Thanks for the warm welcome Martok, and to the rest of you; I think I understand how it works.

It seems then, if you want to bother with spies, that you should borderfort every provence, train some lvl 6+ assassins, remove the bfs on your border provences and stick spies there. They get the first crack at the intruders and if they miss your assassins will get them (or the bfs if they move into the interior) but eventually you'll get some experienced spies which you can then unleash on some hapless junior generals, build up even more, and save for some risky but crucial siege or rebellion. Perhaps I was too hard on them before.