That is manageable. I can call the same event handler from a controlled queue. At present it assigns any completion to whichever attempt is current.

Then test identity as well as order. Give the housing job and each attempt explicit identifiers. The old completion must retain its old identity when delivered; relabelling it at the handler would make the test dishonest.

Include a duplicate of the new result too. Fixing old-versus-new can still leave one current attempt counted twice when its own completion is delivered again.

I've added an event list containing the old completion, the current completion and a duplicate. Each carries the identity it had when created; delivery order is set by the test.

What should happen to a result whose identity matches nothing in the restored history? I'd make that expectation explicit too, rather than merely asserting the current attempt stays incomplete.

It should remain unmatched for review, with its original identity visible. We currently discard it, which loses evidence I may need to explain an interrupted check.

Exercise restart between deliveries. Restore the recorded attempt history, not an empty convenient state. And check the report total separately; a deduplicated result list can still leave an incrementing counter wrong.

A replay that ends with one accepted housing and several retained events would be a useful handover example. The report should explain why those numbers differ, not try to make them match.

The controlled offline cases now keep the two attempts separate across restart and retain unmatched events. Duplicate delivery leaves the accepted count unchanged. The real interface still needs checking for the same identity information.

That last check matters. Your queue can prove how the software handles supplied identities, but it cannot establish that the actual controller exchange provides them in that form.