@@ -87,11 +87,16 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
 
-// FILE_SHARDED_PACKAGES and SLICE_ENV are read only inside functions: this
-// import is circular (the partitioner imports samplesFromSummary from here), so
-// a top-level read would meet an uninitialised binding when the partitioner is
-// the entry point.
-import { countTestFiles, FILE_SHARDED_PACKAGES, SLICE_ENV } from './partition-test-shards.mjs';
+// FILE_SHARDED_PACKAGES, PREVIOUS_FILE_SHARDED_PACKAGES and SLICE_ENV are read
+// only inside functions: this import is circular (the partitioner imports
+// samplesFromSummary from here), so a top-level read would meet an
+// uninitialised binding when the partitioner is the entry point.
+import {
+  countTestFiles,
+  FILE_SHARDED_PACKAGES,
+  PREVIOUS_FILE_SHARDED_PACKAGES,
+  SLICE_ENV,
+} from './partition-test-shards.mjs';
 import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -159,23 +164,34 @@ export function sliceOfCliArguments(args) {
 // `OS_TEST_SHARD=` with nothing after it when the value is empty.
 //
 // So the digest is matched against every slice the partitioner CAN emit for
-// that package, and nothing else: `k/n` for 1 <= k <= n, where n is
-// FILE_SHARDED_PACKAGES[package] from partition-test-shards.mjs. The bound is
-// that map -- n candidates for a package it slices, none for one it does not.
+// that package, or emitted under the map it replaced, and nothing else: `k/n`
+// for 1 <= k <= n, for n = FILE_SHARDED_PACKAGES[package] and n =
+// PREVIOUS_FILE_SHARDED_PACKAGES[package] from partition-test-shards.mjs. The
+// bound is those two closed maps -- n candidates per map that slices the
+// package, none for one that does not. The previous map is what lets a run
+// made before a map change still be read (its header says why it exists and
+// when it decodes nothing); a decoded slice is then summed within its run, so
+// an incomplete set still contributes nothing.
 //
 // ⛔ A digest that matches no candidate is REFUSED, never read as a whole
 // package. That is the #16173 direction exactly: one slice's window recorded as
 // the package's whole cost, a number that reads right and is n times too small.
-// It happens when FILE_SHARDED_PACKAGES changed since the run that wrote the
-// summary, or when the variable was set by hand to a slice the partitioner does
-// not emit; either way the remedy is a summary from a run under the current map.
+// It happens when the map changed twice within a summary's lifetime, or when
+// the variable was set by hand to a slice the partitioner does not emit; either
+// way the remedy is a summary from a run under the current map.
 //
 // An empty value is not a slice: the package's vitest config hands vitest an
 // empty `shard`, which it ignores, and the package runs whole. A task with no
 // `environmentVariables` record at all carries no evidence either way and is
 // read as carrying no env slice -- turbo 2.10.10 writes one on every task, and
 // the self-test fixtures predate it.
-export function sliceOfEnvironment(environmentVariables, name, label, sliced = FILE_SHARDED_PACKAGES) {
+export function sliceOfEnvironment(
+  environmentVariables,
+  name,
+  label,
+  sliced = FILE_SHARDED_PACKAGES,
+  previous = PREVIOUS_FILE_SHARDED_PACKAGES
+) {
   const configured = environmentVariables?.configured;
   if (configured === undefined || configured === null) return null;
   if (!Array.isArray(configured)) {
@@ -186,28 +202,35 @@ export function sliceOfEnvironment(environmentVariables, name, label, sliced = F
   if (entry === undefined) return null;
   const digest = entry.slice(prefix.length);
   if (digest === '') return null;
-  const count = Object.hasOwn(sliced, name) ? sliced[name] : 1;
+  const counts = [];
+  for (const map of [sliced, previous]) {
+    const n = Object.hasOwn(map, name) ? map[name] : 1;
+    if (n > 1 && !counts.includes(n)) counts.push(n);
+  }
   const candidates = [];
-  for (let index = 1; count > 1 && index <= count; index++) {
-    const spec = `${index}/${count}`;
-    if (createHash('sha256').update(spec).digest('hex') === digest) return { index, count };
-    candidates.push(spec);
+  for (const count of counts) {
+    for (let index = 1; index <= count; index++) {
+      const spec = `${index}/${count}`;
+      if (createHash('sha256').update(spec).digest('hex') === digest) return { index, count };
+      candidates.push(spec);
+    }
   }
   throw new Error(
     `${label}: ${name} ran with ${SLICE_ENV} set (digest ${digest.slice(0, 16)}…), and that digest ` +
-      `matches no slice the partitioner can emit for it (${candidates.length ? candidates.join(', ') : 'none: FILE_SHARDED_PACKAGES does not slice it'}). ` +
+      'matches no slice the partitioner can emit for it, or emitted under the map it replaced ' +
+      `(${candidates.length ? candidates.join(', ') : 'none: neither FILE_SHARDED_PACKAGES nor PREVIOUS_FILE_SHARDED_PACKAGES slices it'}). ` +
       'Refusing to read the window as a whole-package sample: it is one slice of the suite, and ' +
-      'recording it as the whole cost is the #16173 defect. If FILE_SHARDED_PACKAGES changed since ' +
-      'this run, refresh from a run made under the current map.'
