Commit 91f8fd9f3 on origin/main established that tests using real external processes belong in operator validation, not unit CI, adding the `integration` marker and `PYTEST_UNIT_ARGS := -m "not integration and not performance"` to `make test` / `test-cov` / `coverage`; 2cf9e9585 then pointed `make ci` at `make test`. The health-lane branch predates that policy, so its two cross-process Oura lock proofs arrived unmarked and would have run inside the unit gate — precisely the class of probe the policy exiles. 704d53bb9 shows the repo actively rewriting tests away from real-process mechanics, so leaving them unmarked would regress a live policy. Marking them `integration` alone, however, would leave `make ci` with no exclusion proof at all, while the scope requires exclusion be demonstrated with distinct processes *or file descriptors* — not only threads. So both subprocess probes are marked `integration` (they still run under `make test-integration`), and the exclusion proof is retained inside the unit gate by two in-process tests that use distinct file descriptors. This is sound because hold_lock uses fcntl.flock(LOCK_EX | LOCK_NB), which is per open-file description: two separate open() calls genuinely exclude one another within a single process, so this is a real exclusion proof and not a thread simulation. test_private_import_lock_excludes_distinct_fds_in_one_process pins that per-open-file-description semantics directly, and fails loudly if the primitive is ever swapped for POSIX per-process record locking, under which a second descriptor would silently succeed and invalidate the proof. test_oura_sync_lock_timeout_with_same_process_distinct_fd drives save-mode sync against a held lock and asserts the structured OuraSyncLockError names the journal, lock path, and timeout, leaks no token, request URL, or health payload, performs no fetch, and writes no bundle, raw, normalized, dedupe, manifest, or cursor state.