finish-f1: Checks: Syntax and diff checks pass. Runtime suites remain u…

ddiff --git a/test/run.js b/test/run.js
iindex 5bbeab86..67a1df1e 100644
---- a/test/run.js
++++ b/test/run.js
@@@ -1,7 +1,7 @@
  #!/usr/bin/env node
  /**
-- * Runs every test in test/ — the files named *.test.js — one at a time, each in its own process, and fails if
-- * any of them fails (openvibe-shared/test-runner).
++ * Runs every test in test/ — the files named *.test.js — each in its own process, and fails if any
++ * of them fails (openvibe-shared/test-runner). PostgreSQL runs two at a time to fit the suite deadline.
   *
   *   npm test                   # everything
   *   npm test -- usernames follows   # only files whose name contains one of the words
@@@ -15,4 +15,4 @@
  const { pathToFileURL } = require('url');
  // Every test process starts with a migrated database of its own (test/helpers/pg-preload.mjs; plan T2, ADR-035).
  const preload = pathToFileURL(require('path').join(__dirname, 'helpers', 'pg-preload.mjs')).href;
--require('openvibe-shared/test-runner').main({ dir: __dirname, timeoutMs: 300000, pad: 40, parallel: 1, hide: /^\[DB\] /, nodeArgs: ['--import', preload] });
++require('openvibe-shared/test-runner').main({ dir: __dirname, timeoutMs: 300000, pad: 40, parallel: process.env.NETWORK_TEST_STORE === 'pg' ? 2 : 1, hide: /^\[DB\] /, nodeArgs: ['--import', preload] });
ddiff --git a/test/security-idor.test.js b/test/security-idor.test.js
iindex 9048d27c..ff34809d 100644
---- a/test/security-idor.test.js
++++ b/test/security-idor.test.js
@@@ -152,6 +152,7 @@ const out = (...a) => process.stdout.write(a.join(' ') + '\n');
          assert.ok(!await db.prepare('SELECT id FROM user_history WHERE id = ?').get(hist.id));
          await ok('alice', 'DELETE', `/api/auth/sessions/${session.id}`);
          assert.strictEqual((await db.prepare('SELECT is_active FROM user_sessions WHERE id = ?').get(session.id)).is_active, 0);
++        await ok('bob', 'PUT', '/api/auth/profile', { id: users.alice.id, user_id: users.alice.id, username: 'alice', bio: 'bob-was-here' });
          assert.strictEqual((await db.prepare('SELECT bio FROM users WHERE id = ?').get(users.bob.id)).bio, 'bob-was-here', 'the ids in the body were ignored: bob edited his own profile');
  
          // ── Service principals outside their own app ───────────────────
ddiff --git a/test/shutdown.test.js b/test/shutdown.test.js
iindex 7e4b4598..b9f2cfa5 100644
---- a/test/shutdown.test.js
++++ b/test/shutdown.test.js
@@@ -27,7 +27,8 @@ const freePort = () => new Promise((resolve) => { const s = net.createServer();
      const exited = new Promise((r) => child.on('exit', (code, signal) => r({ code, signal })));
      try {
          let up = false;
--        for (let i = 0; i < 100 && !up; i++) {
++        const startupDeadline = Date.now() + 60000;
++        while (!up && Date.now() < startupDeadline) {
              up = await fetch(`http://127.0.0.1:${port}/api/health`).then((r) => r.ok).catch(() => false);
              if (!up) await new Promise((r) => setTimeout(r, 100));
          }