An internal UI-revision memo instructs changing the product's displayed name from 'NPM' to 'Cyber Narrator' and specifies an 'Entity explorer' with per-FQDN and per-IP detail pages (e.g. 'Entities/Entity explorer/Fqdn-qq.com', '.../IP-8.8.8.8'), split into 'server-side' and 'client-side' IP detail tabs, plus a planned DNS Dashboard -- confirming CyberNarrator's UI was originally built and marketed as a generic Network & Application Performance Monitoring (NPM) console before being rebranded, and detailing its entity-drilldown structure.

A MESA Lab monthly report states that adjustments to a VPN-detection module accumulated over 10,000 Psiphon3 server IPs and delayed a Psiphon3 client's ability to get online by at least 3 minutes in the researchers' test environment, an earlier-stage data point consistent with the much larger-scale (~70-73K IP) 'vpn-thwarting'/CyberNarrator Psiphon-harvesting pipeline documented elsewhere in this corpus.

MESA Lab group-meeting notes record parallel R&D on a whitelist-filtering module and a project to fingerprint cloud-hosted circumvention/proxy infrastructure at the IP-block (not single-IP) level, explicitly modeled on 2017/2019 academic 'Bulletproof-hosting IP block' research; the notes also mention local packet captures that found Psiphon IPs, the domain types/ratios Psiphon uses, and active-probing behavior with candidate detection countermeasures.

The cyber-narrator/cn-ui repo (the CyberNarrator/网络叙事者 frontend, 3123 commits across 21.08-24.11 tags) maintains dedicated deployment branches "dev-24.01-m22" (M22 = Myanmar per taxonomy) and "dev-xj-0111" (Xinjiang), confirming CyberNarrator is actively built and shipped per-deployment for both an export customer (Myanmar) and a domestic site (Xinjiang) as of 2024, and ships EN/RU/ZH localization plus per-country geojson map data (including kazakhstanLow.json, ethiopiaLow.json, myanmarLow.json) consistent with a multi-country tracking dashboard.

CyberNarrator's reporting-template repo (cyber-narrator/cn-reporter-template) generates recurring, branded per-provider and per-carrier traffic/QoS monitoring reports — including dedicated templates for ByteDance (字节跳动) and Alibaba (阿里巴巴) traffic specifically at "新疆联通" (Xinjiang Unicom) ingress/egress points, plus generic IDC domain and CDN-provider reports — showing CyberNarrator produces customer-facing traffic-monitoring deliverables tied to specific Chinese carriers and named application/service providers, a distinct third capability beyond the Psiphon3-harvesting and Pakistan subscriber-correlation uses already documented.

A Postman API collection titled '银河api' (Galaxy API) documents production query endpoints against the tsg_galaxy analytics backend, including dedicated 'radius日志标准查询' / 'raduis日志clickhouse查询' (RADIUS log queries) and 'Traffic Top Intercept Policies By Hits/Bandwidth' endpoints -- showing RADIUS-based subscriber correlation and interception-policy analytics are standard, generally-available query features of TSG's management API rather than a one-off built solely for the Pakistan deployment.

TSG's central ClickHouse analytics schema ('tsg_galaxy_v3', deployed on cluster 'ck_cluster') defines a 'session_record' table where every logged session carries subscriber_id, imei, imsi, phone_number, and apn fields alongside client/server geolocation and ASN -- showing that per-session subscriber-identity correlation is a built-in, standard field of TSG's core traffic-log schema (used for ordinary session_record, not a bespoke table), not an add-on limited to the already-documented Pakistan CyberNarrator deployment.