Manually deactivated rules are never recreated. This is deliberate for now.
If the Event Folder is set to a path with a valid .evtx file, that is not the correct folder - for instance, you successfully read a path and it is not the right one, the simplest thing to do is reset the app data manually. In the Data directory of Client Run Folder, are the app files. At the expense of clearing any known-data, you can safely delete everything but the appSettings.bin file (which should stay). Data files will be started fresh on next-run. Resetting the app this way can be useful, if you are analyzing files from different sources. Depending on how thorough you need to be, you can also safely go into the subfolders for Logs and Reports, to delete any files created (folders should stay for now).
When managing the firewall, the setting for "Expire After Minutes", must (necessarily) be larger than "Firewall Minutes To Review". We do not disqualify event records, they either fall in the scan window or not. If expiring after 5-minutes, and reviewing 1-week, the app will create rules, expire them 5-minutes later, find the same valid events on next-run, and recreate the rules.
There is no data-aging. Currently, records are forever until their data-files are removed. If the app is run, with manage firewall enabled, and is automated to run regularly, the actual data-load is low. The first run, will block any mass-offenders, and subsequent runs typically find little to do. In my experience, this improves over the matter of several days. However, mass volumes of records are possible, particularly in a mode of observing traffic only (manage firewall off). Failed logins can accrue at over 100,000 per day depending upon the scenario. If you are using this app in a mass-volume, no defence scenario, either do not automate, or be willing to reset data at regular intervals. If you feel a bog-down is occurring, you should be able to identify issues if the Viewer is slow to load, or by using the Viewer to run a data query over a time-period long-enough to include everything.