diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index f4fac9d2e0..cecd5a6315 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.805.0"
+  ".": "1.806.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f431b9fd96..f9252c24a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,33 @@
 # Changelog
 
+## [1.806.0](https://github.com/windmill-labs/windmill/compare/v1.805.0...v1.806.0) (2026-09-08)
+
+
+### Features
+
+* bring gitlab repositories to parity for git sync ([#10938](https://github.com/windmill-labs/windmill/issues/10938)) ([9444049](https://github.com/windmill-labs/windmill/commit/9444049d6013c77a5f25f01a736eb5cd741fb3e6))
+* draw a dbt column trace, across projects and the pipeline boundary ([#11014](https://github.com/windmill-labs/windmill/issues/11014)) ([33f9828](https://github.com/windmill-labs/windmill/commit/33f9828c3ed15fe63fccedc1550584f15c0490ab))
+* durable dbt state per environment, and `--defer` onto it ([#10975](https://github.com/windmill-labs/windmill/issues/10975)) ([621fac5](https://github.com/windmill-labs/windmill/commit/621fac55abcd1859e8c8c06e5f4412e61bb85d59))
+* ingest dbt column lineage and real column schemas from the engine's parquet index ([#10977](https://github.com/windmill-labs/windmill/issues/10977)) ([0139467](https://github.com/windmill-labs/windmill/commit/0139467b01b82e4b3d474ca3f205358fa607d19a))
+* let a worker group override the dependency cache object store ([#11019](https://github.com/windmill-labs/windmill/issues/11019)) ([de98adf](https://github.com/windmill-labs/windmill/commit/de98adf055835ab7c4d6305e7d5d3bdab915876b))
+* **nativets:** bound fetch on a peer that never answers ([#11026](https://github.com/windmill-labs/windmill/issues/11026)) ([785277e](https://github.com/windmill-labs/windmill/commit/785277e0bb2ea77b71a89dd4d389d439dfcf9e03))
+* recognize `// volume:` mounts in PHP scripts ([#11018](https://github.com/windmill-labs/windmill/issues/11018)) ([f081fb1](https://github.com/windmill-labs/windmill/commit/f081fb10705cadf99e99dfa786d1cc2ebf0447db))
+* report a WAC task failure the workflow body never awaited ([#11017](https://github.com/windmill-labs/windmill/issues/11017)) ([3e3a41d](https://github.com/windmill-labs/windmill/commit/3e3a41d418d4ee3fe060bd3acf3324f311d89c8a))
+* retry a workflow-as-code task from its task options ([#11013](https://github.com/windmill-labs/windmill/issues/11013)) ([d3f305d](https://github.com/windmill-labs/windmill/commit/d3f305db982b7c5dc49babf9bec8b62adcd2557d))
+
+
+### Bug Fixes
+
+* chain redeploys onto a retired path's version history ([#11029](https://github.com/windmill-labs/windmill/issues/11029)) ([0b37226](https://github.com/windmill-labs/windmill/commit/0b372260787edb7e9627ad4fb6637ad5f1024e0a))
+* make the native trigger disable/enable toggle actually save ([#11024](https://github.com/windmill-labs/windmill/issues/11024)) ([448fce9](https://github.com/windmill-labs/windmill/commit/448fce93f743d5b2ef2a2d4496eb2ec238594a0a))
+* offload php signature parsing from async workers ([#11027](https://github.com/windmill-labs/windmill/issues/11027)) ([2cb02e3](https://github.com/windmill-labs/windmill/commit/2cb02e3b3398db49f16377dd79dde2dd6fb5cc02))
+* reduce php parser stack use in debug workers ([#11025](https://github.com/windmill-labs/windmill/issues/11025)) ([2ae8509](https://github.com/windmill-labs/windmill/commit/2ae8509b14f112c9ef5b71321e8fd52596a16c10))
+
+
+### Performance Improvements
+
+* reduce shared worker debug polling frames ([#11028](https://github.com/windmill-labs/windmill/issues/11028)) ([946756a](https://github.com/windmill-labs/windmill/commit/946756ae83deb4e7a93111edddbd4d98c596d5a9))
+
 ## [1.805.0](https://github.com/windmill-labs/windmill/compare/v1.804.0...v1.805.0) (2026-09-07)
 
