Fix the usage example, which called a tool that does not exist

README.md

@@ -94,8 +94,29 @@ confirmation prompt is a cheaper failure than an unwanted side effect.
 from interlock.model import load_shield
 
 shield = load_shield("artifacts")
-verdict = shield.check("archive the Q3 notes", {"tool": "fs.delete_file", "arguments": {"path": "notes/"}})
-print(verdict.decision, verdict.deviation)
+# The request names one file. The call names the directory that contains it.
+verdict = shield.check(
+    "Archive the Q3 notes at /work/apollo/q3-notes.md",
+    {"tool": "fs.delete_path", "arguments": {"path": "/work/apollo", "recursive": True}},
+)
+print(verdict.decision, verdict.deviation)   # block scope_expansion
+for reason in verdict.reasons:
+    print(" -", reason)
+```
+
+Nothing about that call reads as dangerous on its own: it is an ordinary delete,
+on an ordinary path, in the project the user named. It is wrong only relative to
+the request, which is the only place the difference exists.
+
+A tool the model has never seen still gets a verdict rather than an exception,
+because an agent can propose anything:
+
+```python
+verdict = shield.check(
+    "Rotate the API key for the billing service",
+    {"tool": "acme.rotate_key", "arguments": {"service": "billing"}},
+)
+print(verdict.decision, verdict.known_tool)   # confirm False
 ```
 
 It is not a content moderation model, not a prompt-injection detector, and not
@@ -137,4 +158,4 @@ a substitute for sandboxing or for asking the user.
 | `interlock-linear.gguf` | tier-1 weight container, not a runtime |
 | `latency.json` | measured per-call latency and peak RSS |
 
-Card generated 2026-08-30T01:25:20+00:00 for `NagaYu/interlock`.
+Card generated 2026-08-30T01:30:45+00:00 for `NagaYu/interlock`.