drop tor state + torrc · detect active bridge usage · circuit + transport connection evidence · runs locally
active bridge circuits · obfs4/meek/snowflake connections · UseBridges usage in state · not just config lines
heuristic screener · parses tor state/torrc locally · focuses on usage evidence not config inventory · binary state sections may need pre-export · not definitive proof