These are illustrations of what a signed-receipt record looks like, not OS-level interception. Every scenario below shows the EIP-712 receipt chain Anima v1.0 produces when consulted by an upstream policy chokepoint (an EDR adapter, a zone-conduit, an agent gateway, a benefits-issuance terminal). Words like "blocked" / "quarantined" inside the demo data describe the decision the receipt records, signed at T2, sealed at T3 — not a kernel-level syscall, file-write, or network-write interception by Anima itself. v1.0 does not own the chokepoint; it owns the receipt. See docs/secops/RELEASE_v1.0_SCOPE_CLARIFICATION.md.