing…"
+        git clean -qxdff && git reset --hard HEAD  || echo "WARNING: could not reset/clean ${TMP_DIR}/cassandra-dtest-jars… continuing…"
         git checkout --quiet $branch
         dtest_jar_version=$(grep 'property\s*name=\"base.version\"' build.xml |sed -ne 's/.*value=\"\([^"]*\)\".*/\1/p')
         if [ -f "${DIST_DIR}/dtest-${dtest_jar_version}.jar" ] ; then
@@ -331,7 +355,16 @@ _run_microbench() {
     local -r arch="$(uname -m)"
     local -r output_dir="${DIST_DIR}/test/output/${_target}/jdk${java_version}/${arch}/${_split_chunk//\//_}"
 
+    # microbench produces JMH json, not JUnit xml
+    set +o errexit
     ant $_target ${ANT_TEST_OPTS} -Dbuild.test.output.dir=${output_dir} -Dbenchmark.name="${benchmark_pattern}" -Dmaven.test.failure.ignore=true
+    local -r _ant_status=$?
+    set -o errexit
+    if [[ ${_ant_status} -ne 0 ]]; then
+      echo "failed ${_target} ${_split_chunk}"
+    else
+      echo "${_target} completed successfully"
+    fi
 
     # Post-process jmh-result.json to add jdk and arch parameters
     local jmh_result="${output_dir}/jmh-result.json"
@@ -349,6 +382,9 @@ with open('${jmh_result}','w') as f:
     json.dump(data,f)
 "
     fi
+
+    # fail the run, as microbench has no JUnit xml for generate-test-report to judge
+    return ${_ant_status}
 }
 
 _main() {
@@ -357,7 +393,7 @@ _main() {
   local -r split_chunk="${chunk:-1/1}" # Chunks formatted as "K/N" for the Kth chunk of N chunks
 
   # check split_chunk is compatible with target (if not a regexp)
-  if [[ "${_split_chunk}" =~ ^\d+/\d+$ ]] && [[ "1/1" != "${split_chunk}" ]] ; then
+  if [[ "${split_chunk}" =~ ^[0-9]+/[0-9]+$ ]] && [[ "1/1" != "${split_chunk}" ]] ; then
     case ${target} in
       "stress-test" | "fqltool-test" | "cqlsh-test" | "sstableloader-test")
           echo "Target ${target} does not support splits."
@@ -401,8 +437,11 @@ _main() {
   [ -d ${TMP_DIR} ] || mkdir -p "${TMP_DIR}"
   export ANT_TEST_OPTS="-Dno-build-test=true -Dtmp.dir=${TMP_DIR} -Dbuild.test.output.dir=${DIST_DIR}/test/output/${target}"
 
-  # fresh virtualenv and test logs results everytime
-  [[ "/" == "${DIST_DIR}" ]] || rm -rf "${DIST_DIR}/test/{html,output,logs,reports}"
+  # fresh virtualenv and test logs results everytime.
+  # loop instead of a brace expansion, which needs ${DIST_DIR} unquoted and so word split
+  if [[ "/" != "${DIST_DIR}" ]] ; then
+    for d in html output logs reports ; do rm -rf "${DIST_DIR}/test/${d}" ; done
+  fi
 
   # cheap trick to ensure dependency libraries are in place. allows us to stash only project specific build artifacts.
   #  also recreate some of the non-build files we need
@@ -493,9 +532,45 @@ _main() {
   esac
 
   # merge all unit xml files into one, and print summary test numbers
-  ant -quiet -silent generate-test-report
+  case ${target} in
+    # Skip targets that produce no JUnit xml
+    "microbench" | "microbench-test" | "build_dtest_jars")
+      ;;
+    *)
+      ant -quiet -silent generate-test-report \
+        -Dbuild.test.output.dir="${DIST_DIR}/test/output" \
+        -Dbuild.test.report.dir="${DIST_DIR}/test/reports"
+      ;;
+  esac
 
   popd  >/dev/null
 }
 
-_main "$@"
+if ${summary}; then
+  # Summarize the run: run-tests.sh keeps going past failing tests.
+  # Keep the full output, as the summary prints matched lines only.
+  # ${DIST_DIR}/test/ is not used, as _main removes it while the log is open.
+  log="${DIST_DIR}/run-tests.log"
+  echo "full output: ${log}"
+  # errexit is dynamically scoped, so the subshell is what keeps it inside _main
+  set +o errexit
+  ( set -o errexit -o pipefail ; _main "$@" ) > "${log}" 2>&1
+  main_status=$?
+  "${CASSANDRA_DIR}/.build/sh/test-log-summary.py" "${log}"
+  summary_status=$?
+  # jenkins archives test/logs/**, see .jenkins/Jenkinsfile
+  [[ -d "${DIST_DIR}/test/logs" ]] && cp "${log}" "${DIST_DIR}/test/logs/run-tests.log"
+  # a setup failure inside _main (error() exits non-zero) takes precedence
+  if [[ ${main_status} -ne 0 ]]; then
+    # the summary matches test results only, so a setup failure leaves it silent.
+    # print the tail of the log, or the cause stays hidden in a file
+    if [[ ${summary_status} -eq 0 ]]; then
+      echo "run-tests.sh exited ${main_status}. The last 25 lines of ${log}:"
+      tail -n 25 "${log}"
+    fi
+    exit ${main_status}
+  fi
+  exit ${summary_status}
+else
+  _main "$@"
+fi
diff --git a/.build/sh/_run-ant.sh b/.build/sh/_run-ant.sh
new file mode 100644
index 000000000000..3e4204ce7b07
--- /dev/null
+++ b/.build/sh/_run-ant.sh
@@ -0,0 +1,47 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Defines run_ant(), shared by .build/build-jars.sh and .build/check-code.sh.
+# Source it, do not execute it.  The caller must set ${CASSANDRA_DIR} and ${summary}.
+# ${DIST_DIR} is optional, and holds the log of a failed run.
+#
+
+# run ant, summarizing failures when ${summary} is true. ant's exit code is
+# authoritative: a pipeline would report the summary's status, and ant can die without
+# printing "BUILD FAILED" (an out-of-memory kill, for example), which the summary
+# reads as a pass. POSIX sh has neither pipefail nor PIPESTATUS, hence the log file.
+run_ant() {
+  if ! ${summary}; then
+    ant -f "${CASSANDRA_DIR}/build.xml" "$@"
+    return $?
+  fi
+  # keep the log in the build directory. .build/docker/_docker_run.sh bind mounts
+  # ${DIST_DIR}, so a --rm container destroys any path under /tmp before it is read
+  _out_dir="${DIST_DIR:-${CASSANDRA_DIR}/build}"
+  mkdir -p "${_out_dir}"
+  _log="${_out_dir}/ant.log"
+  ant -f "${CASSANDRA_DIR}/build.xml" "$@" > "${_log}" 2>&1 && _rc=0 || _rc=$?
+  echo "=== ant $* ==="
+  "${CASSANDRA_DIR}/.build/sh/ant-log-summary.py" "${_log}" || true
+  if [ ${_rc} -eq 0 ] ; then
+    rm -f "${_log}"
+  else
+    # state the verdict, as the summary can find nothing to report and still say SUCCESSFUL
+    echo "ant exited ${_rc}. full output: ${_log}"
+  fi
+  return ${_rc}
+}
diff --git a/.build/sh/ai-build b/.build/sh/ai-build
deleted file mode 100755
index fa69b1b277d9..000000000000
--- a/.build/sh/ai-build
+++ /dev/null
@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#set -o xtrace
-set -o errexit
-set -o pipefail
-set -o nounset
-
-bin="$(cd "$(dirname "$0")" > /dev/null; pwd)"
-home="$(cd "$bin/../.." > /dev/null; pwd)" # this script lives in .build/sh
-
-usage() {
-  if [[ $# -gt 0 ]]; then
-    echo "$*" 1>&2
-  fi
-  cat <<EOF
-Usage: $(basename "$0") (options)*
-Options:
---no-checkstyle     - runs with all checkstyle disabled
--h|--help           - this help page
-EOF
-  exit 1
-}
-
-no_checkstyle=false
-
-while [[ "$#" -gt 0 ]]; do
-  case "$1" in
-    --no-checkstyle)
-      no_checkstyle=true
-      shift
-      ;;
-    -h|--help)
-      usage
-      shift
-      ;;
-    *)
-      usage "Unknown argument $1"
-      ;;
-  esac
-done
-
-# Switch to the project root so all commands work properly
-cd "$home"
-
-opts=(
-  -Dant.gen-doc.skip=true
-  -Drat.skip=true
-)
-
-if [ $no_checkstyle ]; then
-  ant -Dno-checkstyle=true "${opts[@]}" clean jar "$@" 2>&1 | "$bin"/ant-log-summary.py -
-else
-  ant "${opts[@]}" clean jar checkstyle checkstyle-test "$@" 2>&1 | "$bin"/ant-log-summary.py -
-fi
-
diff --git a/.build/sh/ai-ci-test b/.build/sh/ai-ci-test
deleted file mode 100755
index 9e791cd0f1e6..000000000000
--- a/.build/sh/ai-ci-test
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#set -o xtrace
-set -o errexit
-set -o pipefail
-set -o nounset
-
-bin="$(cd "$(dirname "$0")" > /dev/null; pwd)"
-home="$(cd "$bin/../.." > /dev/null; pwd)" # this script lives in .build/sh
-
-# Switch to the project root so all commands work properly
-cd "$home"
-
-"$bin"/ci-test "$@" 2>&1 | "$bin"/ant-log-summary.py -
diff --git a/.build/sh/ant-log-summary.py b/.build/sh/ant-log-summary.py
index 65cbdaf3a832..6f8ce536326a 100755
--- a/.build/sh/ant-log-summary.py
+++ b/.build/sh/ant-log-summary.py
@@ -105,12 +105,13 @@ def main():
         else:
             with open(args.log_file, "r") as f:
                 content = f.read()
+    # exit 2, not 1: 1 means the log says BUILD FAILED, which a log we cannot read does not
     except FileNotFoundError:
         print(f"Error: Log file '{args.log_file}' not found")
-        sys.exit(1)
+        sys.exit(2)
     except Exception as e:
         print(f"Error reading log file: {e}")
-        sys.exit(1)
+        sys.exit(2)
 
