arr_sync.sh had acquire_lock documented in OPERATIONAL SAFEGUARDS header but the call was never present in the code — two sync instances could run simultaneously. bulk_permissions_repair.sh and container_data_export.sh had no lock at all. All three are now consistent with every other script in Media/ and Tools/.