diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2cf592a..d4e9dbd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,35 @@ is `0`, minor versions may carry breaking changes — they are called out here.
 
 ## [Unreleased]
 
+### Fixed — detect units, from the Varpulis engine (varpulis #277, #279, #281)
+- **A sequence with a closure followed by a step** (`A -> all B -> C`) no
+  longer matches before C. Under the default `.each()` it emitted a complete
+  match at every B, with or without a C; the brute-force example alerted on
+  failed logins alone. Matches now come when C arrives, one per closure event.
+- **`.stnm()` now keeps an event from opening a second run** when a run
+  already took it, so `.stnm().longest()` makes one alert of a brute force of
+  any length.
+- **A condition on a field the event does not carry is false** in `.where()`,
+  as it was in a sequence step: `a == "x" or ends_with(b, "y")` fired only
+  when `b` was present, and `selection and not filter` dropped events lacking
+  the filter's field.
+- **A program with a lambda (`arr.filter(x => ...)`), `a?.b` or a timestamp
+  literal no longer aborts the process** with a stack overflow, which took
+  every unit of the runtime down with it.
+- **`vejas-runtime vpl-check` and the MCP tool `vejas_vpl_check` run the
+  engine's semantic validator**: an unknown function (E050), a misspelled
+  event type once types are declared (E033), a regular expression that cannot
+  compile (E052) and an unbounded closure (W003, a warning) are reported with
+  their line. They checked parse and load only.
+
+### Added — in VPL
+- Single-quoted raw strings (`'\AppData\Local\Temp\'`, `''` for a quote),
+  `regex_match(s, pattern)`, and backticked field names (`` `cs-uri-query` ``)
+  for web and proxy logs. With them, rules converted from Sigma by
+  `sigma convert -t varpulis`
+  ([pySigma-backend-varpulis](https://github.com/varpulis/pySigma-backend-varpulis))
+  run as detect units.
+
 ## [0.3.0] — 2026-09-22
 
 ### Added
diff --git a/core/Cargo.lock b/core/Cargo.lock
index ef3eb06..65dc0dc 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -1846,11 +1846,12 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 [[package]]
 name = "varpulis-core"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "chrono",
  "indexmap",
  "miette",
+ "regex",
  "rustc-hash",
  "schemars",
  "serde",
@@ -1862,7 +1863,7 @@ dependencies = [
 [[package]]
 name = "varpulis-dead-letter"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "chrono",
  "serde",
@@ -1874,7 +1875,7 @@ dependencies = [
 [[package]]
 name = "varpulis-engine"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "serde_json",
  "thiserror",
@@ -1886,7 +1887,7 @@ dependencies = [
 [[package]]
 name = "varpulis-hamlet"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "rustc-hash",
  "smallvec",
@@ -1897,7 +1898,7 @@ dependencies = [
 [[package]]
 name = "varpulis-parser"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "logos",
  "miette",
@@ -1910,7 +1911,7 @@ dependencies = [
 [[package]]
 name = "varpulis-pst"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "hashlink",
  "rustc-hash",
@@ -1920,13 +1921,14 @@ dependencies = [
 [[package]]
 name = "varpulis-runtime"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "chrono",
  "hashlink",
  "hex",
  "indexmap",
  "rand 0.10.3",
+ "regex",
  "rustc-hash",
  "serde",
  "serde_json",
@@ -1947,7 +1949,7 @@ dependencies = [
 [[package]]
 name = "varpulis-sase"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "chrono",
  "rustc-hash",
@@ -1959,7 +1961,7 @@ dependencies = [
 [[package]]
 name = "varpulis-simd"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "varpulis-core",
 ]
@@ -1967,7 +1969,7 @@ dependencies = [
 [[package]]
 name = "varpulis-zdd"
 version = "0.11.0"
-source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2"
+source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf"
 dependencies = [
  "rustc-hash",
 ]
diff --git a/core/Cargo.toml b/core/Cargo.toml
index 2f04572..ae9ab8d 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -22,7 +22,7 @@ webpki-roots = "0.26"
 # The Varpulis CEP engine, embedded as a library (ADR-0031): compile a VPL
 # program, feed it events, publish its emits. No async runtime in its tree —
 # its own CI (scripts/check-engine-deps.py) fails if one ever appears.
-varpulis-engine = { git = "https://github.com/varpulis/varpulis", rev = "8bbeffc9130ff4f6938420da5afa1bcc580100b2" }
+varpulis-engine = { git = "https://github.com/varpulis/varpulis", rev = "9e92c0bfaa748217edbb571b9fb4992d731ea0bf" }
 
 [[bin]]
 name = "vejas-runtime"