The accounts divide on whether the theft was a state operation, an operational lapse, or the predictable defect of centralised custody