my thought was that if you get an alert that a key system is flapping in production, your first thought shouldn't be to squelch the alert.
Otoh, the fact that there's a clear audit log that this happened, even if it wasn't effectively handled at the time, is quite impressive.
And finding a lost tool is a toughy -- how do you avoid an infinite loop, looking for something that really did walk off the site and/or end up in a trash can? You can't prove the lack of something.