diff --git a/Makefile b/Makefile
index 468bf99..5b91dfd 100644
--- a/Makefile
+++ b/Makefile
@@ -31,9 +31,38 @@ setup: ## Create the venv, install the test extra, and prove it actually works
 	$(VENV)/bin/python -m pytest tests/ --collect-only -q
 
 .PHONY: test
-test: ## Run the test suite
+test: ## Run the test suite — hermetic, no live services (D-26)
 	@test -x $(VENV)/bin/python || { echo "FAIL — no venv in this tree; run: make setup"; exit 69; }
-	$(VENV)/bin/python -m pytest tests/
+	# Integration tests are deselected here, not skipped by accident. Twelve
+	# tests in test_database_integration.py carry @pytest.mark.integration and
+	# need a real Postgres; they errored on every run of this target because
+	# nothing deselected them, and the marker had no target to select it either.
+	# So they neither passed nor ran — they just made `make test` exit 2 forever,
+	# which trains a reader to ignore the exit code (T-55).
+	#
+	# They were invisible to the netns audit that found the rest of this: they
+	# fail identically with and without a network, because postgres-shared is a
+	# Docker-internal name a host process cannot resolve in either case. A
+	# namespace proves a test does not reach the network; it cannot tell that
+	# apart from a test whose dependency is unreachable anyway.
+	$(VENV)/bin/python -m pytest tests/ -m "not integration"
+
+.PHONY: test-integration
+test-integration: ## Run only the tests that need live Postgres/Redis
+	@test -x $(VENV)/bin/python || { echo "FAIL — no venv in this tree; run: make setup"; exit 69; }
+	# Refuses an empty selection. A target that passes because it selected
+	# nothing is the defect this repo keeps meeting from the other side, so
+	# pytest's exit 5 (no tests collected) is a failure with its own message,
+	# and a collection error gets a different one — "nothing to run" must never
+	# read as "everything passed" (D-24).
+	@$(VENV)/bin/python -m pytest tests/ -m integration --collect-only -q >/dev/null 2>&1; \
+	 rc=$$?; \
+	 if [ $$rc -eq 5 ]; then \
+	   echo "FAIL test-integration — selected 0 tests (marker renamed, moved, or lost — this is a defect, not a pass)"; exit 1; \
+	 elif [ $$rc -ne 0 ]; then \
+	   echo "FAIL test-integration — collection errored (rc=$$rc)"; exit 1; \
+	 fi
+	$(VENV)/bin/python -m pytest tests/ -m integration -v
 
 # No `lint` target, deliberately. CLAUDE.md states it outright: no linter is
 # configured, no ruff or flake8 config, neither in the dependencies. Per D-27