macOS app-specific container: documented initial creation behavior and storage restrictions

I am considering a dedicated macOS .app and am looking for public Apple documentation about the initial creation of its app-specific container by the operating system.

The priority is to protect existing application data and settings. Running the proposed app and allowing application-managed storage remain on hold.

This question concerns an individual app’s container, rather than an App Group shared container. The target macOS version, bundle identifier, signing configuration, and entitlements are not specified here. Please identify any conditions on which an answer depends.

My primary question is:

Is there public Apple documentation that identifies what the OS creates during initial container creation, which items are mandatory or conditional, and what triggers their creation? Where documented, I would like to understand their locations, contents, size bounds, and lifetime.

For a later assessment, I also need to understand:

• How the container and its initial contents are associated with a particular .app, including any relevant signing or identity requirements.
• Whether a public, supported mechanism can permit OS-managed initial container creation while separately preventing subsequent application-managed writes inside that container.

Please distinguish OS-managed initial creation from writes performed by application code or frameworks used by the application. Please also identify whether the behavior depends on App Sandbox, entitlements, or the macOS version.

Links to documentation describing the supported guarantees and their limits would be especially helpful. If some details are implementation-dependent or undocumented, please distinguish those from documented guarantees.

Thank you.