+      'recording it as the whole cost is the #16173 defect. If FILE_SHARDED_PACKAGES changed more ' +
+      'than once since this run, refresh from a run made under the current map.'
   );
 }
 
 // The slice one measured leg ran as, from either carrier. Both present and
 // disagreeing is not a reading to pick from: vitest would have run the CLI's,
 // but no workflow here sets both, so it is refused rather than resolved.
-function sliceOfLeg(leg, name, label, sliced) {
+function sliceOfLeg(leg, name, label, sliced, previous) {
   const fromArgs = sliceOfCliArguments(leg.cliArguments);
-  const fromEnv = sliceOfEnvironment(leg.environmentVariables, name, label, sliced);
+  const fromEnv = sliceOfEnvironment(leg.environmentVariables, name, label, sliced, previous);
   if (fromArgs && fromEnv && (fromArgs.index !== fromEnv.index || fromArgs.count !== fromEnv.count)) {
     throw new Error(
       `${label}: ${name} carries two different slices -- --shard=${fromArgs.index}/${fromArgs.count} ` +
@@ -249,7 +272,12 @@ const SAMPLED_TASKS = ['test', 'test:repo'];
 // Recording one leg's seconds alone (because the other was cached or failed)
 // would write a partial suite's cost as the package's whole cost, a reading
 // worse than today's undercount by #16466's own defect this card fixes.
-export function samplesFromSummary(parsed, label, sliced = FILE_SHARDED_PACKAGES) {
+export function samplesFromSummary(
+  parsed,
+  label,
+  sliced = FILE_SHARDED_PACKAGES,
+  previous = PREVIOUS_FILE_SHARDED_PACKAGES
+) {
   const tasks = parsed?.tasks;
   if (!Array.isArray(tasks)) {
     throw new Error(
@@ -312,7 +340,7 @@ export function samplesFromSummary(parsed, label, sliced = FILE_SHARDED_PACKAGES
       seconds += leg.seconds;
       // A passthrough slice (`cliArguments`, the nightly tiers) or an
       // `OS_TEST_SHARD` one (Test Core, #19278) -- see sliceOfEnvironment().
-      slice ??= sliceOfLeg(leg, name, label, sliced);
+      slice ??= sliceOfLeg(leg, name, label, sliced, previous);
     }
     samples.set(name, seconds);
     if (slice) slices.set(name, slice);
@@ -558,7 +586,7 @@ export function buildDataset({ perSummary, fileCounts, provenance, carryFrom = n
 // remedy is to find what stopped registering, never to lower the number.
 const SELF_TEST_BATTERIES = Object.freeze({
   'measure-test-shard-timings self-test': 56,
-  'env-carried slices (#19278)': 10,
+  'env-carried slices (#19278)': 11,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
@@ -1155,7 +1183,7 @@ function selfTest() {
   // carrier, an empty value, an unrelated variable -- and pin what the digest
   // path must NOT read. Each case was ablated against the code it pins.
   // `sliced` stands in for FILE_SHARDED_PACKAGES so the fixtures keep the short
-  // names above, and one case reads the REAL map.
