@@ -264,12 +264,13 @@ jobs:
         # at `-n 4` the `ALL` tier took each worker to 5.4-5.9 GB and them all
         # past 20 GB, measured on PyPy 8.0.1, where a 14 GB cap OOM-killed them
         # and a 3 GB `PYPY_GC_MAX` raised MemoryError instead. A smaller `-n`
-        # only hands each worker more tests. So a PyPy leg runs pytest once per
-        # directory `SHARDS` names, then once more over the rest, ignoring each
-        # of them, and every run starts its workers afresh: the largest, with
-        # tests/protocols, peaked at 2.6 GB a worker and 8.5 GB in all, and the
-        # tier took 383 s rather than 493 s. Each run but the last writes a
-        # JUnit file of its own, beside junit.xml; the step fails if any run did.
+        # only hands each worker more tests. So on a PyPy leg util/pytest_shards.py
+        # runs pytest once per directory `SHARDS` names, then once more over the
+        # rest, ignoring each of them, and every run starts its workers afresh:
+        # the largest, with tests/protocols, peaked at 2.6 GB a worker and 8.5 GB
+        # in all, and the tier took 383 s rather than 493 s. Each run but the
+        # last writes a JUnit file of its own, beside junit.xml; the step fails
+        # if any run did.
         env:
           COVERAGE: ${{ matrix.coverage }}
           LATEST: ${{ matrix.python-version == needs.python-versions.outputs.latest }}
@@ -297,15 +298,8 @@ jobs:
             COVERAGE_DEBUG=pid,process COVERAGE_DEBUG_FILE="$PWD/coverage-processes.log" \
             python util/cap_file_size.py python -m coverage run --rcfile=.github/coverage.toml -m pytest "$@"
           elif [ -n "$SHARDS" ]; then
-            status=0
-            rest=()
-            for shard in $SHARDS; do
-              python util/cap_file_size.py python -m pytest "$@" \
-                --junitxml="$RUNNER_TEMP/junit-${shard//\//-}.xml" "$shard" || status=$?
-              rest+=(--ignore="$shard")
-            done
-            python util/cap_file_size.py python -m pytest "$@" "${rest[@]}" || status=$?
-            exit "$status"
+            # #2005: #1963's script, on the leg's interpreter, under the one cap.
+            python util/cap_file_size.py python util/pytest_shards.py "$SHARDS" -- python -m pytest "$@"
           else
             python util/cap_file_size.py python -m pytest "$@"
           fi
 
@@ -52,7 +52,7 @@ Editing ``__version__`` by hand without also moving :file:`CITATION.cff`'s
 (``:494-514``) asserts the two agree, and ``create-release.yml``'s
 ``unit-tests`` job (``:581-597``) calls ``unit-tests.yml`` with
 ``gate-only: true``, which runs the **full** suite rather than the tiered
-subset an ordinary push runs (its ``gate`` job, ``unit-tests.yml:1804-1879``).
+subset an ordinary push runs (its ``gate`` job, ``unit-tests.yml:1798-1873``).
 That gate runs whenever a release will -- a moved ``__version__`` is exactly
 what makes ``version_check``'s evidence read "not yet published" -- and every
 publishing job requires it to have succeeded (``:621,808,974,1210``), so a
@@ -62,7 +62,7 @@ Either run the script, or move both fields by hand in the same commit.
 This is the **only** edit a person makes to get a release started -- the tag,
 the Release, and every upload are the workflow's job from here. Other
 checks run unconditionally on the same path, though none is a step in *this*
-process: the ``changelog`` job (``unit-tests.yml:1647-1673``) fails outright if
+process: the ``changelog`` job (``unit-tests.yml:1641-1667``) fails outright if
 ``CHANGELOG.md`` has drifted from its source entry under
 :file:`docs/source/changelog/`, and the release-body step warns, without
 failing, if that entry's heading still reads "unreleased"
 
