I cannot assign one acknowledgement to an inspection attempt because the app reused its job label after restarting and the PLC and laptop clocks disagree; is there another reliable link I should look for in the existing exports?
Look for request sequence values or other identifiers that appear in both exports. I wouldn't start by lining up the nearest times. We once made two unrelated events look connected by correcting one clock against the very event we were trying to identify.
Any connection or startup entries around those attempts? They may let you split the application file into runs, even if they don't identify the acknowledgement on their own.
For the next capture, have the maintainer record the agreed request identity in each participating log and note restarts explicitly. Keep your current exports unchanged. They show why that addition is needed, even without a neat answer to this occurrence.