engine: Varpulis at 4e3dbb5, windows close on event time

[cpoder]

Why

A time window in a detect unit closed only when a later event reached that same window. A count per address waited for the same address's next failure. A brute force that ended in a successful logon was therefore never raised in a running unit. varpulis simulate hid this, because it closes every window at the end of a file.

What changes

• Engine bump to varpulis 4e3dbb5. It brings two fixes:
  • varpulis#284. A window closes when the event time of the types feeding it passes its end, on any event of those types. Windows close upstream first, so a count's alert reaches the correlations above it in time. A type that goes quiet holds back only the windows it feeds, whereas .watermark() used to hold back every window.
  • varpulis#285. A sequence step that names a derived stream reads what that stream outputs. Over an aggregate, it used to match the raw events.
• e2e/detect D6. The scenario is three failures from one address, a success from the same address, then a logon from another address after the window.
  • Against the previous runtime (VEJAS_BIN = the v0.3.1-era build), D6 fails: nothing is ever raised.
  • On this branch, the next logon raises the brute force with n = 3.
  • D4 now lists three units.
• Docs and changelog. detects.md says when windows close. The CHANGELOG entry sits under Unreleased.

Checks run locally

• cargo test: 43 passed.
• e2e/detect/run.sh: all invariants hold, D6 included.
• e2e/detect-demo/run.sh: every beat holds.

🤖 Generated with Claude Code

https://claude.ai/code/session_01N3K1TGnWTvwYzt9rKuJXES