@@ -376,7 +376,7 @@ the same commit several times over. It also skips ``changes``,
 Checks`_ below), which are gated out by their own ``if:`` rather than by having
 already run. ``changelog`` carries no
 ``if:`` at all and runs on every path regardless -- deliberately, per its own
-comment (``unit-tests.yml:1635-1641``): ``create-release.yml`` feeds
+comment (``unit-tests.yml:1629-1635``): ``create-release.yml`` feeds
 ``CHANGELOG.md`` to the GitHub Release body, so the release path is exactly
 where a drifted file must not go unchecked. Confirmed on run `36210743295
 <https://github.com/JarryShaw/PyPCAPKit/actions/runs/36210743295>`__ (a
@@ -689,7 +689,7 @@ grepping every workflow file for its name:
      - Where
    * - ``Required checks passed``
      - job ``required-checks``
-     - ``unit-tests.yml:1970``
+     - ``unit-tests.yml:1964``
    * - ``Compat Python 3.11``
      - job ``compatibility``, matrix leg ``3.11``
      - ``python-compatibility.yml:60``, ``.github/python-versions.toml:20``
@@ -711,22 +711,22 @@ which added ``Compat Python 3.15`` and removed ``Compat Python 3.10``. Moving a
 between the tiers below means editing the ruleset in the same change.
 
 ``Required checks passed`` is defined by exactly one job
-(``unit-tests.yml:1970``). ``Compat Python`` is defined by one, the
+(``unit-tests.yml:1964``). ``Compat Python`` is defined by one, the
 ``compatibility`` job in ``python-compatibility.yml`` (``:60``), whose matrix
 (``:74``) comes from :file:`.github/python-versions.toml`: the required legs
 are its supported tier (``python-versions.toml:20-24``), and its KTLO legs
 (``python-versions.toml:16-19``) have names ending in ``(KTLO)``, so no required
 context matches one. A comment at
-``unit-tests.yml:1882`` mentions the string without defining it.
+``unit-tests.yml:1876`` mentions the string without defining it.
 
 ``Required checks passed`` is an aggregate, not a single check run. The ruleset
 requires it and the ``Compat Python 3.11``-``3.15`` legs, nothing else, as
-``unit-tests.yml``'s own comment (``unit-tests.yml:1881-1891``) records. It
+``unit-tests.yml``'s own comment (``unit-tests.yml:1875-1885``) records. It
 ``needs:`` the gating jobs of ``unit-tests.yml`` -- ``test``, ``integration``,
 ``engine-tests`` and ``pypcap-parity``, plus ``project-tests``, the one run of
 the project pins, and ``changes`` for the docs-only path -- and checks each
 result explicitly
-(``unit-tests.yml:1969-2025``). Rulesets match check names literally, with no
+(``unit-tests.yml:1963-2019``). Rulesets match check names literally, with no
 wildcard, so requiring the matrix cells one by one would mean editing the
 ruleset whenever a matrix changes; the aggregate keeps the required list fixed.
 It accepts the gating jobs as ``skipped`` only on a docs-only pull request, where
@@ -735,7 +735,7 @@ It accepts the gating jobs as ``skipped`` only on a docs-only pull request, wher
 ``python-compatibility.yml``, and a job cannot ``needs:`` a job in another
 workflow file. This job runs on Unit Tests' own ``push``/``pull_request``
 triggers; the ``gate-only: true`` reusable calls documented above skip it via
-``if: ${{ always() && inputs.gate-only != true }}`` (``unit-tests.yml:1972``),
+``if: ${{ always() && inputs.gate-only != true }}`` (``unit-tests.yml:1966``),
 so it is never produced -- and never expected -- on those paths.
 
 .. _ktlo-tier:
@@ -759,7 +759,7 @@ and keeps its legs' check names, ``Python 3.10 (KTLO)`` and so on. In
 with supported legs. Every job holding KTLO legs works the same way:
 
 * Every step that can fail on a KTLO leg has an ``id`` and
-  ``continue-on-error: ${{ matrix.ktlo == true }}`` (``unit-tests.yml:400-417``),
+  ``continue-on-error: ${{ matrix.ktlo == true }}`` (``unit-tests.yml:394-411``),
   unless it is masked on every leg, as the timings uploads are. Its ``outcome`` is
   then ``failure`` but its ``conclusion`` ``success``, so the job, its check run
   and ``required-checks`` read ``success``. A step that needs an earlier one's work
@@ -797,9 +797,10 @@ with the image's Rust and ``libssl-dev``, and none of ``lxml``, so the ``test``
 extra carries ``lxml`` on CPython only.
 