+  // names above; one case reads the REAL maps, and one crosses a map change.
   battery('env-carried slices (#19278)');
   const digestOf = (value) => createHash('sha256').update(value).digest('hex');
   const envTask = (pkg, start, end, value, extra = {}) => ({
@@ -1180,34 +1208,73 @@ function selfTest() {
     if (r.samples.get('cli') !== 118.073) throw new Error('env slice: the slice window was not kept as the sample');
   });
   check(() => {
-    // The REAL map, a real package name, a digest of the form turbo writes:
-    // the default `sliced` IS the partitioner's live map. Written for either
-    // state the partitioner's slice-count pin can leave that map in -- a live
-    // entry must resolve its own last slice, and an EMPTY map must refuse a
-    // slice digest on the CLI naming the empty map -- so it reds when the
-    // default stops being the live map, whichever state that is.
-    const live = Object.entries(FILE_SHARDED_PACKAGES);
-    if (live.length > 0) {
-      const [name, n] = live[0];
-      const r = samplesFromSummary(summary([envTask(name, 0, 1000, `${n}/${n}`)]), 'f');
-      const s = r.slices.get(name);
+    // The REAL maps, a real package name, digests of the form turbo writes: the
+    // defaults ARE the partitioner's live FILE_SHARDED_PACKAGES and
+    // PREVIOUS_FILE_SHARDED_PACKAGES. Written for whatever state those maps are
+    // in -- every count either names for the CLI must decode its own last
+    // slice, and a count neither names must be refused listing exactly their
+    // candidates -- so it reds when a default stops being its live map.
+    const name = '@objectstack/cli';
+    const counts = [];
+    for (const map of [FILE_SHARDED_PACKAGES, PREVIOUS_FILE_SHARDED_PACKAGES]) {
+      const n = Object.hasOwn(map, name) ? map[name] : 1;
+      if (n > 1 && !counts.includes(n)) counts.push(n);
+    }
+    for (const n of counts) {
+      const s = samplesFromSummary(summary([envTask(name, 0, 1000, `${n}/${n}`)]), 'f').slices.get(name);
       if (!s || s.index !== n || s.count !== n) {
-        throw new Error(`env slice: the live FILE_SHARDED_PACKAGES did not resolve ${name} ${n}/${n} (got ${JSON.stringify(s ?? null)})`);
-      }
-    } else {
-      let message = '';
-      try {
-        samplesFromSummary(summary([envTask('@objectstack/cli', 0, 1000, '1/2')]), 'f');
-      } catch (e) {
-        message = e.message;
-      }
-      if (!message.includes('FILE_SHARDED_PACKAGES does not slice it')) {
-        throw new Error(
-          'env slice: with the live FILE_SHARDED_PACKAGES empty, a CLI slice digest was not refused ' +
-            `naming the empty map (got ${JSON.stringify(message || 'no throw')})`
-        );
+        throw new Error(`env slice: the live maps did not resolve ${name} ${n}/${n} (got ${JSON.stringify(s ?? null)})`);
       }
     }
+    const stranger = Math.max(1, ...counts) + 1;
+    let message = '';
+    try {
+      samplesFromSummary(summary([envTask(name, 0, 1000, `1/${stranger}`)]), 'f');
+    } catch (e) {
+      message = e.message;
+    }
+    const listed =
+      counts.flatMap((n) => Array.from({ length: n }, (_, i) => `${i + 1}/${n}`)).join(', ') ||
+      'none: neither FILE_SHARDED_PACKAGES nor PREVIOUS_FILE_SHARDED_PACKAGES slices it';
+    if (!message.includes(`(${listed})`)) {
+      throw new Error(
+        `env slice: a ${name} digest of 1/${stranger}, a count neither live map names, was not refused ` +
+          `listing (${listed}) (got ${JSON.stringify(message || 'no throw')})`
+      );
+    }
+  });
+  check(() => {
+    // ACROSS A MAP CHANGE: a run made before it, under a map that cut `cli` in
+    // two, read by a generator whose current map slices nothing. Both halves
+    // decode against the previous map and are summed WITHIN the run to the
+    // whole cost -- the reading the refresh lane needs while every retained
+    // run predates the change -- and a count neither map names is still
+    // refused. Without the previous map both halves are refused and the run
+    // measures nothing.
