diff --git a/README.md b/README.md
index 4116b2b..981d31f 100644
--- a/README.md
+++ b/README.md
@@ -147,7 +147,7 @@ To move the pin, move both:
 
 ```sh
 git -C rayforce-sys/vendor/rayforce fetch --tags
-git -C rayforce-sys/vendor/rayforce checkout v2.6.1
+git -C rayforce-sys/vendor/rayforce checkout v2.6.2
 git add rayforce-sys/vendor/rayforce
 
 git -C rayforce-sys/vendor/rayforce rev-parse --short=7 HEAD   # CORE_COMMIT
diff --git a/docs/docs/content/CHANGELOG.md b/docs/docs/content/CHANGELOG.md
index e5e1a33..4a2aeab 100644
--- a/docs/docs/content/CHANGELOG.md
+++ b/docs/docs/content/CHANGELOG.md
@@ -29,7 +29,7 @@ All notable changes to `rayforce` are documented here. This project adheres to
 
 ### Changed
 
-- **The vendored core is v2.6.1 and `rayforce-q` is `1eabaf4`** (from v2.5.8 and
+- **The vendored core is v2.6.2 and `rayforce-q` is `1eabaf4`** (from v2.5.8 and
   2.0.0). The core now recognises in-band nulls at construction, which changes
   what a vector built from a raw buffer reports: `Value::vec(&[1i64, i64::MIN, 3])`
   answers `is_null_at(1)` and `get(1)` returns the null singleton, where before
@@ -101,6 +101,27 @@ All notable changes to `rayforce` are documented here. This project adheres to
   pass a table value rather than a quoted name, so they keep taking the copy
   path and are unaffected.
 
+- **The v2.6.2 engine deltas that reach this crate.** A `Value::slice` of a
+  vector holding nulls inherits its parent's `HAS_NULLS` hint; before, every
+  gate that reads the bit took the window for null-free, so an aggregate over it
+  folded the sentinel in as a value. `is_null_at` on a slice already asked the
+  parent and is unchanged. `Table::save_splayed` derives the on-disk bit from
+  the payload rather than trusting the in-memory header, so a column holding a
+  sentinel reloads with its nulls. `nil?` (`Operation::NilQ`) is element-wise
+  outside queries as it always was inside them: over a vector or a list it
+  answers a `B8` vector, where it used to answer `false`. The parser rejects a
+  symbol, keyword, name or number glued to a quote, a colon or another name
+  character — `['a:1]` is a parse error rather than the two symbols `a` and `1`,
+  and so is `0Na` — so Rayfall text handed to `eval` must separate its tokens.
+  `Table::load_parted` no longer reads a calendar-impossible directory such as
+  `2024.02.31` as a date partition, which it used to normalise silently into
+  `2024.03.02`; a root holding one falls back to symbol partitions. `.log.write`
+  is refused inside an auto-journaled IPC evaluation. The rest lives in the
+  engine binary rather than this crate's surface: the per-connection transmit
+  backlog is configurable (`.ipc.txlimit`, 256 MiB by default — the old fixed
+  cap), `.mc.sub` no longer requires a filter argument, and a script or piped
+  session stays alive until its pending timers are spent.
+
 - **The submodules are addressed over SSH.** `.gitmodules` now points at
   `git@github.com:RayforceDB/rayforce.git` and `rayforce-q.git`. An existing
   clone picks the change up with `git submodule sync --recursive`; CI needs
diff --git a/docs/docs/content/documentation/data-types/vector.md b/docs/docs/content/documentation/data-types/vector.md
index 42fac16..019dc8d 100644
--- a/docs/docs/content/documentation/data-types/vector.md
+++ b/docs/docs/content/documentation/data-types/vector.md
@@ -111,9 +111,9 @@ Nulls live **in-band**: an element is null when it holds its type's sentinel —
 `i16::MIN`, `i32::MIN`, `i64::MIN`, `NaN`, the all-zero GUID, the empty symbol,
 the empty string. For the fixed-width types the engine also keeps a `HAS_NULLS`
 attribute as a fast-path hint and checks it first; `Value::vec` raises it when
-the buffer it is handed already contains a sentinel, and `set_null` raises it
-when marking an element. Symbol and string vectors need no hint: the empty
-value *is* the null.
+the buffer it is handed already contains a sentinel, `set_null` raises it when
+marking an element, and a `slice` inherits its parent's. Symbol and string
+vectors need no hint: the empty value *is* the null.
 
 ```rust
 // A buffer carrying a sentinel is null from construction:
diff --git a/docs/docs/content/get-started/installation.md b/docs/docs/content/get-started/installation.md
index 22d911a..fb3cfb5 100644
--- a/docs/docs/content/get-started/installation.md
+++ b/docs/docs/content/get-started/installation.md
@@ -92,11 +92,11 @@ Moving the pin means moving the submodule and the constants together:
 ```sh
 # 1. Move the submodule to the new tag.
 git -C rayforce-sys/vendor/rayforce fetch --tags
-git -C rayforce-sys/vendor/rayforce checkout v2.6.1
+git -C rayforce-sys/vendor/rayforce checkout v2.6.2
 git add rayforce-sys/vendor/rayforce
 
 # 2. Read back the values build.rs must stamp.
-git -C rayforce-sys/vendor/rayforce describe --tags --exact-match   # -> v2.6.1
+git -C rayforce-sys/vendor/rayforce describe --tags --exact-match   # -> v2.6.2
 git -C rayforce-sys/vendor/rayforce rev-parse --short=7 HEAD        # -> e.g. 1a2b3c4
 ```
 
@@ -104,7 +104,7 @@ Then edit `rayforce-sys/build.rs` to match — `CORE_VERSION` is the tag without
 its leading `v`:
 
 ```rust
-const CORE_VERSION: &str = "2.6.1";
+const CORE_VERSION: &str = "2.6.2";
 const CORE_COMMIT: &str = "1a2b3c4";
 ```
 
diff --git a/rayforce-sys/build.rs b/rayforce-sys/build.rs
index 7c8c733..f235b12 100644
--- a/rayforce-sys/build.rs
+++ b/rayforce-sys/build.rs
@@ -24,7 +24,7 @@ use std::process::Command;
 ///
 /// Must match the tag `vendor/rayforce` is pinned to. CI asserts the two agree;
 /// see the "Check vendored core pin" step in `.github/workflows/ci.yml`.
-const CORE_VERSION: &str = "2.6.1";
+const CORE_VERSION: &str = "2.6.2";
 
 /// Commit the `vendor/rayforce` submodule is pinned to, stamped alongside
 /// [`CORE_VERSION`]. Also checked by CI's "Check vendored core pin" step.
@@ -35,7 +35,7 @@ const CORE_VERSION: &str = "2.6.1";
 /// under OUT_DIR, an unset value does not fall back to "unknown" — it silently
 /// reports the HEAD of whatever unrelated repository happens to enclose the
 /// build directory.
-const CORE_COMMIT: &str = "a99a019";
+const CORE_COMMIT: &str = "2c10dba";
 
 /// Warning flags for the vendored core build — the core's own `WARNS`
 /// (`Makefile:30`) minus `-Werror`. Consumers compile this with whatever
diff --git a/rayforce-sys/vendor/rayforce b/rayforce-sys/vendor/rayforce
index a99a019..2c10dba 160000
--- a/rayforce-sys/vendor/rayforce
+++ b/rayforce-sys/vendor/rayforce
@@ -1 +1 @@
-Subproject commit a99a019e796f9632cabfb8f351164c8ab261c125
+Subproject commit 2c10dba6542c70b4cc27857e0cf3ced8190b5206