     is_failed, failed_target, failure_output = find_build_failures(content)
 
diff --git a/.build/sh/ci-test b/.build/sh/ci-test
deleted file mode 100755
index 091dbb1d5666..000000000000
--- a/.build/sh/ci-test
+++ /dev/null
@@ -1,149 +0,0 @@
-#!/usr/bin/env bash
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#set -o xtrace
-set -o errexit
-set -o pipefail
-set -o nounset
-
-bin="$(cd "$(dirname "$0")" > /dev/null; pwd)"
-home="$(cd "$bin/../.." > /dev/null; pwd)" # this script lives in .build/sh
-
-# Switch to the project root so all commands work properly
-cd "$home"
-
-error() {
-  echo "ERROR: $*" 1>&2
-  exit 1
-}
-
-usage() {
-  if [[ $# -gt 0 ]]; then
-    echo "$*" 1>&2
-  fi
-  cat <<EOF
-Usage: $(basename "$0") [class name] (options)*
-Options:
---cdc                               - runs with cdc enabled
---compression                       - run with compression enabled
---jvm-dtest-version|--dtest-version - which jvm-dtest version to use
---reuse                             - skip calling ant realclean
---tokens|--num-tokens               - number of vnode tokens to use for jvm-dtest
--h|--help                           - this help page
-EOF
-  exit 1
-}
-
-if [[ $# -eq 0 ]]; then
-  usage "Missing required arguments"
-fi
-
-class_name=""
-task="testclasslist"
-fresh_build=true
-jvm_dtest_version=""
-num_tokens=""
-while [[ "$#" -gt 0 ]]; do
-  case "$1" in
-    --tokens|--num-tokens)
-      num_tokens="$2"
-      shift 2
-      ;;
-    --cdc)
-      task="testclasslist-cdc"
-      shift
-      ;;
-    --compression)
-      task="testclasslist-compression"
-      shift
-      ;;
-    --reuse)
-      fresh_build=false
-      shift
-      ;;
-    --jvm-dtest-version|--dtest-version)
-      jvm_dtest_version="$2"
-      shift 2
-      ;;
-    -h|--help)
-      usage
-      shift
-      ;;
-    *)
-      if [[ -z "${class_name:-}" ]]; then
-        class_name="$1"
-        shift
-      else
-        usage "Unknown argument $1"
-      fi
-      ;;
-  esac
-done
-if [[ -z "${class_name:-}" ]]; then
-  usage "No class provided"
-fi
-# Is the class name valid?
-if [[ "$class_name" =~ [:#$] ]]; then
-  error "Unexpected class name: $class_name.  Illegal characters were detected: ':', '#', and '\$' are not allowed!  ci-test only supports class names, and not references to methods."
-fi
-path="$(echo "$class_name" | tr '.' '/' ).java"
-prefix="$( find test | grep "$path" | awk -F/ '{print $2}' )"
-
-JAVA_VERSION=$(java -version 2>&1 | awk -F '"' '/version/ {print $2}' | awk -F. '{print $1}')
-
-if [ "$JAVA_VERSION" -ge 11 ]; then
-  export CASSANDRA_USE_JDK11=true
-fi
-
-if [ -n "${num_tokens:-}" ]; then
-  export CASSANDRA_DTEST_NUM_TOKENS="$num_tokens"
-fi
-
-opts=(
-  -Dant.gen-doc.skip=true
-  -Dno-checkstyle=true
-  -Dant.gen-doc.skip=true
-  -Drat.skip=true
-)
-if [[ -n "${jvm_dtest_version:-}" ]]; then
-  opts+=( "-Ddtest-api.version=$jvm_dtest_version" )
-fi
-
-if [[ "$fresh_build" == true ]]; then
-  if [[ ! "$path" =~ distributed/upgrade ]]; then
-    ant "${opts[@]}" realclean
-    ant "${opts[@]}"
-    ant "${opts[@]}" generate-idea-files
-  fi
-fi
-
-# cleanup logs so w/e is around are for this run
-rm -rf build/test/logs || true
-
-test_timeout=$(grep "name=\"test.$prefix.timeout\"" build.xml | awk -F'"' '{print $4}' || true)
-if [ -z "$test_timeout" ]; then
-  test_timeout=$(grep 'name="test.timeout"' build.xml | awk -F'"' '{print $4}')
-fi
-if [[ "$fresh_build" == false ]]; then
-  opts+=(-Dno-build-test=true)
-fi
-
-if [[ "$prefix" == "simulator" ]]; then
-  ant "${opts[@]}" test-simulator-dtest -Dtest.name="$(echo "$path" | awk -F'.' '{print $1}' | awk -F'/' '{print $NF}')"
-else
-  ant "${opts[@]}" "$task" -Dtest.timeout="$test_timeout" -Dtest.classlistfile=<(echo "$path") -Dtest.classlistprefix="$prefix"
-fi
diff --git a/.build/sh/ci-test-loop b/.build/sh/ci-test-loop
deleted file mode 100755
index 8d44fe1427c9..000000000000
--- a/.build/sh/ci-test-loop
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#set -o xtrace
-set -o errexit
-set -o pipefail
-set -o nounset
-
-bin="$(cd "$(dirname "$0")" > /dev/null; pwd)"
-home="$(cd "$bin/../.." > /dev/null; pwd)" # this script lives in .build/sh
-
-# Switch to the project root so all commands work properly
-cd "$home"
-
-usage() {
-  if [[ $# -gt 0 ]]; then
-    echo "$*" 1>&2
-  fi
-  cat <<EOF
-Usage: $(basename "$0") [class name] (option)*
-
-Options:
-EOF
-  exit 1
-}
-
-_main() {
-  local class_name=""
-  fresh_build=true
-  while [[ "$#" -gt 0 ]]; do
-    case "$1" in
-      --reuse)
-        fresh_build=false
-        shift
-        ;;
-      -h|--help)
-        usage
-        shift
-        ;;
-      *)
-        if [[ -z "${class_name:-}" ]]; then
-          class_name="$1"
-          shift
-        else
-          usage "Unknown argument $1"
-        fi
-        ;;
-    esac
-  done
-
-  if [[ -z "${class_name:-}" ]]; then
-    usage "No class provided"
-  fi
-
-  path="$(echo "$class_name" | tr '.' '/' ).java"
-
-  if $fresh_build; then
-    if [[ ! "$path" =~ distributed/upgrade ]]; then
-      ant realclean && ant && ant generate-idea-files
-    fi
-  fi
-
-  counter=1
-  echo ">>> Running attempt $counter"
-  while "$bin"/ci-test "$class_name" --reuse; do
-    counter=$(( counter + 1 ))
-    echo ">>> Running attempt $counter"
-  done;
-  echo "Exited after $counter attempts"
-}
-
-_main "$@"
diff --git a/.build/sh/test-log-summary.py b/.build/sh/test-log-summary.py
new file mode 100755
index 000000000000..9ad33597c764
--- /dev/null
+++ b/.build/sh/test-log-summary.py
@@ -0,0 +1,198 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Summarize the output of .build/run-tests.sh.
+#
+# Unlike ant-log-summary.py (which keys off ant's BUILD FAILED/SUCCESSFUL),
+# run-tests.sh deliberately continues past failing tests, as ant still prints
+# BUILD SUCCESSFUL with test failures.
+#
+# Failures are identified from the test results instead:
+#   - the "[Test Summary] Run: N, Failed: N, Errors: N, Skipped: N" line
+#     emitted by ant's generate-test-report target,
+#   - run-tests.sh's own "failed <prefix> <target> ..." lines,
+#   - "failure rate: X/Y" lines printed for repeated runs,
+#   - per-test "Testcase: <name>:\tFAILED / Caused an ERROR" markers from the
+#     brief JUnit formatter,
+#   - a compile/setup "BUILD FAILED" (with the [javac] errors).
+#
+# The exit code mirrors the outcome: 0 for a clean run, 1 if any failure signal is
+# seen, and 2 if the log cannot be read.  ant-log-summary.py uses the same codes.
+
+import argparse
+import re
+import sys
+
+TEST_SUMMARY_RE = re.compile(
+    r"\[Test Summary\]\s*Run:\s*(\d+),\s*Failed:\s*(\d+),\s*Errors:\s*(\d+),\s*Skipped:\s*(\d+)"
+)
+FAILURE_RATE_RE = re.compile(r"failure rate:\s*(\d+)/(\d+)")
+# run-tests.sh: echo "failed ${_target_prefix} ${_testlist_target} ..."
+# the negative lookahead skips prose such as "failed to reset/clean …"
+RUN_TESTS_FAILED_RE = re.compile(r"^failed\s+(?!to\s)\S+")
+# brief JUnit formatter: "Testcase: <name>:\tFAILED" / ":\tCaused an ERROR",
+# optionally prefixed by an ant task tag such as "[junit] ".
+TESTCASE_FAIL_RE = re.compile(r"^(?:\[[^\]]+\]\s*)?Testcase:\s.*\b(FAILED|Caused an ERROR)\b")
+# run-tests.sh microbench success marker: microbench emits no JUnit xml
+MICROBENCH_OK_RE = re.compile(r"^\S+\s+completed successfully")
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(
+        description="Summarize Apache Cassandra .build/run-tests.sh output"
+    )
+    parser.add_argument(
+        "log_file",
+        nargs="?",
+        default="-",
+        help='Path to the run-tests.sh log (use "-" or omit to read from stdin)',
+    )
+    return parser.parse_args()
+
+
+ANT_TAG_RE = re.compile(r"^\[[^\]]+\]\s*")
+
+
+def _strip_tag(line):
+    """Drop a leading ant task tag such as '[junit] ' or '[echo] '."""
+    return ANT_TAG_RE.sub("", line.strip())
+
+
+def summarize(content):
+    """Return (failed, lines) where failed is a bool and lines is the summary."""
+    lines = content.split("\n")
+
+    summaries = []          # [Test Summary] lines
+    failed_targets = []     # run-tests.sh "failed ..." lines
+    failure_rates = []      # "failure rate: X/Y" lines
+    failed_testcases = []   # per-test FAILED / ERROR markers
+    javac_errors = []       # compile errors, when a BUILD FAILED is present
+    microbench_ok = []      # microbench success markers
+
+    build_failed = "BUILD FAILED" in content
+
+    for line in lines:
+        stripped = line.strip()
+        m = TEST_SUMMARY_RE.search(line)
+        if m:
