System.tag.browse odd behavior on remote provider

We have a 8.1.39 gateway with a remote tag provider to a 7.9.21 tag gateway with just over 1M tags. I know 7.9 is basically ancient at this point, we are working on migrating the tag gateway to 8 but this is a painful process for us due to our system scale. For now the remote provider has worked pretty well for the simple read/write operations we need while developing our Perspective client.

I am working on a system to lookup all 1M+ tagpaths on the 7.9.21 gateway in the provider we have set up Realtime1_1. I just need a list of all the tagpaths for an internal tool. I started with system.tag.browseTags with the recursive flag locks up, even when in the gateway context. Manual recursion works but is extremely slow. Same with system.tag.browseConfiguration.

I thought I would try running system.tag.browse from the remote provider in Ignition 8. I noticed two strange issues.

First, calling system.tag.browse('[Realtime1_1]', {'recursive': True}) times out from the client, which I expected. But, when run from the gateway context (gateway timer script) it returns immediately with zero tags which is annoying. Querying a folder like system.tag.browse('[Realtime1_1]TEST', {'recursive': True}) returns tags. So, I implemented a first call to system.tag.browse('[Realtime1_1]') and then manually called system.tag.browse again with the recursive flag. This works great and is quite fast. Then, I noticed another issue. The tag count returned is correct, but its not handling nested folders correctly. For example, here is the tag structure for this test on 7:

browseTags on 7 works right

browse with recurse on 8 however messes up the on the fullPath for the Layer2 tags, making them the same as Layer1...

I know some pathing issues with browse on remote providers was previously fixed but if memory serves, it was before 8.1.39 which we are on. Couldn't see anything in version 8.1.39+ patch notes related to this issue.

Am I overlooking something here or is this a bug on the 7 -> 8 remote tag provider? Is there a fast way to look up every full tagpath for a provider? We have a java module and I've considered just doing a query on the internal DB but would like to avoid that if possible.

I created the tags in a provider on the 8 gateway, and system.tag.browse works properly. Seems like its just a remote tag provider issue, probably just a 7 -> 8 remote tag provider issue.