diff --git a/integrations/cortex-xdr/mappers/get_alerts.yaml b/integrations/cortex-xdr/mappers/get_alerts.yaml
index 6c15efa..323bf62 100644
--- a/integrations/cortex-xdr/mappers/get_alerts.yaml
+++ b/integrations/cortex-xdr/mappers/get_alerts.yaml
@@ -24,8 +24,9 @@ ocsf:
   - { source_path: "alert_name",           ocsf_field: "finding_info.analytic.name" }
   - { source_path: "matching_service_rule_id", ocsf_field: "finding_info.analytic.uid" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # The grid exposes when the tenant took the alert in (source_insert_ts); a
   # sensor-side detection timestamp, when the tenant sends one, is closer to the
   # event and comes last so it wins.
diff --git a/integrations/cortex-xdr/mappers/get_incidents.yaml b/integrations/cortex-xdr/mappers/get_incidents.yaml
index 58a7995..b5555a1 100644
--- a/integrations/cortex-xdr/mappers/get_incidents.yaml
+++ b/integrations/cortex-xdr/mappers/get_incidents.yaml
@@ -20,8 +20,9 @@ ocsf:
   - { source_path: "status",             ocsf_field: "status" }
   # `time` is the OCSF event time — when XDR opened the incident, as opposed to
   # when Riposte ingested it.
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   - { source_path: "creation_time",      ocsf_field: "time" }
   - { source_path: "alert_count",        ocsf_field: "count" }
   # ── MITRE ATT&CK (first aggregated tactic/technique) ──────────────
diff --git a/integrations/cortex-xdr/mappers/get_incidents_full.yaml b/integrations/cortex-xdr/mappers/get_incidents_full.yaml
index 6c3fafb..7419f4e 100644
--- a/integrations/cortex-xdr/mappers/get_incidents_full.yaml
+++ b/integrations/cortex-xdr/mappers/get_incidents_full.yaml
@@ -36,8 +36,9 @@ ocsf:
   # can still pivot to the single alert in the XDR console.
   - { source_path: "alerts[0].alert_id",  ocsf_field: "finding_info.uid_alt" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # Weakest first, strongest last. detection_time is often null on an XDR
   # incident, and then the first alert's own detection timestamp is the honest
   # anchor; incident creation is the last resort.
diff --git a/integrations/crowdstrike/mappers/search_detections.yaml b/integrations/crowdstrike/mappers/search_detections.yaml
index 0bb88bb..5cd2b34 100644
--- a/integrations/crowdstrike/mappers/search_detections.yaml
+++ b/integrations/crowdstrike/mappers/search_detections.yaml
@@ -28,8 +28,9 @@ ocsf:
   - { source_path: "description",        ocsf_field: "finding_info.desc" }
   - { source_path: "created_timestamp",  ocsf_field: "finding_info.created_time" }
   # `time` is the OCSF event time: when Falcon raised the alert.
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   - { source_path: "created_timestamp",  ocsf_field: "time" }
   - { source_path: "updated_timestamp",  ocsf_field: "finding_info.modified_time" }
   - { source_path: "scenario",           ocsf_field: "finding_info.analytic.name" }
diff --git a/integrations/rapid7-insightidr/mappers/get_investigations_full.yaml b/integrations/rapid7-insightidr/mappers/get_investigations_full.yaml
index 36457a3..59ef7b3 100644
--- a/integrations/rapid7-insightidr/mappers/get_investigations_full.yaml
+++ b/integrations/rapid7-insightidr/mappers/get_investigations_full.yaml
@@ -68,8 +68,9 @@ ocsf:
   - { source_path: "assignee.name",      ocsf_field: "assignee.name" }
   - { source_path: "assignee.email",     ocsf_field: "assignee.email_addr" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # Weakest first, strongest last. The investigation is created after the alert that
   # opened it; the alert's own alerted_at is when the event happened in the source system.
   - { source_path: "created_time",       ocsf_field: "time" }
diff --git a/integrations/rapid7-insightidr/mappers/query_log.yaml b/integrations/rapid7-insightidr/mappers/query_log.yaml
index d5bfecf..33a0eb8 100644
--- a/integrations/rapid7-insightidr/mappers/query_log.yaml
+++ b/integrations/rapid7-insightidr/mappers/query_log.yaml
@@ -42,8 +42,9 @@ ocsf:
   - { source_path: "detection_name", ocsf_field: "finding_info.analytic.name" }
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "finding_info.created_time" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # The log's own timestamp, not the poll's.
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "time" }
   # ── Product identity ──────────────────────────────────────────────
diff --git a/integrations/rapid7-insightidr/mappers/query_log_set.yaml b/integrations/rapid7-insightidr/mappers/query_log_set.yaml
index fbd4f48..e6e3f60 100644
--- a/integrations/rapid7-insightidr/mappers/query_log_set.yaml
+++ b/integrations/rapid7-insightidr/mappers/query_log_set.yaml
@@ -41,8 +41,9 @@ ocsf:
   - { source_path: "detection_name", ocsf_field: "finding_info.analytic.name" }
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "finding_info.created_time" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # The log's own timestamp, not the poll's.
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "time" }
   # ── Product identity ──────────────────────────────────────────────
diff --git a/integrations/rapid7-insightidr/mappers/search_alerts.yaml b/integrations/rapid7-insightidr/mappers/search_alerts.yaml
index 72c4906..b1effe5 100644
--- a/integrations/rapid7-insightidr/mappers/search_alerts.yaml
+++ b/integrations/rapid7-insightidr/mappers/search_alerts.yaml
@@ -51,8 +51,9 @@ ocsf:
   - { source_path: "rule.rrn",                ocsf_field: "finding_info.analytic.uid" }
   - { source_path: "rule.version_rrn",        ocsf_field: "finding_info.analytic.version" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # alerted_at is when the underlying event happened in the source system; created_at is
   # when Rapid7 finished building the alert. Weakest first, strongest last.
   - { source_path: "created_at",              ocsf_field: "time" }