+            run, failures, errors, skipped = (int(g) for g in m.groups())
+            summaries.append((_strip_tag(line), failures, errors))
+            continue
+        if RUN_TESTS_FAILED_RE.match(stripped):
+            failed_targets.append(stripped)
+            continue
+        m = FAILURE_RATE_RE.search(line)
+        if m:
+            failure_rates.append((stripped, int(m.group(1))))
+            continue
+        if TESTCASE_FAIL_RE.match(stripped):
+            failed_testcases.append(_strip_tag(line))
+            continue
+        if MICROBENCH_OK_RE.match(stripped):
+            microbench_ok.append(stripped)
+            continue
+        if build_failed and "[javac]" in line and ("error:" in line or "errors" in line):
+            clean = line.replace("[javac]", "").strip()
+            if clean:
+                javac_errors.append(clean)
+
+    # decide pass/fail
+    failed = build_failed
+    for _, failures, errors in summaries:
+        if failures or errors:
+            failed = True
+    if failed_targets:
+        failed = True
+    if failed_testcases:
+        # targets that emit no JUnit xml have no [Test Summary] line to read
+        failed = True
+    for _, n in failure_rates:
+        if n:
+            failed = True
+
+    # build the summary output
+    out = []
+    if build_failed:
+        out.append("BUILD FAILED")
+        if javac_errors:
+            out.append("")
+            out.append("Compilation Errors:")
+            out.append("-" * 20)
+            out.extend(javac_errors)
+
+    if failed_testcases:
+        out.append("")
+        out.append("Failed tests:")
+        out.append("-" * 13)
+        # de-duplicate while preserving order
+        seen = set()
+        for tc in failed_testcases:
+            if tc not in seen:
+                seen.add(tc)
+                out.append(tc)
+
+    if failed_targets:
+        out.append("")
+        out.extend(failed_targets)
+
+    for line, _ in failure_rates:
+        out.append(line)
+
+    if summaries:
+        out.append("")
+        for line, _, _ in summaries:
+            out.append(line)
+    elif microbench_ok:
+        # microbench emits no JUnit xml; its own success marker is the report
+        out.append("")
+        out.extend(microbench_ok)
+    elif not build_failed and not failed:
+        # nothing ran a test report and nothing failed
+        out.append("No test summary found (nothing ran, or non-test target).")
+
+    if not failed and (summaries or microbench_ok):
+        out.append("")
+        out.append("TESTS PASSED")
+
+    return failed, out
+
+
+def main():
+    args = parse_args()
+
+    try:
+        if args.log_file == "-":
+            content = sys.stdin.read()
+        else:
+            with open(args.log_file, "r") as f:
+                content = f.read()
+    except FileNotFoundError:
+        print(f"Error: Log file '{args.log_file}' not found")
+        sys.exit(2)
+    except Exception as e:
+        print(f"Error reading log file: {e}")
+        sys.exit(2)
+
+    failed, out = summarize(content)
+    print("\n".join(out))
+    sys.exit(1 if failed else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.build/sh/test/_test-harness.sh b/.build/sh/test/_test-harness.sh
new file mode 100644
index 000000000000..ab9aec924292
--- /dev/null
+++ b/.build/sh/test/_test-harness.sh
@@ -0,0 +1,74 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Assertions shared by the .build/sh/test/stub-*-cases.sh harnesses.
+# Source it, do not execute it.  The caller must set ${STUB_INVOCATIONS}, the file
+# its stub appends one line to per call, and must end with `report <harness name>`.
+#
+
+failures=0
+LAST_OUT=""
+LAST_RC=0
+
+# run a command, keeping its combined output and its exit code for the expect_* helpers
+run_case() {
+  LAST_OUT="$("$@" 2>&1)"
+  LAST_RC=$?
+}
+
+pass() { printf 'ok    %s\n' "$1"; }
+
+fail() {
+  printf 'FAIL  %s\n' "$1"
+  printf '%s\n' "${LAST_OUT}" | sed 's/^/      | /'
+  failures=$((failures + 1))
+}
+
+expect_rc() {
+  if [ "${LAST_RC}" -eq "$2" ]; then pass "$1"; else fail "$1: expected rc $2, got ${LAST_RC}"; fi
+}
+
+expect_out() {
+  case "${LAST_OUT}" in
+    *"$2"*) pass "$1" ;;
+    *)      fail "$1: output lacks '$2'" ;;
+  esac
+}
+
+expect_no_out() {
+  case "${LAST_OUT}" in
+    *"$2"*) fail "$1: output must not contain '$2'" ;;
+    *)      pass "$1" ;;
+  esac
+}
+
+expect_invocation() {
+  if grep -q -- "$2" "${STUB_INVOCATIONS}"; then pass "$1"; else fail "$1: no call matched '$2'"; fi
+}
+
+expect_no_invocation() {
+  if grep -q -- "$2" "${STUB_INVOCATIONS}"; then fail "$1: a call matched '$2'"; else pass "$1"; fi
+}
+
+report() {
+  if [ "${failures}" -eq 0 ]; then
+    echo "all $1 cases passed"
+    exit 0
+  fi
+  echo >&2 "${failures} $1 case(s) failed"
+  exit 1
+}
diff --git a/.build/sh/test/stub-ant-cases.sh b/.build/sh/test/stub-ant-cases.sh
new file mode 100755
index 000000000000..8a2dd5ee8dbf
--- /dev/null
+++ b/.build/sh/test/stub-ant-cases.sh
@@ -0,0 +1,374 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Exercise the .build/*.sh wrapper scripts against a stub `ant`.
+#
+# The stub replays canned output and a canned exit code, so these cases test the
+# shell plumbing (argument parsing, exit codes, target selection) in seconds and
+# without a JDK build.  The summary scripts themselves are unit tested in
+# .build/sh/test/test_log_summary.py.
+#
+# Usage: .build/sh/test/stub-ant-cases.sh
+#
+
+set -o nounset
+set -o pipefail
+
+export CASSANDRA_DIR="$(cd -- "$(dirname -- "$0")/../../.." && pwd)"
+STUB_DIR="$(mktemp -d)"
+trap 'rm -rf "${STUB_DIR}"' EXIT
+
+export STUB_LOG_DIR="${STUB_DIR}/logs"
+export STUB_INVOCATIONS="${STUB_DIR}/invocations"
+export STUB_ANT_OPTS="${STUB_DIR}/ant-opts"
+export DIST_DIR="${STUB_DIR}/dist"
+mkdir -p "${STUB_DIR}/bin" "${STUB_DIR}/empty" "${STUB_LOG_DIR}" "${DIST_DIR}"
+
+# defines run_case(), the expect_* assertions and report()
+# shellcheck source=.build/sh/test/_test-harness.sh
+. "$(dirname -- "$0")/_test-harness.sh"
+
+# pre-conditions. run-tests.sh needs a JDK and git before it reaches any ant call
+for _tool in java javac git; do
+  command -v "${_tool}" >/dev/null 2>&1 || { echo >&2 "${_tool} needs to be installed"; exit 1; }
+done
+
+# the cases name these tests, so a rename must fail here and not deep inside a case
+for _fixture in test/unit/org/apache/cassandra/service/StorageServiceServerTest.java \
+                test/microbench/org/apache/cassandra/test/microbench/AutoBoxingBench.java ; do
+  [ -f "${CASSANDRA_DIR}/${_fixture}" ] \
+    || { echo >&2 "fixture ${_fixture} is gone; update the test names in $0"; exit 1; }
+done
+
+# the stub ant. For every non-option argument <a> it replays ${STUB_LOG_DIR}/<a>.log
+# and takes its exit code from ${STUB_LOG_DIR}/<a>.rc, defaulting to 0.
+cat > "${STUB_DIR}/bin/ant" <<'STUB'
+#!/bin/sh
+echo "ant $*" >> "${STUB_INVOCATIONS}"
+printf '%s\n' "${ANT_OPTS}" > "${STUB_ANT_OPTS}"
+_rc=0
+for _a in "$@"; do
+  case "${_a}" in -*) continue ;; esac
+  [ -f "${STUB_LOG_DIR}/${_a}.log" ] && cat "${STUB_LOG_DIR}/${_a}.log"
+  [ -f "${STUB_LOG_DIR}/${_a}.rc" ] && _rc="$(cat "${STUB_LOG_DIR}/${_a}.rc")"
+done
+exit "${_rc}"
+STUB
+chmod +x "${STUB_DIR}/bin/ant"
+export PATH="${STUB_DIR}/bin:${PATH}"
+
+# the project must look built, or run-tests.sh stops early
+version="$(grep 'property\s*name="base.version"' "${CASSANDRA_DIR}/build.xml" | sed -ne 's/.*value="\([^"]*\)".*/\1/p')"
+touch "${DIST_DIR}/apache-cassandra-${version}-SNAPSHOT.jar"
+
+################################
+#
+# Harness
+#
+################################
+
+reset_stub() {
+  # remove ant.log too, or a stale one from a previous failing case reads as this one's
+  rm -rf "${STUB_LOG_DIR}" "${STUB_INVOCATIONS}" "${STUB_ANT_OPTS}" "${DIST_DIR}/ant.log"
+  mkdir -p "${STUB_LOG_DIR}"
+  : > "${STUB_INVOCATIONS}"
+}
+
+stub_log() { printf '%s\n' "$2" > "${STUB_LOG_DIR}/$1.log"; }
+stub_rc()  { printf '%s\n' "$2" > "${STUB_LOG_DIR}/$1.rc"; }
+
+################################
+#
+# Cases: help and argument parsing
+#
+################################
+
+reset_stub
+for s in build-jars check-code run-tests; do
+  run_case "${CASSANDRA_DIR}/.build/${s}.sh" -h
+  expect_rc "${s}.sh -h exits 0" 0
+done
+
+run_case "${CASSANDRA_DIR}/.build/build-jars.sh" --bogus
+expect_rc "build-jars.sh rejects an unknown argument" 1
+expect_out "build-jars.sh names the unknown argument" "Unknown argument --bogus"
+
+run_case "${CASSANDRA_DIR}/.build/check-code.sh" --bogus
+expect_rc "check-code.sh rejects an unknown argument" 1
