First thought: if I left bad or useless code in a commit, how many levels of verification would it need to pass to make it to production?
Otoh, the fact that there's a clear audit log that this happened, even if it wasn't effectively handled at the time, is quite impressive.
And finding a lost tool is a toughy -- how do you avoid an infinite loop, looking for something that really did walk off the site and/or end up in a trash can? You can't prove the lack of something.