farhan-syah · Oct 18, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/README.md b/README.md
@@ -118,8 +118,8 @@ cargo install nodedb
 Requires Linux kernel >= 5.1 (io_uring). Connect:
 
 ```bash
-ndb                              # native CLI (connects to localhost:6433)
-psql -h localhost -p 6432        # or any PostgreSQL client
+ndb -w                           # native CLI as user nodedb on localhost:6433, prompts for the password (or set NDB_PASSWORD)
+psql -h localhost -p 6432 -U nodedb -d default   # password: <data_dir>/.superuser_password, or set NODEDB_SUPERUSER_PASSWORD
 ```
 
 ```sql
@@ -164,7 +164,7 @@ See [NodeDB-Lite](https://github.com/NodeDB-Lab/nodedb-lite) for platform detail
 
 **Write-time validation** -- Typeguards enforce types, required fields, CHECK constraints, and DEFAULT/VALUE expressions on schemaless collections. Graduate to strict schema with `CONVERT COLLECTION x TO document_strict`.
 
-**Bitemporal queries** -- System time (audit trail) and valid time (temporal semantics) across all engines. Query data as it existed in the past, or as it was valid on a past date. GDPR-compliant tile purge on array engine.
+**Bitemporal queries** -- System time (audit trail) and valid time (temporal semantics) on Document, Columnar, Timeseries, Graph and Array. Vector, Full-Text, Spatial and KV indexes reach time through the collection they index. Query data as it existed in the past, or as it was valid on a past date. GDPR-compliant tile purge on array engine.
 
 **Multi-dimensional arrays** -- Scientific computing with Z-order indexed tiles, tile-level compression, and bitemporal support. Combine with vector/graph/text in fused queries via cross-engine identity.
 
@@ -214,11 +214,9 @@ cargo nextest run --all-features
 
 ## Release Status
 
-NodeDB Origin is in **public beta**; the current release is **v0.5.0 (2026-08-04)**. All eight engines are feature-complete and covered by tests. The query-facing wire protocols (pgwire, HTTP, native MessagePack, RESP) are stable — clients written against 0.1.0 will keep working through 1.0. The CRDT sync protocol and ILP ingest are still moving: 0.5.0 changes the sync frame and requires authentication on ILP connections, so upgrade NodeDB Lite and ingest clients together with the server.
+NodeDB Origin is in **public beta**; the current release is **v0.6.2 (2026-10-16)**. All eight engines are feature-complete and covered by tests. Server binaries, Docker images and the crates.io crates ship at the same version. The CRDT sync protocol and the native protocol still change between minor releases, so upgrade NodeDB Lite and `nodedb-client` together with the server.
 
-v0.5.0 ships as server binaries and Docker images; the crates.io publication follows separately, so `cargo add` still resolves 0.4.0 for now. Library users who need the 0.5.0 fixes today can depend on the `v0.5.0` tag by git.
-
-**v0.5.0 — Beta (today).** Build new products on it. The public surface (SQL dialect, query wire protocols, configuration) is stable; expect internal changes (storage layout, on-disk format, replication internals) between minor releases — a 0.4.0 data directory needs a dump/reload to move to 0.5.0. Patch and minor bumps land as needed — 0.2 through 0.5 shipped as the work demanded. The beta period is deliberately for real workloads to surface edge cases we can't manufacture in-house.
+**v0.6 — Beta (today).** Build new products on it. Expect internal changes (storage layout, on-disk format, replication internals) between minor releases: a 0.5.0 data directory cannot be opened by 0.6, so start 0.6 on an empty directory. Patch and minor bumps land as needed. The beta period is deliberately for real workloads to surface edge cases we can't manufacture in-house.
 
 **v1.0.0 — Production-ready (target: after the beta hardening period).** What 1.0 guarantees:
 

diff --git a/docs/array.md b/docs/array.md
diff --git a/docs/bitemporal.md b/docs/bitemporal.md
@@ -115,19 +115,19 @@ Retrieve array cells as they existed at a point in time:
 -- Multidimensional scientific data with temporal audit trail
 CREATE ARRAY climate_grid
   DIMS (
-    lon INT32 DOMAIN [-180, 180),
-    lat INT32 DOMAIN [-90, 90)
+    lon INT64 [-180..180],
+    lat INT64 [-90..90]
   )
   ATTRS (
-    temp_c FLOAT32
+    temp_c FLOAT64
   )
   TILE_EXTENTS (64, 64)
   WITH (audit_retain_ms = 7776000000);  -- 90 days
 
 -- Query cells as they were committed yesterday
 SELECT lon, lat, temp_c FROM ARRAY_SLICE(
     'climate_grid',
-    {lon: [-10, 10), lat: [0, 20)},
+    '{lon: [-10, 9], lat: [0, 19]}',
     ['temp_c']
 )
 AS OF SYSTEM TIME '2026-06-06T00:00:00Z';
@@ -162,7 +162,7 @@ AS OF SYSTEM TIME NULL  -- returns every system-time version, ascending
 ORDER BY _ts_system ASC;
 ```
 