+
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -z
+expect_rc "run-tests.sh rejects an unknown option" 1
+
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" --bogus
+expect_rc "run-tests.sh rejects an unknown long option" 1
+expect_out "run-tests.sh names the unknown long option" "Invalid option: --bogus"
+
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -a
+expect_rc "run-tests.sh rejects a flag with no argument" 1
+expect_out "run-tests.sh says which flag needs an argument" "Option -a requires an argument"
+
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -a bogus-target
+expect_rc "run-tests.sh rejects an unknown target type" 1
+expect_out "run-tests.sh names the unknown target type" "Invalid test target type"
+
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" --target bogus-target
+expect_rc "run-tests.sh --target reaches the same check as -a" 1
+expect_out "run-tests.sh --target names the unknown target type" "Invalid test target type"
+
+# this script runs on the java on the path, so a legacy positional java version is a
+# mistake. reading it as a test name regexp would run the wrong tests on the wrong jdk
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" test 17
+expect_rc "run-tests.sh rejects a legacy positional java version" 1
+expect_out "run-tests.sh says it cannot set the java version" "cannot set the java version"
+expect_out "run-tests.sh names the docker script that can" "docker/run-tests.sh -a test -j 17"
+
+################################
+#
+# Case: error() is defined before the pre-conditions call it
+#
+################################
+
+reset_stub
+run_case env PATH="${STUB_DIR}/empty" "${CASSANDRA_DIR}/.build/run-tests.sh" -h
+expect_rc "run-tests.sh fails when ant is absent" 1
+expect_out "run-tests.sh reports the missing ant, not a missing function" "ant needs to be installed"
+
+################################
+#
+# Case: the split check uses a POSIX character class, not \d
+#
+################################
+
+reset_stub
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -a stress-test -c 2/4
+expect_rc "run-tests.sh rejects a split on stress-test" 1
+expect_out "run-tests.sh explains the rejected split" "does not support splits"
+
+reset_stub
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -a test -c 2/4 -t StorageServiceServerTest
+expect_rc "run-tests.sh allows a split on test" 0
+
+################################
+#
+# Cases: run-tests.sh --summary
+#
+################################
+
+reset_stub
+stub_log generate-test-report "   [concat] [Test Summary] Run: 12, Failed: 0, Errors: 0, Skipped: 1"
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -s -a test -t StorageServiceServerTest
+expect_rc "run-tests.sh -s exits 0 on a green run" 0
+expect_out "run-tests.sh -s reports the pass" "TESTS PASSED"
+expect_invocation "run-tests.sh runs generate-test-report for the test target" "generate-test-report"
+
+# -s must keep the full output, as the summary prints matched lines only
+if grep -q "Test Summary" "${DIST_DIR}/run-tests.log" 2>/dev/null; then
+  pass "run-tests.sh -s keeps the full output in DIST_DIR/run-tests.log"
+else
+  fail "run-tests.sh -s keeps the full output in DIST_DIR/run-tests.log"
+fi
+expect_out "run-tests.sh -s names the log file" "full output: ${DIST_DIR}/run-tests.log"
+
+reset_stub
+stub_log generate-test-report "[Test Summary] Run: 12, Failed: 0, Errors: 0, Skipped: 0"
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" --summary --target test --test StorageServiceServerTest
+expect_rc "run-tests.sh long flags exit 0 on a green run" 0
+expect_out "run-tests.sh --summary reports the pass" "TESTS PASSED"
+
+reset_stub
+stub_log generate-test-report "[Test Summary] Run: 12, Failed: 2, Errors: 0, Skipped: 1"
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -s -a test -t StorageServiceServerTest
+expect_rc "run-tests.sh -s exits 1 on test failures" 1
+expect_out "run-tests.sh -s shows the failure counts" "Failed: 2"
+
+reset_stub
+stub_rc testclasslist 1
+stub_log testclasslist "    [junit] Testcase: testFoo(org.apache.cassandra.FooTest):	FAILED"
+stub_log generate-test-report "[Test Summary] Run: 12, Failed: 1, Errors: 0, Skipped: 0"
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -s -a test -t StorageServiceServerTest
+expect_rc "run-tests.sh -s exits 1 when ant returns non-zero" 1
+expect_out "run-tests.sh -s names the failed target" "failed unit testclasslist"
+expect_invocation "run-tests.sh still reports after a failing target" "generate-test-report"
+
+# a setup failure must take precedence over the summary, and must name its cause.
+# the summary matches test results only, so without the log tail the user reads
+# "No test summary found" and nothing else
+reset_stub
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -s -a test -t NoSuchTestClassAnywhere
+expect_rc "run-tests.sh -s propagates a setup failure" 1
+expect_out "run-tests.sh -s shows the tail of the log on a setup failure" "run-tests.sh exited 1"
+expect_out "run-tests.sh -s shows what the run last printed" "Running tests: NoSuchTestClassAnywhere"
+
+# errexit is dynamically scoped, so -s must not disable it inside _main.
+# resolver-dist-lib runs before any test, and its failure must stop the run.
+reset_stub
+stub_rc resolver-dist-lib 1
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -s -a test -t StorageServiceServerTest
+expect_rc "run-tests.sh -s stops when the ant setup target fails" 1
+expect_no_invocation "run-tests.sh -s runs no test after a failed setup target" "testclasslist"
+
+################################
+#
+# Case: generate-test-report is skipped for targets with no JUnit xml
+#
+################################
+
+reset_stub
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -s -a microbench -t AutoBoxingBench
+expect_rc "run-tests.sh -s exits 0 on a green microbench run" 0
+expect_out "run-tests.sh -s reports the microbench pass" "completed successfully"
+expect_no_invocation "run-tests.sh skips generate-test-report for microbench" "generate-test-report"
+
+reset_stub
+stub_rc microbench 1
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -s -a microbench -t AutoBoxingBench
+expect_rc "run-tests.sh -s exits 1 on a failing microbench run" 1
+expect_out "run-tests.sh -s names the failed microbench" "failed microbench"
+
+# without -s there is no summary to read the marker, so the status must propagate
+reset_stub
+stub_rc microbench 1
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -a microbench -t AutoBoxingBench
+expect_rc "run-tests.sh exits 1 on a failing microbench run without -s" 1
+
+################################
+#
+# Case: stale test output is removed (the brace expansion was quoted before)
+#
+################################
+
+reset_stub
+mkdir -p "${DIST_DIR}/test/output" "${DIST_DIR}/test/logs"
+touch "${DIST_DIR}/test/output/TEST-stale.xml" "${DIST_DIR}/test/logs/stale.log"
+run_case "${CASSANDRA_DIR}/.build/run-tests.sh" -a test -t StorageServiceServerTest
+if [ -e "${DIST_DIR}/test/output/TEST-stale.xml" ] || [ -e "${DIST_DIR}/test/logs/stale.log" ]; then
+  fail "run-tests.sh removes stale test output"
+else
+  pass "run-tests.sh removes stale test output"
+fi
+
+# a DIST_DIR holding a space must not be word split, or rm -rf takes the wrong path.
+# unquoted, "${STUB_DIR}/spaced dist/test/{html,…}" splits into "${STUB_DIR}/spaced"
+# and "dist/test/html", so the sentinel below is what the old code deleted.
+reset_stub
+SPACED_DIR="${STUB_DIR}/spaced dist"
+SENTINEL="${STUB_DIR}/spaced"
+mkdir -p "${SPACED_DIR}/test/output" "${SPACED_DIR}/test/logs" "${SENTINEL}"
+touch "${SPACED_DIR}/apache-cassandra-${version}-SNAPSHOT.jar"
+touch "${SPACED_DIR}/test/output/TEST-stale.xml" "${SPACED_DIR}/test/logs/stale.log"
+touch "${SENTINEL}/keep-me"
+run_case env DIST_DIR="${SPACED_DIR}" "${CASSANDRA_DIR}/.build/run-tests.sh" -a test -t StorageServiceServerTest
+if [ -e "${SPACED_DIR}/test/output/TEST-stale.xml" ] || [ -e "${SPACED_DIR}/test/logs/stale.log" ]; then
+  fail "run-tests.sh removes stale output under a DIST_DIR with a space"
+else
+  pass "run-tests.sh removes stale output under a DIST_DIR with a space"
+fi
+if [ -e "${SENTINEL}/keep-me" ]; then
+  pass "run-tests.sh does not delete the word split prefix of DIST_DIR"
+else
+  fail "run-tests.sh does not delete the word split prefix of DIST_DIR"
+fi
+rm -rf "${SPACED_DIR}" "${SENTINEL}"
+
+################################
+#
+# Cases: build-jars.sh and check-code.sh
+#
+################################
+
