What your logs can't see

The premise "A detection rule can only fire on evidence that reached the platform." That sounds obvious written down, and it's routinely skipped in practice. When coverage gets audited, it gets audite