Reviewed both changes against the surrounding code in AutomationServer.cpp. This is a clean, well-reasoned fast-follow — the analysis in the PR body holds up.

Bug 1 — thread_local sink: correct and robust. MarkCapture/g_markSink live in the existing anonymous namespace (internal linkage, no ODR concern). The key safety property is solid: because g_markSink is thread_local and points at a stack local on doMark's thread, only that thread's own synchronous tap call ever writes to cap; other threads' taps read their own (null) sink. And it degrades safely even if the synchronous-same-thread assumption were ever violated — g_markSink is reset to nullptr before the tap could fire late, so cap.set stays false and you take the resident-tail fallback rather than dereferencing a dangling pointer. Nice. The !cap.set fallback for the lcAutomation-disabled case is the right call too.

Bug 2 — oldest field: good, with one boundary nit. Computing oldest from m_logRing.front().seq under the same lock is correct. One off-by-one in the gap predicate, though:

tail returns events with e.seq > since (strict — the mark line at seq == since is excluded). gap_after flags a gap when since < oldest. Consider oldest == since + 1: the mark line itself was evicted, but the first wanted event (since + 1) is still resident as the ring front — so the post-mark bracket is actually complete, yet gap_after returns True. The strictly-correct condition is oldest > since + 1 (i.e. the first event after the mark was evicted). It only ever over-reports, never misses a real gap, so it errs in the safe direction — but since this is a precision tool, you may want to tighten it to avoid spurious "truncated window" signals at that exact boundary.

Minor: the oldest signal detects ring eviction but not n-truncation. A driver bracketing with the default tail (n=100) where >100 events match since silently gets only the newest 100, with no eviction and so gap_after returns False despite a truncated window. Worth a one-line note in the tail_window docstring that callers bracketing a region should pass a generous n (the oldest gap check assumes the window wasn't n-capped).

Neither blocks merge. Python wrapper keeps tail() compatible and documents the new path well. Thanks for the careful write-up and the reproduction evidence, @jensenpat.

_{🤖 aethersdr-agent · cost: $4.0001 · model: claude-opus-4-8}

Reviewed the mark/tail precision fixes — both correct.

Bug 1 (doMark seq race): the thread_local g_markSink captures the marker's seq/mono inside the synchronous MARK tap, so it's the exact in-lock-assigned seq rather than a later event's read after a re-lock gap. thread_local ⇒ only doMark's own thread publishes; concurrent loggers see null and skip — no race. Clean fallback when lcAutomation info logging is off.

Bug 2 (tail eviction gap): the additive 'oldest' field (front-of-ring seq, under the same lock) lets a driver detect truncation via since < oldest. Backward-compatible; logwatch.py exposes tail_window()/gap_after() with tail() unchanged.

Verified the patch anchors (the tap lambda + doLog tail return) survive #3819 untouched, so the 3-way merge is clean despite the line shift.

Non-blocking nit: g_markSink arm/disarm isn't RAII-guarded — theoretical dangle if qCInfo threw, which it doesn't. A small RAII guard would make it bulletproof.

Automation-only, no TX/radio impact, live mark/tail proof included. Thanks @jensenpat.