Supported continuity of exact-target native WFP blocking across BFE failures

We seek an initial clarification of supported Windows platform semantics, not certification of a deployed application. No exact deployment is asserted; guest build and provider configuration remain unselected.

The proposed mechanism uses committed persistent native FWP_ACTION_BLOCK filters at FWPM_LAYER_ALE_AUTH_CONNECT_V4 and FWPM_LAYER_ALE_AUTH_CONNECT_V6, matching FWPM_CONDITION_ALE_APP_ID AND FWPM_CONDITION_ALE_PACKAGE_ID. Required direct-process coverage includes application-originated loopback. Protection must remain effective from before application execution until all relevant execution and initiated asynchronous/delegated activity is independently quiescent.

Does Windows provide a supported guarantee of uninterrupted effective exact-target denial after the provisioning process exits and throughout planned BFE stop, the stopped interval, restart, abrupt BFE failure, delayed or absent recovery, and provider reactivation? Please distinguish stored persistence, management enumeration, activation and actual effective enforcement. Address new and pending connections and existing ALE state, including inbound-origin flows carrying outbound traffic, and identify any enforcement gap or traffic outside these layers.

Please reconcile the provider-without-serviceName startup behavior described by Object Management with the disabled-state descriptions in FWPM_PROVIDER0 and FWPM_FILTER0. Distinguish no associated provider, provider without a service name, and services configured for automatic or nonautomatic startup.

Identify supported Windows versions/builds, necessary exact-target, activation/arbitration and ownership prerequisites, exceptions, and authoritative documentation or attributable Windows engineering clarification. We do not assume delegated DNS Client traffic retains the originating application/package identity; identify any relevant limitation. Broad SYSTEM/shared-service filtering, AppContainer loopback exemptions, reactive termination, finite tests and outer isolation cannot substitute for this guarantee. The proposed environment has no NIC or live external-controller dependency.

If no applicable guarantee exists, please state that explicitly. If an answer depends on configuration, identify only the minimum additional fields needed to answer this initial question. Distinguish any boot-time handoff guarantee from runtime BFE-failure behavior.