@DineshBennett0734 Found it. I can split our Python log into two sessions. Still no attempt match for that PLC acknowledgement, though

Keep source order, label the sessions and leave that acknowledgement unassigned. Comparing the timestamps alongside them should establish the combined order.

Those clocks disagree. No offset or causal link, no established combined order.

You're right; i went too far. Timestamps suggest matches. Keep source order and mark cross-system links uncertain unless evidence supports them.

I'll keep that acknowledgement unassigned. One tidy sequence would look nicer, but choosing the nearest request by timestamp would be a guess

My merged log fooled us after a machine clock adjustment. Keeping the original source order let us untangle our confidently wrong interpretation.

Would monotonic time fix it? Or only inside one process?

@FarahBrooks0852 Inside a running process. Machines and restarts don't automatically share that clock, so keep a session ID and wall-clock reference too.

This resolves how I'll present the incident: separate source sequences, application sessions identified, and the unmatched acknowledgement left uncertain. I'm not claiming that establishes the job's final outcome

That gives readers an honest incident view without making the unknown result look settled.