swarmkv is an internally-built, CRDT-based distributed key-value store (Redis-like, with Bloom filter, HyperLogLog, Count-Min Sketch, and token-bucket data types) referenced directly by TSG ticket numbers (TSG-20539, TSG-21840, TSG-15595) for its Committed-Information-Rate/Committed-Burst-Size (CIR/CBS) token-bucket throttling — the distributed state layer backing TSG's cluster-wide rate-limit/throttling policy actions.

Session records log MITM-proxy decision fields per session -- proxy_action, proxy_pinning_status, proxy_intercept_status, proxy_cert_verify, proxy_intercept_error, and proxy_passthrough_reason -- alongside security_rule_list/security_action and shaping_rule_list. This confirms, at the OLAP schema level, that TLS-interception outcomes (intercepted vs. passed through, including why -- e.g. detected certificate pinning) are retained per session, corroborating the certstore product's Trusted/Untrusted/Dynamic-Bypass model. Two adjacent columns, sc_rsp_raw/sc_rsp_decrypted, sit next to these but their exact semantics were not confirmed from schema alone.

TSG's QA automation framework (dongxiaoyan/gap_tsg_api) documents the policy engine's app-blocking action taxonomy (default/Drop/RateLimit/Tamper, with "rst" later renamed "reset") and records that, as of a 2022 test-suite update, the circumvention tools Psiphon ("赛风") and Freegate ("自由门") were only supported under a RateLimit (throttle) deny action rather than a hard Drop, while dozens of other apps (WeChat, Telegram, WhatsApp, Tor, WireGuard, TachyonVPN, Instagram, Facebook, etc.) had named test coverage across Allow/Deny/Monitor actions.

Confirms operational deployment of TSG's 'Shaping' (bandwidth-throttling) feature at the M22 project's YGN-MYTEL site (Yangon, Mytel — Myanmar), with per-client-IP rate limits implemented via a distributed token-bucket system ('SwarmKV'); a bug investigation shows throttling policies can cause full client disconnection under cluster-sync load, not just degraded speed.

TSG's "shaping-engine" (tango/shaping-engine) implements bandwidth-shaping "Profiles" (fair-share token allocation, priority-based bandwidth borrowing, active queue management) driven by rules loaded directly from MAAT (shaper_maat.cpp/h, shaping_maat.json, migrated to MAAT's JSON rule format with UUID rule IDs), providing the likely underlying enforcement mechanism behind app-specific RateLimit deny actions such as the Psiphon/Freegate throttling documented in gap_tsg_api.

TSG's policy-API test suite (zhaokun/tsg_policy_api, 508 commits) enumerates the full deny-action taxonomy exercised against combinations of IP/SNI/APP/flag match conditions and negation: deny_alert (HTTP 200 with profile or text body), deny_block (403/404 with profile or text), deny_drop, deny_noreset, deny_redirect (DNS with 1-3 forged answers), and deny_rate_limit (high/low), plus "allow" and "shunt" (traffic-diversion) actions — a precise map of TSG's blocking/throttling/redirect action space.

Release 24.04 (28 APR 2024) adds province/city-granularity ("administrative area") geo-tagging to every session and security-event log for both client and server -- client_country/client_super_administrative_area/ client_administrative_area/client_sub_administrative_area and the server-side equivalents -- plus Client ASN/Server ASN as dedicated Statistics Rule Metric datasets, confirming sub-national geolocation is a standard enrichment field across TSG's logging pipeline, not a specialized lookup.