 
diff --git a/backend/.sqlx/query-904c81997a1594ca998a4b1af5a5710bcbe114153f9096d0e2e59e429bd5a325.json b/backend/.sqlx/query-904c81997a1594ca998a4b1af5a5710bcbe114153f9096d0e2e59e429bd5a325.json
new file mode 100644
index 0000000000..14a20fa112
--- /dev/null
+++ b/backend/.sqlx/query-904c81997a1594ca998a4b1af5a5710bcbe114153f9096d0e2e59e429bd5a325.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT 1 FROM script WHERE parent_hashes[1] = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "904c81997a1594ca998a4b1af5a5710bcbe114153f9096d0e2e59e429bd5a325"
+}
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 4dff91e5d2..769fffc0aa 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -1958,18 +1958,18 @@ dependencies = [
 
 [[package]]
 name = "bon"
-version = "3.10.0"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e3fac94a66da67200398458a25412bcc3f9b6443b5119a6cad9cf3ccfcd8cc6"
+checksum = "60eafe0d77c3a2fc292c1d1346c3041b33c0a108085a2afabf672b70f69dbbc9"
 dependencies = [
  "bon-macros",
 ]
 
 [[package]]
 name = "bon-macros"
-version = "3.10.0"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4654961ad0494e4774c5c60b4cb4cd0ae9b9d92d039d901638b1dba97ebebf5"
+checksum = "bd0f9631d8aaaee112c41985d675ef269e02acbd4f33122836af4f0c5f699ff6"
 dependencies = [
  "darling 0.24.1",
  "ident_case",
@@ -11484,11 +11484,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.22.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a"
+checksum = "935177bb8c0cd8ca1a4e6d1a2ac8988bea69cab4f9d3a31311e012ad27868ea4"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "bs58",
  "chrono",
  "hex",
@@ -11505,14 +11505,14 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.22.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46"
+checksum = "1d607aa01a3cb0ad757d6fd216136910db3c97b102fe686585689615a02dbcdc"
 dependencies = [
- "darling 0.23.0",
+ "darling 0.24.1",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.5",
 ]
 
 [[package]]
@@ -14747,7 +14747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14835,7 +14835,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14868,7 +14868,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14881,7 +14881,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15021,7 +15021,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15044,7 +15044,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15061,7 +15061,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15087,7 +15087,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15097,7 +15097,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15114,7 +15114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -15136,7 +15136,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15159,7 +15159,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15175,7 +15175,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15197,7 +15197,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15218,7 +15218,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15232,7 +15232,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15267,7 +15267,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15292,7 +15292,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15320,7 +15320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15342,7 +15342,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15362,7 +15362,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15400,7 +15400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15428,7 +15428,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15440,7 +15440,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15464,7 +15464,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15478,7 +15478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15513,7 +15513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15527,7 +15527,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15652,7 +15652,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "chrono",
  "futures",
@@ -15672,7 +15672,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "regex",
  "serde",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15714,7 +15714,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15731,7 +15731,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15768,7 +15768,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15799,7 +15799,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15824,7 +15824,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15859,7 +15859,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15877,7 +15877,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15886,7 +15886,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15898,7 +15898,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15910,7 +15910,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15922,7 +15922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15934,7 +15934,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15946,7 +15946,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15957,7 +15957,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15968,7 +15968,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15980,7 +15980,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15991,7 +15991,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16013,7 +16013,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16025,7 +16025,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16039,7 +16039,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16056,7 +16056,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16069,7 +16069,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16081,7 +16081,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16099,7 +16099,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -16115,7 +16115,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16131,7 +16131,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16145,7 +16145,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16184,7 +16184,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -16224,7 +16224,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -16235,7 +16235,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16270,7 +16270,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16294,7 +16294,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16327,7 +16327,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16354,7 +16354,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16387,7 +16387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16407,7 +16407,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16441,7 +16441,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16477,7 +16477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16500,7 +16500,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16524,7 +16524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16548,7 +16548,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16583,7 +16583,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16611,7 +16611,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16636,7 +16636,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16655,7 +16655,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16773,7 +16773,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 9e8d62316f..2701f83f36 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.805.0"
+version = "1.806.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.805.0"
+version = "1.806.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 13597b06c9..7fa74c4dcf 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6286,7 +6286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6295,7 +6295,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6490,7 +6490,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.805.0"
+version = "1.806.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 7de860c637..ad8bbf7443 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.805.0"
+version = "1.806.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/tests/script_auto_parent_archived.rs b/backend/tests/script_auto_parent_archived.rs
index 5115c516c2..58b926b9c4 100644
--- a/backend/tests/script_auto_parent_archived.rs
+++ b/backend/tests/script_auto_parent_archived.rs
@@ -9,8 +9,9 @@
 //! `lineage must be linear: no 2 scripts can have the same parent` error
 //! whenever that archived hash already had a child from the prior rename.
 //!
-//! The fix clears `parent_hash` to `None` in that case so the push starts a
-//! fresh lineage instead of failing.
+//! Resolution only ever adopts an archived version nothing else descends from,
+//! so here it finds none and leaves `parent_hash` at `None`, starting a fresh
+//! lineage instead of failing.
 
