Does Azure provide a verifiable dataplane egress fence-completion guarantee for existing TCP/TLS connections

We are evaluating a security-sensitive active/standby gateway architecture on Microsoft Azure.

Before activating a replacement gateway, we must establish that an old gateway cannot transmit any additional bytes beyond a defined terminal network boundary after a positive fencing acknowledgement.

Our requirement includes:

Already established TCP/TLS connections and pending encrypted traffic.

Queued packets in the VM networking stack, virtual NIC, Azure SDN, load balancer and downstream buffers.

All relevant IPv4/IPv6 egress paths.

Persistent enforcement after VM restart, reconnect or network partition.

A verifiable completion acknowledgement produced independently of the old gateway.

We understand that Azure NSG flushConnection can trigger flow re-evaluation, while Azure Load Balancer Admin State Down can preserve established TCP connections.

Our question is whether any currently supported Azure Networking/Compute service or API provides the stronger, versioned fence-completion guarantee described above.

If such a mechanism exists, please identify the exact service, API version, supported configuration, dataplane completion semantics, failure behavior and independent verification method.

If Azure does not provide this guarantee, or if it is not formally documented, please confirm that explicitly.

We would appreciate escalation to Azure Networking/Compute engineering for a written, technically sourced answer. We are seeking architecture feasibility clarification, not reporting a live production incident.