Vlk may have an exact info… I think it’s caused by the fact that the scanning has to be done asynchronously in this case - the platform doesn’t offer better possibilities.

Scanning “on open” works this way… but scanning “on write” is different. I rather consider it as a notification in case of spreading through open shares, etc

For scanning “on write”, no. For the other “types” of resident protection, yes (just that it doesn’t block ALL activity, but only the call accessing the file).