 On PyPy an xdist worker's RSS grows with every test it runs, rather than in a few
-heavy modules, so a PyPy leg's ``Run unit tests`` runs pytest once per directory its
-``SHARDS`` names, ``tests/protocols`` and then ``tests/corekit``, and once more over
-the rest, ignoring each (`#2005 <https://github.com/JarryShaw/PyPCAPKit/issues/2005>`__).
+heavy modules, so a PyPy leg's ``Run unit tests`` hands its pytest command to
+:file:`util/pytest_shards.py`, as GraalPy's leg does (see below), which runs it once per
+directory its ``SHARDS`` names, ``tests/protocols`` and then ``tests/corekit``, and once
+more over the rest, ignoring each (`#2005 <https://github.com/JarryShaw/PyPCAPKit/issues/2005>`__).
 Each run starts its workers afresh. Measured on PyPy 8.0.1 at ``-n 4``, one run
 over the whole ``ALL`` tier took each worker to 5.4-5.9 GB and the workers together
 past 20 GB, beyond the runner's 16 GB; split, the largest run peaked at 2.6 GB a
@@ -1199,14 +1200,17 @@ does; each has tests under :file:`tests/project/` that run it.
      - ``Report coverage`` in ``unit-tests.yml``'s ``test``, on the coverage leg.
    * - :file:`util/pytest_shards.py`
      - ``Run unit tests`` in ``experimental.yml``'s ``experimental``, on GraalPy's leg
-       (`#1963 <https://github.com/JarryShaw/PyPCAPKit/issues/1963>`__).
+       (`#1963 <https://github.com/JarryShaw/PyPCAPKit/issues/1963>`__), and in
+       ``unit-tests.yml``'s ``test`` and ``test-ktlo``, on PyPy's legs (`#2005
+       <https://github.com/JarryShaw/PyPCAPKit/issues/2005>`__).
 
 The summaries run on the image's ``/usr/bin/python3`` rather than the leg's
 interpreter, which may have failed to set up or be too broken to run anything, so
 they need only the standard library, as ``classify_changes.py`` does on the
 runner's ``python3``. :file:`util/pytest_shards.py` runs on ``/usr/bin/python3``
 too, standard library only, so on GraalPy's leg the leg's interpreter runs pytest
-alone. Both ``changes`` jobs check out on every event, since the script is in the
+alone; on PyPy's legs the leg's interpreter runs the script as well, under the
+file-size cap every test command of ``unit-tests.yml`` takes. Both ``changes`` jobs check out on every event, since the script is in the
 tree. ``create-release.yml``'s ``pypi`` job keeps its own copy of
 the KTLO summary's shell until its shell moves to scripts too; a project pin runs
 that copy and the script on the same steps and requires the same output.
 
@@ -91,7 +91,7 @@ def test_a_shard_that_fails_fails_the_step_after_the_rest_ran(self) -> None:
         with tempfile.TemporaryDirectory() as temp:
             stub = pathlib.Path(temp, 'python')
             # The first pytest run fails as pytest does on a failed test; `-c` asks the real interpreter.
-            stub.write_text('#!/bin/sh\ncase "$1" in -c) exec "$REAL_PYTHON" "$@";; '
+            stub.write_text('#!/bin/sh\ncase "$1" in -c|util/pytest_shards.py) exec "$REAL_PYTHON" "$@";; '
                             'util/cap_file_size.py) shift; exec "$@";; esac\n'
                             'echo run >> "$RUNS"\n'
                             '[ "$(wc -l < "$RUNS")" -eq 1 ] && exit 1\nexit 0\n', encoding='utf-8')
@@ -112,9 +112,15 @@ class TestTheTimingsAreUploaded(unittest.TestCase):
     def test_the_upload_takes_each_runs_junit_file(self) -> None:
         upload = next(entry for entry in job(*JOB)['steps'] if entry.get('name') == 'Upload test timings')
         self.assertEqual(upload['with']['path'], '${{ runner.temp }}/junit*.xml')
-        for shard in SHARDS:
+        runs = run_step_each(pypy_leg())
+        for shard, run in zip(SHARDS, runs):
             with self.subTest(shard=shard):
-                self.assertIn(f'--junitxml="$RUNNER_TEMP/junit-${{shard//\\//-}}.xml" "$shard"', step()['run'])
+                self.assertIn(f'--junitxml={RUNNER_TEMP}/junit-{shard.replace("/", "-")}.xml', run)
+
+    def test_the_shards_run_through_the_graalpy_script(self) -> None:
+        """#2005 reuses #1963's util/pytest_shards.py, on the leg's interpreter, under the one file-size cap."""
+        self.assertIn('python util/cap_file_size.py python util/pytest_shards.py "$SHARDS" -- '
+                      'python -m pytest "$@"', step()['run'])
 
