diff --git a/internal/handlers/handlers_test.go b/internal/handlers/handlers_test.go
index 7d11279..b31f19b 100644
--- a/internal/handlers/handlers_test.go
+++ b/internal/handlers/handlers_test.go
@@ -78,6 +78,11 @@ func (r *recordingEvictor) Evicted() []string {
 	return out
 }
 
+// newTestApp builds the handlers with their real dependencies. Its
+// RequireStart fails the test when starting takes longer than fx's
+// default start timeout of 15s. That limit catches a start that hangs,
+// not a busy host: measured with make test on 2026-10-02 at host load
+// 58-69 on 48 cores, the slowest of this package's starts took 0.49s.
 func newTestApp(
 	t *testing.T,
 	targets ...any,
diff --git a/script/test b/script/test
index 9095510..5aa6d49 100755
--- a/script/test
+++ b/script/test
@@ -2,9 +2,10 @@
 # script/test: run the test suite.
 #
 # -timeout is applied by `go test` per package, not to the run as a whole, so
-# it only has to clear the slowest single package. That is internal/handlers,
-# measured in a cache-defeated builder stage on the 48-core shared build host
-# (2026-08-18); load- and host-dependent, not invariants:
+# it only has to clear the slowest single package. When this budget was set
+# that was internal/handlers, measured in a cache-defeated builder stage on the
+# 48-core shared build host (2026-08-18); load- and host-dependent, not
+# invariants:
 #
 #   16.9s                  host load 5-20, GOMAXPROCS 48
 #   45.9s / 47.3s / 49.0s  three runs at deliberate host load 31-73
@@ -23,6 +24,11 @@
 # a condition CI runs under. If a CPU-limited runner ever puts a real run near
 # 67s, that is the datum to revisit the org figure with.
 #
+# Those figures predate tests hashing the admin password at 1 MB instead of
+# 64 MB (https://git.eeqj.de/sneak/webhooker/pulls/404). After that change, in
+# a cache-defeated build at host load 44-109 (2026-10-02), internal/handlers
+# took 8.5s and the slowest package was internal/database at 15.8s.
+#
 # -p 4 -parallel 8 keep the run under 2 GB of memory: at most four test
 # binaries build or run at once, each with at most eight parallel tests. Under
 # -race every test binary and every link costs a few hundred MB, so the