+# both scripts call run_ant, so loop over the behaviour they share.
+# each entry names the script and the one ant target it runs
+for _case in "build-jars.sh jar" "check-code.sh check"; do
+  s="${_case% *}"
+  target="${_case#* }"
+
+  reset_stub
+  run_case "${CASSANDRA_DIR}/.build/${s}" -s
+  expect_rc "${s} -s exits 0 on a green run" 0
+  expect_out "${s} -s reports the pass" "BUILD SUCCESSFUL"
+  expect_invocation "${s} runs the ${target} target" " ${target}"
+
+  reset_stub
+  stub_rc "${target}" 1
+  stub_log "${target}" "${target}:
+    [javac] /src/Foo.java:12: error: cannot find symbol
+BUILD FAILED"
+  run_case "${CASSANDRA_DIR}/.build/${s}" -s
+  expect_rc "${s} -s exits 1 on a failing ${target}" 1
+  expect_out "${s} -s names the failed target" "Failed target: ${target}"
+  expect_out "${s} -s shows the line that failed" "cannot find symbol"
+
+  reset_stub
+  stub_rc "${target}" 1
+  run_case "${CASSANDRA_DIR}/.build/${s}"
+  expect_rc "${s} without -s still exits 1 on a failing ${target}" 1
+
+  # ant can die without printing "BUILD FAILED", which the summary alone reads as a pass
+  reset_stub
+  stub_rc "${target}" 1
+  stub_log "${target}" "${target}:
+java.lang.OutOfMemoryError: Java heap space"
+  run_case "${CASSANDRA_DIR}/.build/${s}" -s
+  expect_rc "${s} -s exits 1 when ant dies without BUILD FAILED" 1
+  # the log must sit under DIST_DIR, which .build/docker/_docker_run.sh bind mounts.
+  # a --rm container destroys /tmp, so a path there names a file the user cannot read
+  expect_out "${s} -s names a log file under DIST_DIR" "full output: ${DIST_DIR}/"
+  if [ -f "${DIST_DIR}/ant.log" ]; then
+    pass "${s} -s keeps the failed run's log in DIST_DIR"
+  else
+    fail "${s} -s keeps the failed run's log in DIST_DIR"
+  fi
+done
+
+# --clean belongs to build-jars.sh only
+reset_stub
+run_case "${CASSANDRA_DIR}/.build/build-jars.sh" -s
+expect_no_invocation "build-jars.sh does not clean without --clean" " clean"
+
+reset_stub
+run_case "${CASSANDRA_DIR}/.build/build-jars.sh" -s --clean
+expect_rc "build-jars.sh -s --clean exits 0 on a green build" 0
+expect_out "build-jars.sh -s labels the clean summary" "=== ant clean ==="
+expect_out "build-jars.sh -s labels the jar summary" "=== ant jar ==="
+first="$(sed -n 1p "${STUB_INVOCATIONS}")"
+second="$(sed -n 2p "${STUB_INVOCATIONS}")"
+case "${first}" in
+  *" clean"*) case "${second}" in
+                *" jar"*) pass "build-jars.sh --clean cleans before it builds" ;;
+                *)        fail "build-jars.sh --clean cleans before it builds: second call was '${second}'" ;;
+              esac ;;
+  *) fail "build-jars.sh --clean cleans before it builds: first call was '${first}'" ;;
+esac
+
+# _docker_run.sh puts -Dbuild.dir=${DIST_DIR} in ANT_OPTS, so check-code.sh must append
+reset_stub
+run_case env ANT_OPTS="-Dbuild.dir=/sentinel" "${CASSANDRA_DIR}/.build/check-code.sh" -s
+expect_rc "check-code.sh -s exits 0 with an inherited ANT_OPTS" 0
+if grep -q -- "-Dbuild.dir=/sentinel" "${STUB_DIR}/ant-opts" 2>/dev/null; then
+  pass "check-code.sh keeps the ANT_OPTS it inherited"
+else
+  fail "check-code.sh keeps the ANT_OPTS it inherited"
+fi
+
+################################
+#
+# Result
+#
+################################
+
+report stub-ant
diff --git a/.build/sh/test/stub-docker-cases.sh b/.build/sh/test/stub-docker-cases.sh
new file mode 100755
index 000000000000..1222b8f29050
--- /dev/null
+++ b/.build/sh/test/stub-docker-cases.sh
@@ -0,0 +1,231 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Exercise the .build/docker/*.sh wrapper scripts against a stub `docker`.
+#
+# The stub answers the host queries and records every call, so these cases test the
+# argument parsing without a container.  Two pieces of parsing need the coverage:
+# the optional positional java version in _docker_run.sh, and the long flags in
+# .build/docker/run-tests.sh.  Both decide what the container is told to run.
+#
+# Usage: .build/sh/test/stub-docker-cases.sh
+#
+
+set -o nounset
+set -o pipefail
+
+export cassandra_dir="$(cd -- "$(dirname -- "$0")/../../.." && pwd)"
+STUB_DIR="$(mktemp -d)"
+trap 'rm -rf "${STUB_DIR}"' EXIT
+
+export STUB_INVOCATIONS="${STUB_DIR}/invocations"
+export build_dir="${STUB_DIR}/dist"
+mkdir -p "${STUB_DIR}/bin" "${build_dir}"
+
+# defines run_case(), the expect_* assertions and report()
+# shellcheck source=.build/sh/test/_test-harness.sh
+. "$(dirname -- "$0")/_test-harness.sh"
+
+# the m2 repository is only mounted, so keep it out of the developer's home
+export m2_dir="${STUB_DIR}/m2"
+
+java_default="$(grep 'property\s*name="java.default"' "${cassandra_dir}/build.xml" | sed -ne 's/.*value="\([^"]*\)".*/\1/p')"
+
+# the stub docker. It records every call, and answers the three host queries that
+# .build/docker/run-tests.sh reads: the cpu count, the memory size and the cpu limit.
+cat > "${STUB_DIR}/bin/docker" <<'STUB'
+#!/bin/sh
+echo "docker $*" >> "${STUB_INVOCATIONS}"
+case "$1" in
+  --version) echo "Docker version 0.0.0-stub, build stub" ;;
+  info)      echo " CPUs: 8" ;;
+  images)    echo "stub-image-id" ;;
+  run)
+    # `docker run --rm alpine … nproc --all` and `… free -b` ask the host, not the image
+    for _a in "$@"; do
+      case "${_a}" in
+        nproc) echo 8 ; exit 0 ;;
+        free)  echo "Mem: 34359738368 0 0" ; exit 0 ;;
+      esac
+    done
+    echo "stub-container-id"
+    ;;
+esac
+exit 0
+STUB
+chmod +x "${STUB_DIR}/bin/docker"
+export PATH="${STUB_DIR}/bin:${PATH}"
+
+reset_stub() {
+  rm -f "${STUB_INVOCATIONS}"
+  : > "${STUB_INVOCATIONS}"
+}
+
+################################
+#
+# Cases: _docker_run.sh, and the optional positional java version
+#
+################################
+
+reset_stub
+run_case "${cassandra_dir}/.build/docker/_docker_run.sh" -h
+expect_rc "_docker_run.sh -h exits 0" 0
+expect_out "_docker_run.sh -h documents the script arguments" "script arguments"
+
+# with no version, the default applies and the flag still reaches the run script
+reset_stub
+run_case "${cassandra_dir}/.build/docker/_docker_run.sh" debian-build.docker build-jars.sh --clean
+expect_rc "_docker_run.sh runs with no java version" 0
+expect_out "_docker_run.sh reports the default java version" "Defaulting to java ${java_default}"
+expect_invocation "_docker_run.sh sets the default java version" "_set_java.sh ${java_default}"
+expect_invocation "_docker_run.sh passes --clean to build-jars.sh" "build-jars.sh --clean"
+
+# with a version, the run script must not receive it as one of its own arguments
+reset_stub
+run_case "${cassandra_dir}/.build/docker/_docker_run.sh" debian-build.docker build-jars.sh 17 --clean
+expect_rc "_docker_run.sh runs with a java version" 0
+expect_no_out "_docker_run.sh does not default when a version is given" "Defaulting to java"
+expect_invocation "_docker_run.sh sets the given java version" "_set_java.sh 17"
+expect_invocation "_docker_run.sh still passes --clean" "build-jars.sh --clean"
+expect_no_invocation "_docker_run.sh does not pass the version to the run script" "build-jars.sh 17"
+
+# a leading - marks a run script argument, so -s must never be read as a java version
+reset_stub
+run_case "${cassandra_dir}/.build/docker/_docker_run.sh" debian-build.docker check-code.sh -s
+expect_rc "_docker_run.sh reads -s as a run script argument" 0
+expect_invocation "_docker_run.sh sets the default java version before -s" "_set_java.sh ${java_default}"
+expect_invocation "_docker_run.sh passes -s to check-code.sh" "check-code.sh -s"
+
+reset_stub
+run_case "${cassandra_dir}/.build/docker/_docker_run.sh" debian-build.docker build-jars.sh 99
+expect_rc "_docker_run.sh rejects an unsupported java version" 1
+expect_out "_docker_run.sh names the supported java versions" "Java version is not in"
+
+reset_stub
+run_case "${cassandra_dir}/.build/docker/_docker_run.sh" no-such.docker build-jars.sh
+expect_rc "_docker_run.sh rejects a missing dockerfile" 1
+expect_out "_docker_run.sh names the missing dockerfile" "no-such.docker must exist"
+
+# docker accepts [a-zA-Z0-9][a-zA-Z0-9_.-] in a container name only. four call sites pass a
+# run_script that holds a directory, so the name must not carry the directory separator
+reset_stub
+run_case "${cassandra_dir}/.build/docker/_docker_run.sh" almalinux-build.docker docker/_build-redhat.sh 21
+expect_rc "_docker_run.sh runs a run_script under a directory" 0
+expect_invocation "_docker_run.sh names the container after the run_script alone" "\-\-name cassandra_almalinux-build_build-redhat_jdk21__"