+    const none = Object.freeze({});
+    const was2 = Object.freeze({ cli: 2 });
+    const legA = samplesFromSummary(summary([envTask('cli', 0, 300_000, '1/2')]), 'a', none, was2);
+    const legB = samplesFromSummary(summary([envTask('cli', 0, 433_330, '2/2')]), 'b', none, was2);
+    const set = buildDataset({
+      perSummary: [{ ...legA, run: 'r' }, { ...legB, run: 'r' }],
+      fileCounts: new Map([['cli', 300]]),
+      provenance: {},
+    });
+    if (set.packages.cli !== 733.33 || set.skippedIncompleteSlices.length !== 0) {
+      throw new Error(
+        `env slice: a pre-change run's two halves did not assemble to 733.33s (got ${set.packages.cli}; ` +
+          `incomplete ${JSON.stringify(set.skippedIncompleteSlices)})`
+      );
+    }
+    let message = '';
+    try {
+      samplesFromSummary(summary([envTask('cli', 0, 1000, '1/3')]), 'c', none, was2);
+    } catch (e) {
+      message = e.message;
+    }
+    if (!message.includes('(1/2, 2/2)')) {
+      throw new Error(`env slice: a digest neither map names was not refused (got ${JSON.stringify(message || 'no throw')})`);
+    }
   });
   check(() => {
     // The passthrough carrier is untouched: the nightly tiers still use it.
 
@@ -224,12 +224,38 @@ export const MAX_MEASURED_OVER_PREDICTED = 1.5;
 // holding each package's WHOLE cost, and the division by n happens here. That
 // is what keeps a refresh comparable across a change to this map, and it is why
 // measure-test-shard-timings.mjs has to reassemble a package's slices before it
-// records one -- see `sliceOfCliArguments` there. A change to this map also
-// retires the summaries written under the old one: the generator refuses an
-// `OS_TEST_SHARD` slice the map can no longer emit rather than read it as a
-// whole package, so a refresh after a change measures runs made after it.
+// records one -- see `sliceOfCliArguments` there. A change to this map is also
+// a change to what that generator can DECODE, which is why the map it replaced
+// is kept below.
 export const FILE_SHARDED_PACKAGES = Object.freeze({});
 
+// THE MAP AS IT STOOD BEFORE ITS LAST CHANGE, read only by the generator's
+// slice-digest matcher (measure-test-shard-timings.mjs `sliceOfEnvironment`).
+//
+// A run summary records a slice only as the sha256 of its `OS_TEST_SHARD`
+// value, and the matcher decodes that digest against the slices the
+// partitioner can emit, refusing the whole summary when nothing matches. So a
+// run made BEFORE a change to the map above -- slices the map no longer emits
+// -- is refused, and while every retained run predates the change, the
+// refresh lane can measure nothing at all. That is not hypothetical: on the
+// change that emptied the map, the lane's pull_request rehearsal (run
+// 37074888579) refused all ten eligible hourly runs on main and regenerated
+// nothing.
+//
+// With the outgoing map here, a pre-change slice decodes EXACTLY -- by hash
+// equality, against this closed map, never by guessing a count -- and is then
+// summed within its run like any slice, so a run that cannot assemble the
+// package still contributes nothing (`skippedIncompleteSlices`). A digest
+// matching neither map is refused as before.
+//
+// Set it to the OUTGOING map in the same PR that changes FILE_SHARDED_PACKAGES.
+// Its only readers are run summaries, which ci.yml keeps for one day
+// (`retention-days: 1` on `test-core-run-summary-*`), so a day after that PR
+// lands no retained summary predates the change and this map decodes nothing.
+export const PREVIOUS_FILE_SHARDED_PACKAGES = Object.freeze({
+  '@objectstack/cli': 2,
+});
+
 // The item grammar. A shard item is a package (`@objectstack/cli`) or a SLICE
 // of one (`@objectstack/cli 1/2`), and this pair of functions is the only place
 // that spelling is written or read -- ci.yml builds the turbo invocation from