Realign the roadmap with what is already built

Three of the roadmap's claims were contradicted by the repository
itself.

Fleet management was Phase 11, "Planned", and positioning.md said config
still flowed to the agent from the host rather than from the platform.
agent-management-design.md has recorded the opposite for some time:
punch list complete, verified live, with central authoring, versioning,
rollout on the next check-in, observation, and a restart command a real
agent picks up and acts on. There is no Phase 11 now. Its remainder is
either already named there -- stop/uninstall, per-host multi-row
alerting, a rule-per-host generator -- or belongs to Phase 8, since
distributing rules is the one genuinely new thing the mechanism has to
carry, and a rule language nobody can push to a fleet is not worth
having.

That inverts the old ordering argument, which put fleet last on the
grounds that it manages configuration the earlier phases define. Sound
reasoning; the world went the other way and built the mechanism first.
Recorded rather than quietly dropped, because the instinct behind it is
a good one that happened not to apply.

Retention was listed as a question Phase 10 would finally have to
answer. Half of it is answered: api/logretention serves operator-driven
preview and delete with an owner-only per-agent floor. What is missing
is an automatic TTL, so Phase 10 owns tiering and automatic TTL rather
than retention from nothing.

The rule-language recommendation is now settled rather than proposed,
and not on its own authority: DesiredOverride is already a closed typed
shape that cannot carry arbitrary code, so no channel exists that would
deliver JavaScript to an agent even if the language argument had gone
the other way.

That surfaced a requirement nothing had written down. Agent management
rests on an invariant it states outright -- every editable field
degrades behaviour without cutting off the agent's ability to receive
the next correction. Processing rules break it: a rule that panics or
loops strands the agent exactly the way a corrupted ingest endpoint
would, across every host it reached first. Phase 8 now owes either total
evaluation or apply-then-verify with rollback, chosen deliberately
rather than discovered mid-rollout.

Signed-off-by: John Coffey <[email protected]>

docs/status.md

@@ -20,19 +20,37 @@ verification procedure and its results.
 | 5 | Frontend redesign and design system | Shipped |
 | 6 | License compliance audit and remediation | Shipped |
 | 7 | AI-assisted query authoring | Shipped |
-| 8 | Processing: rule DSL, agent-side and ingest-side | Planned |
+| 8 | Processing: rule DSL, agent-side and ingest-side, and its distribution | Planned |
 | 9 | Routing: multiple destinations and delivery guarantees | Planned |
-| 10 | Archive and replay, retention and tiering | Planned |
-| 11 | Fleet: central agent configuration | Planned |
+| 10 | Archive and replay, tiering, automatic TTL | Planned |
+| — | Fleet: central agent configuration | Mostly shipped, see below |
 | — | AI-assisted analysis and explanation, on a local model | End-state goal |
 
-Phases 8-11 are a second axis rather than a continuation of the first:
-0-7 built the destination, and those four build the road to it. The
+Phases 8-10 are a second axis rather than a continuation of the first:
+0-7 built the destination, and those three build the road to it. The
 argument for taking that on, including the part where cheap storage
 removes the usual reason to buy a pipeline at all, is
 [`positioning.md`](positioning.md). Nothing in them is started. None of
 them depends on Phase 4.
 
+**There is no Phase 11.** It was going to be fleet management, and fleet
+management already exists: central config authoring, versioning, pull-based
+rollout, observation, and a working restart command, all recorded and
+verified live in
+[`agent-management-design.md`](agent-management-design.md). The roadmap
+was describing it as future work long after it stopped being any. Its real
+remainder is small and already disclosed there -- `stop`/`uninstall`
+lifecycle commands, true per-host multi-row alerting, and a rule-per-host
+generator -- and the one piece that is genuinely new, distributing
+processing rules, belongs to Phase 8, because a rule language nobody can
+push to a fleet is not worth having.
+
+Retention is half-built too, which changes what Phase 10 owns.
+`api/logretention` ships operator-driven preview and delete with an
+owner-only per-agent floor. What does not exist is an *automatic* TTL
+policy, which is why Phase 10 is now "tiering, automatic TTL" rather than
+"retention" from nothing.
+
 **Decision, 2026-09-05: tenancy is for other people's data; installations
 are for environments.** Phase 4 stays shipped and stays in the tree, and
 comes off the roadmap. Separating two environments means running two