+expect_no_invocation "_docker_run.sh puts no directory separator in the container name" "\-\-name [^ ]*/"
+
+################################
+#
+# Cases: docker/run-tests.sh, and its long flags
+#
+################################
+
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" -h
+expect_rc "docker/run-tests.sh -h exits 0" 0
+expect_out "docker/run-tests.sh -h documents --summary" "-s, --summary"
+
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" -a test -t StorageServiceServerTest -j 17 -s
+expect_rc "docker/run-tests.sh runs with short flags" 0
+# two assertions, as an empty split_chunk_arg leaves a double space between -a and -t
+expect_invocation "docker/run-tests.sh passes the target on" "_docker_init_tests.sh \-a test"
+expect_invocation "docker/run-tests.sh passes the test name and -s on" "\-t StorageServiceServerTest \-s"
+expect_invocation "docker/run-tests.sh sets java from -j" "_set_java.sh 17"
+
+# the long flags must reach the container as the same short flags
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" --target test --test StorageServiceServerTest --java 17 --summary
+expect_rc "docker/run-tests.sh runs with long flags" 0
+expect_invocation "docker/run-tests.sh turns --target into -a" "_docker_init_tests.sh \-a test"
+expect_invocation "docker/run-tests.sh turns --test and --summary into -t and -s" "\-t StorageServiceServerTest \-s"
+expect_invocation "docker/run-tests.sh sets java from --java" "_set_java.sh 17"
+
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" --target bogus-target
+expect_rc "docker/run-tests.sh rejects an unknown target type" 1
+expect_out "docker/run-tests.sh names the unknown target type" "Invalid test target type"
+
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" --target
+expect_rc "docker/run-tests.sh rejects a long flag with no argument" 1
+expect_out "docker/run-tests.sh says which flag needs an argument" "requires an argument"
+
+# run-python-dtests.sh has no summary mode, so the flag must be refused before any docker work
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" --target dtest --summary
+expect_rc "docker/run-tests.sh rejects --summary for a dtest target" 1
+expect_out "docker/run-tests.sh explains the refused --summary" "has no summary mode"
+expect_no_invocation "docker/run-tests.sh starts no container for a refused --summary" "docker run"
+
+# with no target, that same guard must not fire on an empty test_target
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" --summary
+expect_rc "docker/run-tests.sh rejects --summary with no target" 1
+expect_out "docker/run-tests.sh names the missing target, not the summary mode" "resource limits unconfigured"
+
+# an argument this script does not know reaches the downstream script
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" -a test -t StorageServiceServerTest -b 4.1
+expect_rc "docker/run-tests.sh runs with an argument it does not know" 0
+expect_invocation "docker/run-tests.sh passes the unknown argument downstream" "\-b 4.1"
+
+# the sibling docker scripts take the java version positionally, so refuse that form here
+# rather than let the downstream script reject the token after the container is up
+java_supported="$(grep 'property\s*name="java.supported"' "${cassandra_dir}/build.xml" | sed -ne 's/.*value="\([^"]*\)".*/\1/p')"
+for _v in ${java_supported//,/ } ; do
+  reset_stub
+  run_case "${cassandra_dir}/.build/docker/run-tests.sh" -a test "${_v}"
+  expect_rc "docker/run-tests.sh rejects a positional java version ${_v}" 1
+  expect_out "docker/run-tests.sh names -j for the positional ${_v}" "Use '-j ${_v}'"
+  expect_no_invocation "docker/run-tests.sh starts no container for the positional ${_v}" "docker run"
+done
+
+# the guard reads whole arguments only, so a version inside a value must survive it
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" -a test -t StorageServiceServerTest -b cassandra-11
+expect_rc "docker/run-tests.sh keeps an argument that merely contains a java version" 0
+expect_invocation "docker/run-tests.sh passes that argument downstream" "\-b cassandra-11"
+
+################################
+#
+# Cases: docker/run-tests.sh, and the deprecated positional arguments
+#
+################################
+
+# the legacy form is <target> [<test regexp|chunk>] [<java version>]
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" test StorageServiceServerTest 17
+expect_rc "docker/run-tests.sh runs three legacy arguments" 0
+expect_out "docker/run-tests.sh shows the flags the legacy arguments became" "format: -a test -t StorageServiceServerTest -j 17"
+expect_invocation "docker/run-tests.sh sets java from the third legacy argument" "_set_java.sh 17"
+
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" test 1/8
+expect_rc "docker/run-tests.sh reads a legacy X/Y as a chunk" 0
+expect_invocation "docker/run-tests.sh turns the legacy chunk into -c" "_docker_init_tests.sh \-a test \-c 1/8"
+
+# with two legacy arguments the second reads as the java version, not as a test name regexp
+reset_stub
+run_case "${cassandra_dir}/.build/docker/run-tests.sh" test 17
+expect_rc "docker/run-tests.sh runs two legacy arguments" 0
+expect_out "docker/run-tests.sh shows the second legacy argument as -j" "format: -a test  -j 17"
+expect_invocation "docker/run-tests.sh sets java from the second legacy argument" "_set_java.sh 17"
+expect_no_invocation "docker/run-tests.sh reads no test name regexp from it" "\-t 17"
+
+report stub-docker
diff --git a/.build/sh/test/test_log_summary.py b/.build/sh/test/test_log_summary.py
new file mode 100644
index 000000000000..33a1af2c221c
--- /dev/null
+++ b/.build/sh/test/test_log_summary.py
@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Unit tests for .build/sh/test-log-summary.py and .build/sh/ant-log-summary.py.
+#
+# Run with:  python3 -m unittest discover -s .build/sh/test
+
+import importlib.util
+import pathlib
+import subprocess
+import sys
+import unittest
+
+SH_DIR = pathlib.Path(__file__).resolve().parents[1]
+TEST_LOG_SUMMARY = SH_DIR / "test-log-summary.py"
+ANT_LOG_SUMMARY = SH_DIR / "ant-log-summary.py"
+
+
+def _load(name, path):
+    """Import a script whose file name is not a legal module name."""
+    spec = importlib.util.spec_from_file_location(name, path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+summariser = _load("cassandra_test_log_summary", TEST_LOG_SUMMARY)
+
+
+def summary_line(run=10, failed=0, errors=0, skipped=0, tag=""):
+    return "%s[Test Summary] Run: %d, Failed: %d, Errors: %d, Skipped: %d" % (
+        tag,
+        run,
+        failed,
+        errors,
+        skipped,
+    )
+
+
+class SummarizeTest(unittest.TestCase):
+    """Exercise summarize() directly.  Text in, (failed, lines) out."""
+
+    def summarize(self, content):
+        return summariser.summarize(content)
+
+    def test_clean_pass(self):
+        failed, out = self.summarize(summary_line(run=42))
+        self.assertFalse(failed)
+        self.assertIn("TESTS PASSED", out)
+
+    def test_clean_pass_with_ant_task_tag(self):
+        # ant prefixes concat output with a task tag
+        failed, out = self.summarize(summary_line(run=42, tag="   [concat] "))
+        self.assertFalse(failed)
+        self.assertIn("TESTS PASSED", out)
+        self.assertTrue(any(line.startswith("[Test Summary]") for line in out))
+
+    def test_skipped_tests_alone_pass(self):
+        failed, _ = self.summarize(summary_line(run=42, skipped=7))
+        self.assertFalse(failed)
+
+    def test_failures_fail(self):
+        failed, out = self.summarize(summary_line(run=42, failed=2))
+        self.assertTrue(failed)
+        self.assertNotIn("TESTS PASSED", out)
+
+    def test_errors_fail(self):
+        failed, _ = self.summarize(summary_line(run=42, errors=1))
+        self.assertTrue(failed)
+
+    def test_last_summary_does_not_mask_an_earlier_failure(self):
+        content = "\n".join([summary_line(failed=3), summary_line()])
+        failed, _ = self.summarize(content)
+        self.assertTrue(failed)
+
+    def test_run_tests_failed_target(self):
+        content = "\n".join(
+            [
+                "failed unit testclasslist 1/1 StorageServiceServerTest",
+                summary_line(),
+            ]
+        )
+        failed, out = self.summarize(content)
+        self.assertTrue(failed)
+        self.assertIn("failed unit testclasslist 1/1 StorageServiceServerTest", out)
+
+    def test_failed_to_prose_is_not_a_failed_target(self):
+        # _build_all_dtest_jars logs prose that must not read as a target failure
+        content = "\n".join(
