Drive the archive reopen debounce test from a clock (closes #190)

The archive writer now reads the time its reopen debounce is
measured on from a clock field, time.Now outside tests. The
debounce test moves that clock instead of sleeping past a real
2 second window, so a slow host between the two quick writes can
no longer turn a correct result red.

Model: opus-5-5

internal/delivery/export_test.go

@@ -512,6 +512,12 @@ func (e *ExportArchiveWriter) Reopen(
 	return e.w.reopen(expiry)
 }
 
+// SetNow replaces the clock the writer measures its reopen
+// debounce on.
+func (e *ExportArchiveWriter) SetNow(now func() time.Time) {
+	e.w.now = now
+}
+
 // Reopens reports how many times the file has been opened.
 func (e *ExportArchiveWriter) Reopens() int {
 	return e.w.reopens

internal/delivery/target_database_archive.go

@@ -194,6 +194,10 @@ type archiveWriter struct {
 	lastReopen time.Time
 	reopens    int
 
+	// now is the clock the reopen debounce is measured on. It is
+	// time.Now outside tests.
+	now func() time.Time
+
 	// evicted marks a writer that has been removed from the
 	// registry. Its handle is closed and it must never open the
 	// file again: nothing holds it any more, so a reopen would
@@ -228,6 +232,7 @@ func newArchiveWriter(
 		path:     path,
 		log:      log,
 		debounce: archiveReopenDebounce,
+		now:      time.Now,
 	}
 }
 
@@ -263,7 +268,7 @@ func (w *archiveWriter) write(
 		)
 	}
 
-	if time.Since(w.lastReopen) >= w.debounce {
+	if w.now().Sub(w.lastReopen) >= w.debounce {
 		return w.reopen(expiry)
 	}
 
@@ -323,7 +328,7 @@ func (w *archiveWriter) openMode(
 	}
 
 	w.db = gdb
-	w.lastReopen = time.Now()
+	w.lastReopen = w.now()
 	w.reopens++
 
 	if expiry > 0 {

internal/delivery/target_database_test.go

@@ -184,13 +184,20 @@ func TestArchiveWriter_RecreatesAfterRemoval(
 func TestArchiveWriter_ReopenDebounce(t *testing.T) {
 	t.Parallel()
 
-	// A generous debounce keeps the two rapid writes inside
-	// the window even on a heavily loaded test machine.
+	const debounce = 2 * time.Second
+
 	path := filepath.Join(t.TempDir(), "archive-wh.db")
 	w := delivery.NewExportArchiveWriter(
-		path, archiveTestLogger(), 2*time.Second,
+		path, archiveTestLogger(), debounce,
 	)
 
+	// The writer reads the time from this clock, which only the
+	// test moves, so how long the host takes between writes
+	// cannot change the result.
+	now := time.Now()
+
+	w.SetNow(func() time.Time { return now })
+
 	require.NoError(t, w.Write(
 		delivery.ExportArchivedEvent{EventID: "a"}, 0,
 	))
@@ -202,7 +209,7 @@ func TestArchiveWriter_ReopenDebounce(t *testing.T) {
 	// initial open — no extra close/reopen.
 	assert.Equal(t, 1, w.Reopens())
 
-	time.Sleep(2100 * time.Millisecond)
+	now = now.Add(debounce)
 
 	require.NoError(t, w.Write(
 		delivery.ExportArchivedEvent{EventID: "c"}, 0,

internal/handlers/handlers_test.go

@@ -181,6 +181,11 @@ func (r *recordingArchives) Renames() []archiveRename {
 	return out
 }
 
+// newTestApp returns an app whose RequireStart fails the test when
+// starting takes longer than fx's default start timeout of 15s. That
+// limit catches a start that hangs, not a busy host: measured with make
+// test on 2026-10-02 at host load 58-69 on 48 cores, the slowest of this
+// package's starts took 0.49s.
 func newTestApp(
 	t *testing.T,
 	targets ...any,

script/test

@@ -2,9 +2,10 @@
 # script/test: run the test suite.
 #
 # -timeout is applied by `go test` per package, not to the run as a whole, so
-# it only has to clear the slowest single package. That is internal/handlers,
-# measured in a cache-defeated builder stage on the 48-core shared build host
-# (2026-08-18); load- and host-dependent, not invariants:
+# it only has to clear the slowest single package. When this budget was set
+# that was internal/handlers, measured in a cache-defeated builder stage on the
+# 48-core shared build host (2026-08-18); load- and host-dependent, not
+# invariants:
 #
 #   16.9s                  host load 5-20, GOMAXPROCS 48
 #   45.9s / 47.3s / 49.0s  three runs at deliberate host load 31-73
@@ -23,6 +24,11 @@
 # a condition CI runs under. If a CPU-limited runner ever puts a real run near
 # 67s, that is the datum to revisit the org figure with.
 #
+# Those figures predate tests hashing the admin password at 1 MB instead of
+# 64 MB (https://git.eeqj.de/sneak/webhooker/pulls/404). After that change, in
+# a cache-defeated build at host load 44-109 (2026-10-02), internal/handlers
+# took 8.5s and the slowest package was internal/database at 15.8s.
+#
 # -p 4 -parallel 8 keep the run under 2 GB of memory: at most four test
 # binaries build or run at once, each with at most eight parallel tests. Under
 # -race every test binary and every link costs a few hundred MB, so the