 use serde_json::json;
 use sqlx::{Pool, Postgres};
@@ -146,3 +147,221 @@ async fn test_auto_parent_starts_fresh_lineage_when_all_versions_archived(
 
     Ok(())
 }
+
+/// A path whose only versions are archived and childless — what archiving a path
+/// leaves behind, and what a sync push that applies a deletion before the matching
+/// update sees. Resolving `auto_parent` to no parent there hashes the deploy exactly
+/// as the path's first version was hashed, so an unchanged push is rejected as a
+/// duplicate of it.
+#[sqlx::test(fixtures("base"))]
+async fn test_auto_parent_adopts_archived_head_instead_of_colliding(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+
+    let path = "u/test-user/script_archived_head";
+    let body = new_script(path, "export async function main() { return 1; }");
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&body)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201);
+    let first_hash: i64 =
+        sqlx::query_scalar("SELECT hash FROM script WHERE path = $1 AND workspace_id = $2")
+            .bind(path)
+            .bind("test-workspace")
+            .fetch_one(&db)
+            .await?;
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/archive/p/{path}")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "archiving the path should succeed");
+
+    // Byte-identical to the first deploy: the collision this guards against needs the
+    // pushed body to hash the same way the original one did.
+    let resp = authed(
+        client().post(format!("{base}/scripts/create?skip_if_noop=true")),
+        "SECRET_TOKEN",
+    )
+    .json(&{
+        let mut push = body.clone();
+        push["auto_parent"] = json!(true);
+        push
+    })
+    .send()
+    .await?;
+    let status = resp.status();
+    let response_body = resp.text().await?;
+    assert_eq!(
+        status, 201,
+        "re-pushing an archived path must not collide with its own first version, \
+         got {status}: {response_body}"
+    );
+
+    let active: Vec<Option<Vec<i64>>> = sqlx::query_scalar(
+        "SELECT parent_hashes FROM script \
+         WHERE path = $1 AND archived = false AND workspace_id = $2",
+    )
+    .bind(path)
+    .bind("test-workspace")
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(active.len(), 1, "exactly one active version expected");
+    assert_eq!(
+        active[0].as_deref(),
+        Some(&[first_hash][..]),
+        "the revived version should continue the archived lineage"
+    );
+
+    Ok(())
+}
+
+/// The same redeploy from a caller that names no parent at all — the shape a retried
+/// `wmill sync push` takes, once the archive it applied has committed and the path has
+/// dropped out of the listing it diffs against.
+///
+/// The adopted version supplies the lineage and nothing else: a path is reusable by a
+/// different script, which must not start life holding grants nobody gave it.
+#[sqlx::test(fixtures("base"))]
+async fn test_parentless_redeploy_adopts_the_lineage_but_not_the_grants(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+
+    let path = "u/test-user/script_retired_parentless";
+    let body = new_script(path, "export async function main() { return 1; }");
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&body)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201);
+    let first_hash: i64 =
+        sqlx::query_scalar("SELECT hash FROM script WHERE path = $1 AND workspace_id = $2")
+            .bind(path)
+            .bind("test-workspace")
+            .fetch_one(&db)
+            .await?;
+
+    sqlx::query("UPDATE script SET extra_perms = $1 WHERE hash = $2 AND workspace_id = $3")
+        .bind(json!({ "u/someone_else": true }))
+        .bind(first_hash)
+        .bind("test-workspace")
+        .execute(&db)
+        .await?;
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/archive/p/{path}")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "archiving the path should succeed");
+
+    // Byte-identical to the first deploy and naming no parent: hashed as a first deploy it
+    // lands on the archived row.
+    let resp = authed(
+        client().post(format!("{base}/scripts/create?skip_if_noop=true")),
+        "SECRET_TOKEN",
+    )
+    .json(&body)
+    .send()
+    .await?;
+    let status = resp.status();
+    let response_body = resp.text().await?;
+    assert_eq!(
+        status, 201,
+        "a parentless redeploy of a retired path must not collide with its own first \
+         version, got {status}: {response_body}"
+    );
+
+    let live: Vec<(Option<Vec<i64>>, serde_json::Value)> = sqlx::query_as(
+        "SELECT parent_hashes, extra_perms FROM script \
+         WHERE path = $1 AND archived = false AND workspace_id = $2",
+    )
+    .bind(path)
+    .bind("test-workspace")
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(live.len(), 1, "exactly one live version expected");
+    assert_eq!(
+        live[0].0.as_deref(),
+        Some(&[first_hash][..]),
+        "the redeploy should continue the retired lineage"
+    );
+    assert_eq!(
+        live[0].1,
+        json!({}),
+        "an adopted version's grants must not carry over to whatever reuses its path"
+    );
+
+    Ok(())
+}
+
+/// A soft delete keeps the row, and with it the hash the version was deployed under, so a
+/// tombstone has to stay adoptable: skip it and the redeploy hashes straight back onto it.
+#[sqlx::test(fixtures("base"))]
+async fn test_redeploy_chains_past_a_deleted_version(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+
+    let path = "u/test-user/script_deleted_version";
+    let body = new_script(path, "export async function main() { return 1; }");
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&body)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201);
+    let deleted_hash = resp.text().await?;
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/delete/h/{deleted_hash}")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "deleting the version should succeed");
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create?skip_if_noop=true")),
+        "SECRET_TOKEN",
+    )
+    .json(&body)
+    .send()
+    .await?;
+    let status = resp.status();
+    let response_body = resp.text().await?;
+    assert_eq!(
+        status, 201,
+        "redeploying the content of a deleted version must not collide with its \
+         tombstone, got {status}: {response_body}"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index 97e3019835..a4667e4876 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -1318,6 +1318,47 @@ async fn create_script_internal<'c>(
         }
     }
 