+            [
+                "WARNING: could not reset/clean /tmp/cassandra-dtest-jars… continuing…",
+                "failed to parse something harmless",
+                summary_line(),
+            ]
+        )
+        failed, _ = self.summarize(content)
+        self.assertFalse(failed)
+
+    def test_failure_rate_non_zero_fails(self):
+        failed, out = self.summarize("failure rate: 3/500")
+        self.assertTrue(failed)
+        self.assertTrue(any("failure rate: 3/500" in line for line in out))
+
+    def test_failure_rate_zero_passes(self):
+        content = "\n".join(["failure rate: 0/500", summary_line()])
+        failed, _ = self.summarize(content)
+        self.assertFalse(failed)
+
+    def test_testcase_failure_without_a_summary_fails(self):
+        # microbench, microbench-test and build_dtest_jars skip generate-test-report,
+        # so there is no [Test Summary] line to read the verdict from
+        content = "    [junit] Testcase: testFoo(org.apache.cassandra.FooTest):\tFAILED"
+        failed, out = self.summarize(content)
+        self.assertTrue(failed)
+        self.assertIn("Failed tests:", out)
+
+    def test_testcase_error_without_a_summary_fails(self):
+        content = (
+            "    [junit] Testcase: testFoo(org.apache.cassandra.FooTest):"
+            "\tCaused an ERROR"
+        )
+        failed, _ = self.summarize(content)
+        self.assertTrue(failed)
+
+    def test_duplicate_testcase_lines_are_reported_once(self):
+        line = "Testcase: testFoo(org.apache.cassandra.FooTest):\tFAILED"
+        failed, out = self.summarize("\n".join([line, line, line]))
+        self.assertTrue(failed)
+        self.assertEqual(1, out.count(line))
+
+    def test_build_failed_reports_compilation_errors(self):
+        content = "\n".join(
+            [
+                "compile:",
+                "    [javac] /src/Foo.java:12: error: cannot find symbol",
+                "    [javac] 1 error",
+                "BUILD FAILED",
+            ]
+        )
+        failed, out = self.summarize(content)
+        self.assertTrue(failed)
+        self.assertIn("BUILD FAILED", out)
+        self.assertIn("Compilation Errors:", out)
+        self.assertTrue(any("cannot find symbol" in line for line in out))
+
+    def test_microbench_marker_passes(self):
+        failed, out = self.summarize("microbench completed successfully")
+        self.assertFalse(failed)
+        self.assertIn("TESTS PASSED", out)
+        self.assertIn("microbench completed successfully", out)
+
+    def test_microbench_failure_fails(self):
+        failed, _ = self.summarize("failed microbench 1/1")
+        self.assertTrue(failed)
+
+    def test_empty_input_passes_with_a_notice(self):
+        failed, out = self.summarize("")
+        self.assertFalse(failed)
+        self.assertTrue(any("No test summary found" in line for line in out))
+
+
+class ExitCodeTest(unittest.TestCase):
+    """Exercise the two scripts as processes, since the shell reads $?."""
+
+    def run_script(self, script, stdin_text, args=("-",)):
+        proc = subprocess.run(
+            [sys.executable, str(script), *args],
+            input=stdin_text,
+            capture_output=True,
+            text=True,
+        )
+        return proc.returncode, proc.stdout
+
+    def test_test_log_summary_passes_with_zero(self):
+        rc, out = self.run_script(TEST_LOG_SUMMARY, summary_line())
+        self.assertEqual(0, rc)
+        self.assertIn("TESTS PASSED", out)
+
+    def test_test_log_summary_fails_with_one(self):
+        rc, _ = self.run_script(TEST_LOG_SUMMARY, summary_line(failed=1))
+        self.assertEqual(1, rc)
+
+    def test_test_log_summary_reads_stdin_by_default(self):
+        rc, out = self.run_script(TEST_LOG_SUMMARY, summary_line(), args=())
+        self.assertEqual(0, rc)
+        self.assertIn("TESTS PASSED", out)
+
+    def test_test_log_summary_missing_file(self):
+        # 2, as both summarizers reserve 1 for "the log reports a failure"
+        rc, _ = self.run_script(TEST_LOG_SUMMARY, "", args=("/nonexistent.log",))
+        self.assertEqual(2, rc)
+
+    def test_ant_log_summary_passes_with_zero(self):
+        rc, out = self.run_script(ANT_LOG_SUMMARY, "jar:\nBUILD SUCCESSFUL\n")
+        self.assertEqual(0, rc)
+        self.assertIn("BUILD SUCCESSFUL", out)
+
+    def test_ant_log_summary_fails_with_one(self):
+        content = "\n".join(
+            [
+                "checkstyle:",
+                "    [checkstyle] /src/Foo.java:1: line too long",
+                "BUILD FAILED",
+            ]
+        )
+        rc, out = self.run_script(ANT_LOG_SUMMARY, content)
+        self.assertEqual(1, rc)
+        self.assertIn("BUILD FAILED", out)
+        self.assertIn("Failed target: checkstyle", out)
+
+    def test_ant_log_summary_missing_file(self):
+        # 2, as both summarizers reserve 1 for "the log reports a failure"
+        rc, _ = self.run_script(ANT_LOG_SUMMARY, "", args=("/nonexistent.log",))
+        self.assertEqual(2, rc)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/workflows/build-scripts.yaml b/.github/workflows/build-scripts.yaml
new file mode 100644
index 000000000000..9c910f7ba62c
--- /dev/null
+++ b/.github/workflows/build-scripts.yaml
@@ -0,0 +1,75 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Build Scripts
+
+# Fast checks on the .build/*.sh wrapper scripts and their log summarizers.
+# No JDK build runs here: a stub `ant` replays canned output.
+# The real toolchain jobs are in code-check.yaml, and the full test matrix is Jenkins.
+
+on:
+    push:
+        branches:
+            - '**'
+        paths:
+            - '.build/**'
+            - '.github/workflows/**'
+
+jobs:
+    # one job, as every step below runs in seconds and a second runner costs more to start
+    build-scripts:
+        runs-on: ubuntu-latest
+
+        steps:
+          - name: Checkout code
+            uses: actions/checkout@v4
+          - name: JDK 17
+            uses: actions/setup-java@v4
+            with:
+              java-version: '17'
+              distribution: 'temurin'
+          - name: Shellcheck
+            # -S error only, as the older scripts carry pre-existing style findings.
+            # Clean those first, then raise this to -S warning.
+            run: |
+              shellcheck -x -S error \
+                .build/build-jars.sh \
+                .build/check-code.sh \
+                .build/run-tests.sh \
+                .build/docker/run-tests.sh \
+                .build/docker/_docker_run.sh \
+                .build/sh/test/stub-ant-cases.sh \
+                .build/sh/test/stub-docker-cases.sh
+          - name: POSIX syntax
+            # build-jars.sh, check-code.sh and _run-ant.sh declare /bin/sh, so no bashisms
+            run: |
+              dash -n .build/build-jars.sh
+              dash -n .build/check-code.sh
+              dash -n .build/sh/_run-ant.sh
+          - name: Log summarizer unit tests
+            run: python3 -m unittest discover -s .build/sh/test -v
+          - name: run-ci unit tests
+            # the module name holds hyphens, so `unittest discover` skips it. name it instead
+            working-directory: .build/run-ci.d
+            # the run-ci.d/requirements.txt cloud extras are large, and nothing here imports them
+            run: |
+              python3 -m pip install --quiet bs4 kubernetes python-jenkins requests
+              python3 -m unittest run-ci-test -v
+          - name: Wrapper script cases
+            run: .build/sh/test/stub-ant-cases.sh
+          - name: Docker wrapper script cases
+            # a stub `docker` shadows the runner's, so no container starts here
+            run: .build/sh/test/stub-docker-cases.sh
diff --git a/.github/workflows/code-check.yaml b/.github/workflows/code-check.yaml
index f94f3f90742a..0f2f47c72182 100644
--- a/.github/workflows/code-check.yaml
+++ b/.github/workflows/code-check.yaml
@@ -32,4 +32,5 @@ jobs:
               java-version: '17'
               distribution: 'temurin'
           - name: Run Code Checks
-            run: .build/docker/check-code.sh 17
\ No newline at end of file
+            # --summary exercises run_ant's summary path against real ant output
+            run: .build/docker/check-code.sh 17 --summary
\ No newline at end of file
diff --git a/.jenkins/Jenkinsfile b/.jenkins/Jenkinsfile
index 938cfc7b6acd..83e58b67f81c 100644
--- a/.jenkins/Jenkinsfile
+++ b/.jenkins/Jenkinsfile
@@ -690,7 +690,7 @@ def generateTestReports() {
 
