docs(mappers): MTTD is not retired, only re-anchored

The previous commit said MTTD was retired. Migration 0256 did retire it,
but 0257 restored it at once: what stays is its anchor, the moment
Riposte records the alert. The OCSF `time` field is still not read to
date detection — that part was right.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

integrations/cortex-xdr/mappers/get_alerts.yaml

@@ -24,8 +24,9 @@ ocsf:
   - { source_path: "alert_name",           ocsf_field: "finding_info.analytic.name" }
   - { source_path: "matching_service_rule_id", ocsf_field: "finding_info.analytic.uid" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # The grid exposes when the tenant took the alert in (source_insert_ts); a
   # sensor-side detection timestamp, when the tenant sends one, is closer to the
   # event and comes last so it wins.

integrations/cortex-xdr/mappers/get_incidents.yaml

@@ -20,8 +20,9 @@ ocsf:
   - { source_path: "status",             ocsf_field: "status" }
   # `time` is the OCSF event time — when XDR opened the incident, as opposed to
   # when Riposte ingested it.
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   - { source_path: "creation_time",      ocsf_field: "time" }
   - { source_path: "alert_count",        ocsf_field: "count" }
   # ── MITRE ATT&CK (first aggregated tactic/technique) ──────────────

integrations/cortex-xdr/mappers/get_incidents_full.yaml

@@ -36,8 +36,9 @@ ocsf:
   # can still pivot to the single alert in the XDR console.
   - { source_path: "alerts[0].alert_id",  ocsf_field: "finding_info.uid_alt" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # Weakest first, strongest last. detection_time is often null on an XDR
   # incident, and then the first alert's own detection timestamp is the honest
   # anchor; incident creation is the last resort.