Title: NEFilterDataProvider — fail-closed behaviour after provider crash or suspension

Title: NEFilterDataProvider — fail-closed behaviour after provider crash or suspension

I'm investigating the documented failure behaviour of NEFilterDataProvider on macOS.

For a content filter handling outbound socket flows:

1. If the data provider process crashes, is terminated, or disconnects unexpectedly, what happens to existing allowed, paused and partially released flows?
2. If the provider is suspended or its callback queue stops making progress, does macOS retain existing verdicts indefinitely, block further data, or apply some other behaviour?
3. Can an existing passBytes allowance remain usable after the provider becomes unavailable?
4. Is there a supported mechanism for independently confirming that all relevant existing flows and outstanding release allowances have been fenced?

I'm particularly interested in documented guarantees, rather than implementation behaviour observed in individual tests.

Any relevant Apple API documentation or technical clarification would be appreciated.