       dir('build/') {
         archiveArtifacts artifacts: "ci_summary.html,results_details.tar.xz,${logfile}", fingerprint: true
-        copyToNightlies('ci_summary.html,results_details.tar.xz,${logfile}')
+        copyToNightlies("ci_summary.html,results_details.tar.xz,${logfile}")
       }
     }
     processJmhReports()
diff --git a/AGENTS.md b/AGENTS.md
index 1a6b6a947bbc..5e2d3c16f26e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,47 +14,69 @@ Apache Cassandra is a NoSQL distributed database. This is the official Git repos
 
 ## Build
 
+Prefer the `.build/*.sh` helper scripts over calling `ant` directly. See
+[.build/README.md](./.build/README.md) for the full set.
+
 ```bash
-.build/sh/ai-build       # clean, build JAR, and run checkstyle (output is summarized)
+.build/build-jars.sh -s          # build the Cassandra JAR (runs `ant jar`)
+.build/build-jars.sh -s --clean  # clean first, then build
 ```
 
-Do NOT call `ant` directly — always use the `ai-*` wrapper scripts which handle log summarization and correct working directory.
+All three scripts accept `-s`/`--summary`, which prints a summary of failures instead of the full ant output.  Omit it for the full output.  `--clean` applies to `.build/build-jars.sh` only.
 
 ## Testing
 
 - Do NOT run the entire test suite. Run only the specific test(s) relevant to your change.
+- The project must be built first (e.g. `.build/build-jars.sh`).
 
     ```bash
-    # Run a single unit test class
-    .build/sh/ai-ci-test org.apache.cassandra.service.StorageServiceServerTest
+    # Run a single test class: -a is the test type, -t is a class-name regexp
+    .build/run-tests.sh -s -a test -t StorageServiceServerTest
     ```
 
-- `ai-ci-test` does NOT support method-level filtering — it runs the entire test class.
+- `-a` is the test type (`test`, `jvm-dtest`, `long-test`, …; run `.build/run-tests.sh -h` for the full list).
+- `-t` matches the test class only, not individual methods.
+- `-s`/`--summary` prints a concise list of failed tests.  The full output is kept in `build/run-tests.log`.
 - When fixing a bug, first create a regression test that reproduces the failure, then implement the fix and verify.
 - Provide test(s) coverage for all new or modified code.
 
 ## Linting and Code Checks
 
-`.build/sh/ai-build` includes checkstyle validation. There is no need to run checkstyle separately.
+```bash
+.build/check-code.sh -s    # runs `ant check` (rat-check + checkstyle + checkstyle-test, after a build)
+```
+
+The `check` target depends on `_main-jar`, `build-test` and `gen-asciidoc`, so
+`.build/check-code.sh` builds the jar and the test classes itself.  Do not run
+`.build/build-jars.sh` before it.
+
+The same dependencies make `check` slower than checkstyle alone: it also generates the
+documentation, and `rat-check` reads every file in the working directory.
 
 ## Code Style
-Cassandra enforces style via Checkstyle (run via `.build/sh/ai-build`). The official style guide is at https://cassandra.apache.org/_/development/code_style.html. Always defer to it when in doubt.
+Cassandra enforces style via Checkstyle (run via `.build/check-code.sh`). The official style guide is at https://cassandra.apache.org/_/development/code_style.html. Always defer to it when in doubt.
 
 General style conventions:
 - 4-space indentation, no tabs.
 - Match existing code style in the file you are editing.
 - All new files must include the Apache License 2.0 header.
 - Concise English documentation is required for complex classes and methods; trivial ones may not require them.
+- Shorten (make succinct) comments. Comments are not needed for what can easily be read from the code.
+
+# Docker mode
+If commands fails due to host issues, and docker is available, use the `.build/docker/` command equivalents.
 
 ## Git Workflow
 - Do NOT commit unless explicitly asked.
 - Commit messages format. For example:
 
     ```
-    <One sentence description, usually Jira title or CHANGES.txt summary>
+    <One sentence description, usually Jira title or CHANGES.txt summary, no jira id>
 
     <Optional lengthier description>
   
+     patch by <Authors,>; reviewed by <Reviewers,> for CASSANDRA-#####
+
     Assisted-by: AGENT_NAME:MODEL_VERSION
     ```