-`AS OF SYSTEM TIME NULL` returns every system-time version of each matching row, ordered ascending. Each version row carries the user columns plus three synthetic temporal columns: `_ts_system`, `_ts_valid_from`, and `_ts_valid_until`. Unbounded valid-time ends surface as the raw `i64::MIN` / `i64::MAX` sentinels (matching the Columnar and Timeseries engines). It is supported on the Document (strict and schemaless), Columnar, and Timeseries engines. It is not supported on the Graph or Array engines, nor when reading through a database clone — those return a typed error rather than collapsing to a single version.
+`AS OF SYSTEM TIME NULL` returns every system-time version of each matching row, ordered ascending. Each version row carries the user columns plus three synthetic temporal columns: `_ts_system`, `_ts_valid_from`, and `_ts_valid_until`. Unbounded valid-time ends surface as the raw `i64::MIN` / `i64::MAX` sentinels (matching the Columnar and Timeseries engines). It is supported on the Document (strict and schemaless), Columnar, and Timeseries engines, and on `ARRAY_SLICE`. An `ARRAY_SLICE` version row carries the dimension and attribute columns plus `_ts_system` only. It is not supported on the Graph engine or on `ARRAY_AGG`, nor when reading through a database clone — those return a typed error rather than collapsing to a single version.
 
 `AS OF` reads run at parity with non-temporal reads: `WHERE` predicates (including on strict Binary-Tuple collections), `ORDER BY`, computed columns, and window functions all apply to temporal queries.
 

diff --git a/docs/databases.md b/docs/databases.md
@@ -309,7 +309,7 @@ This allows safe retry after network failures without duplicating the move.
 ### Per-Database Audit Filtering
 
 ```sql
-SHOW AUDIT IN DATABASE staging [WHERE event_type = 'database_quota_changed'];
+SHOW AUDIT IN DATABASE staging [WHERE event_type = 'database_quota_changed'] [LIMIT n];
 ```
 
 Events tagged with `database_id` include: `DatabaseCreated`, `DatabaseDropped`, `DatabaseRenamed`, `DatabaseQuotaChanged`, `DatabaseCloned`, `DatabaseMirrored`, `DatabasePromoted`, `TenantMoved`, etc.

diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -726,17 +726,21 @@ An env override still wins over an expanded value for the same field.
 ### With the `ndb` CLI
 
 ```bash
-./target/release/ndb
+./target/release/ndb -w
 ```
 
+`ndb` connects to `127.0.0.1:6433` as user `nodedb`. The server runs in password mode by default, and `ndb` sends no password unless given `-w`, which prompts for it. Set `NDB_PASSWORD` to skip the prompt. `NDB_USER` and `NDB_DATABASE` set the user and database.
+
 You get a full TUI with syntax highlighting, tab completion, and history search. See the [CLI guide](cli.md) for details.
 
 ### With psql
 
 ```bash
-psql -h localhost -p 6432
+psql -h localhost -p 6432 -U nodedb -d default
 ```
 
+The server starts in password mode with the superuser `nodedb`. Set `NODEDB_SUPERUSER_PASSWORD` before the first start, or read the generated password from `<data_dir>/.superuser_password`. `-d default` names the built-in database. Without it, psql asks for a database named after the user, and the server refuses the connection with `3D000`.
+
 NodeDB speaks PostgreSQL's wire protocol, so standard tools like `psql`, ORMs, and BI tools work out of the box.
 
 ### With the Rust SDK or FFI

diff --git a/docs/protocols.md b/docs/protocols.md
@@ -21,7 +21,7 @@ NodeDB speaks six wire protocols. All SQL-capable protocols share the same query
 Standard PostgreSQL wire protocol. Any tool that speaks Postgres works with NodeDB.
 
 ```bash
-psql -h localhost -p 6432
+psql -h localhost -p 6432 -U nodedb -d default
 
 # Or any Postgres-compatible client
 # JDBC, libpq, SQLAlchemy, Prisma, etc.
@@ -76,11 +76,11 @@ Use SQL for complex queries, ad-hoc exploration, and rapid prototyping. Use nati
 **Connection:**
 
 ```bash
-# ndb CLI connects automatically
-./target/release/ndb
+# ndb CLI: user nodedb, port 6433, -w prompts for the password (or set NDB_PASSWORD)
+./target/release/ndb -w
 
 # Or specify host
-./target/release/ndb --host localhost --port 6433
+./target/release/ndb --host localhost --port 6433 -w
 ```
 
 ## HTTP API