Discover the effective boundary
Record the OS and filter versions, active network extensions, application signatures, helpers, listeners and proxy/DNS modes. A running configuration app does not prove its filter is active.
Check actual precedence and loopback behavior. If child processes are not covered, a separate proven boundary is needed; do not block a shared interpreter or system service globally.
Launch paths and lifecycle
Test terminal, original CLI, SDK and Desktop entry separately. Preserve code signing and the existing account/provider mode. Updates, new helpers, login startup and filter failure remain separate acceptance cases.
This overview supplies no universal rule order or importable commands. Product/version-specific commands and rollback need independent review. Apple platform capabilities and tool behavior must be checked for the installed versions.