What if the gesture looked suspicious but the customer paid at checkout?

Mark the alert as "Suspicious", then select "Relevant gesture — no theft" or "Product paid/recovered after intervention" in the follow-up.