Python has a counter. It restarts at zero. The merged export removed the startup lines.

Can you read the separate source files before rebuilding that merged export?

Keep the uncertain timeout description in the support request while you look, so nobody treats the guessed receipt match as the agreed starting point.

Separate files recovered. Two sessions both use attempt six. No session identity was sent with it.

Does the receiving side retain anything that distinguishes those two requests?

Not in what we retained. Same job label, same local number. This is worse than clock skew.

Then keep both candidates unresolved unless another source distinguishes them. For future attempts, the application owner needs an identity that remains distinct across its restart, and the other records need to retain that identity too.

Would replaying two sessions with the same local count make a useful offline failure test?

Yes. Built that replay. Current parser joins the old receipt to the new request, exactly as feared.

Does that explain the original timeout, or only show that the join can be wrong?

Callum's distinction matters for the support request; reproducing a bad report should not become an invented account of what the controller did.

Only the join. Original timeout cause still unknown. I have removed the guessed pairing from the report.

Keep the two possible receipts available with the uncertainty stated. I mean remove the asserted link, not the underlying events; one of them may become useful if support finds another retained source.

Events kept. Support has no extra trace, so the old pair remains unassigned.

Have the new identity and repeated-session test reached the export too, not just your comparison view?

New identity survives application restart in the offline test. Export keeps both sessions separate. Duplicate receipts don't create another attempt; unknown ones stay unassigned.

What about a receipt arriving after timeout for an identity you do know?

Same attempt history, late receipt noted. It doesn't erase the timeout or declare the inspection accepted.

Integrator checked the new reporting capture during the agreed workstation check. Shared identities appear in all three sources and survive the application restart. Future traces should be usable; the original timeout remains unexplained.