 
 class TestTheDocsSayIt(unittest.TestCase):
 
@@ -79,8 +79,10 @@
 #: no real interpreter: under the coverage leg one would be measured, be logged as a
 #: second ``coverage run --rcfile`` controller, and exec before saving, which fails the
 #: #1387 guard (#1969). A PyPy leg runs pytest more than once (#2005), so each run is
-#: recorded rather than the last.
-STUB = ('#!/bin/sh\ncase "$1" in -c) exec "$REAL_PYTHON" "$@";; util/cap_file_size.py) shift; exec "$@";; esac\n'
+#: recorded rather than the last, and util/pytest_shards.py, which starts them there,
+#: runs on the real one too.
+STUB = ('#!/bin/sh\ncase "$1" in -c|util/pytest_shards.py) exec "$REAL_PYTHON" "$@";; '
+        'util/cap_file_size.py) shift; exec "$@";; esac\n'
         'printf \'%s\\n\' "$@" \'<end>\' >> "$ARGS_FILE"\n')
 #: The line :data:`STUB` writes after each run's arguments.
 END = '<end>'
@@ -172,8 +174,9 @@ def shards(leg: 'dict[str, Any]') -> 'list[str]':
 def unsharded(leg: 'dict[str, Any]', runs: 'list[list[str]]') -> 'list[str]':
     """The arguments each of the ``test`` step's runs on ``leg`` shares, once each run's own are taken off.
 
-    #2005: a run per directory :func:`shards` names adds its JUnit file and the
-    directory, and the last run an ``--ignore`` of each.
+    #2005: util/pytest_shards.py's run per directory :func:`shards` names adds its JUnit
+    file, an ``--ignore`` of each earlier shard, and the directory, and the last run an
+    ``--ignore`` of each.
 
     """
     named = shards(leg)
@@ -183,8 +186,8 @@ def unsharded(leg: 'dict[str, Any]', runs: 'list[list[str]]') -> 'list[str]':
     common = runs[-1][:len(runs[-1]) - len(rest)]
     if runs[-1][len(common):] != rest:
         raise AssertionError(f'the last run on {leg} does not end by ignoring {named}: {runs[-1]}')
-    for shard, run in zip(named, runs):
-        own = [f'--junitxml={RUNNER_TEMP}/junit-{shard.replace("/", "-")}.xml', shard]
+    for index, (shard, run) in enumerate(zip(named, runs)):
+        own = [f'--junitxml={RUNNER_TEMP}/junit-{shard.replace("/", "-")}.xml', *rest[:index], shard]
         if run != common + own:
             raise AssertionError(f'the {shard} run on {leg} is not the others\' arguments and {own}: {run}')
     return common
 
@@ -9,6 +9,9 @@
 
     /usr/bin/python3 util/pytest_shards.py "$SHARDS" -- python -m pytest ...
 
+unit-tests.yml's ``Run unit tests`` runs it the same way on PyPy's legs, whose
+xdist workers' RSS grows with every test as well (#2005).
+
 ``SHARDS`` holds the shards, separated by whitespace, and each is a directory or
 a glob of the entries of one directory, such as ``tests/corekit/test_i*``.
 The command runs once per shard, then once more over the rest, and each run