An FR10 acknowledgement with two possible attempts

Python timeout precedes restart. Its new request follows. PLC acknowledgement position against them is uncertain.

On one investigation the file modification time was mistaken for the event time, so I would first identify what each timestamp represents before estimating any clock offset

These are recorded event times. Original exports preserved. No measured offset between the clocks.

Only the label. No run number or item identity in that message.

Then I would leave the acknowledgement unassigned in the incident report, with the two possible attempts shown, rather than choosing the order that looks most likely

Agreed. But keep looking for independent evidence, such as an application receipt record or an operator observation tied to one physical item. Missing clock alignment need not make every other source useless.

Was anyone at the station when the app restarted? They may remember whether a result was visible before it closed, though I'd label that as recollection.

Operator remembers a result, but cannot say whether it was fresh. Screen retained its previous value.

That recollection cannot establish a new result without the value's observation time, and I would check whether the displayed timestamp changed on refresh even when the underlying observation did not

It did. Display time was refresh time, not observation time. Separate defect logged.

Useful finding even if the old acknowledgement remains ambiguous; it explains why a person could reasonably remember seeing something the incident record cannot confirm as new

Will the replacement screen show when the value was actually observed? That would help the next operator describe the event without having to know the logging code.

And give attempts a persistent identity through the exchange. The display fix improves the evidence people see, but the repeated job label still lets different attempts look identical to the software.

Both repairs assigned. Original acknowledgement remains unassigned. No result credited to either attempt from it.

Will you post whether any independent evidence turns up? Interested in the original event as well as the proposed repair

For the new tests, deliver an old acknowledgement after restart deliberately. That will show whether the identity change actually prevents the association that the historical record cannot settle.