"Release discipline, not more detectors" is the lesson worth the post, and the mechanism deserves spelling out: every detector carries its own false-positive rate, so at 40 of them the aggregate alert volume is dominated by noise unless each one was individually tuned against real traces. Detector count is an input cost presented as a capability.

The 100K real traces plus a synthetic generator is the part I would lean on hardest. Synthetic traces let you measure recall on known-bad behaviour while real ones measure false positives, and you genuinely need both to calibrate.

Curious how many of the 35 survive a round of pruning by actual yield.