finish-f1: Changed: test/perf-budget.test.js (startup wait 10 s → 60…

ddiff --git a/test/perf-budget.test.js b/test/perf-budget.test.js
iindex 9e59cc05..ace47b64 100644
---- a/test/perf-budget.test.js
++++ b/test/perf-budget.test.js
@@@ -35,7 +35,8 @@ const freePort = () => new Promise((resolve) => { const s = net.createServer();
      const base = `http://127.0.0.1:${port}`;
      try {
          let up = false;
--        for (let i = 0; i < 100 && !up; i++) {
++        const startupDeadline = Date.now() + 60000;   // a fresh PGlite database takes well over 10 s to migrate and seed
++        while (!up && Date.now() < startupDeadline) {
              up = await fetch(`${base}/api/health`).then((r) => r.ok).catch(() => false);
              if (!up) await new Promise((r) => setTimeout(r, 100));
          }
ddiff --git a/test/security-idor.test.js b/test/security-idor.test.js
iindex ff34809d..9c4dbc47 100644
---- a/test/security-idor.test.js
++++ b/test/security-idor.test.js
@@@ -26,7 +26,9 @@ const out = (...a) => process.stdout.write(a.join(' ') + '\n');
          const { users, dev, db } = w;
          const PA = dev.PA.id; const AA = dev.PA.app; const PB = dev.PB.id; const AB = dev.PB.app;
          const DEV_TABLES = ['dev_projects', 'dev_project_members', 'dev_apps', 'dev_credentials', 'dev_grants', 'dev_quotas'];
--        const snap = async (tables, where = {}) => JSON.stringify((await Promise.all(tables.map(async (t) => await db.prepare(`SELECT * FROM "${t}" ${where[t] || ''}`).all()))));
++        // is_emailed is the email queue's (every 2 minutes, server/index.js), not any request's: a run that outlasts
++        // 2 minutes under load would otherwise blame whichever call was in flight when the queue marked a row.
++        const snap = async (tables, where = {}) => JSON.stringify((await Promise.all(tables.map(async (t) => (await db.prepare(`SELECT * FROM "${t}" ${where[t] || ''}`).all()).map(({ is_emailed, ...row }) => row)))));
          const secretNeedles = { ...w.secrets };
          const refused = [];
          const expectRefused = async (who, method, p, body, { tables, where, codes = [401, 403, 404] } = {}) => {