+    // A retired path keeps its versions, and the newest is where a redeploy belongs: hashed
+    // as a first deploy instead, unchanged content lands on the row the path's own first
+    // version already holds. A deleted version still counts — its row keeps the hash it was
+    // deployed under even once the content is wiped, so skipping it is what collides.
+    //
+    // Any parentless deploy, not only an `auto_parent` one: the CLI names no parent for a
+    // path its listing no longer shows, which is where a retried push lands. Gated on
+    // nothing being live there, so a parentless deploy onto a live path still meets the
+    // path conflict the match below raises.
+    let mut parent_adopted_from_retired_path = false;
+    if ns.parent_hash.is_none() && clashing_script.is_none() {
+        // Locked, not merely read: a competing deploy chaining onto this same candidate
+        // takes `FOR UPDATE` on it before inserting, so holding the row is what serializes
+        // the two. Probe first and the child still uncommitted reads as absent.
+        let candidate = sqlx::query_scalar::<_, i64>(
+            "SELECT hash FROM script WHERE path = $1 AND workspace_id = $2 \
+             ORDER BY created_at DESC LIMIT 1 FOR UPDATE",
+        )
+        .bind(&ns.path)
+        .bind(&w_id)
+        .fetch_optional(&mut *tx)
+        .await?;
+        // Adoptable only if nothing already descends from it: a rename leaves its source
+        // path holding a version whose child lives at the destination, and a second child
+        // forks a lineage the guard below requires to be linear. Nothing adoptable means a
+        // fresh lineage, which has no parent to vary its hash and can still collide.
+        ns.parent_hash = match candidate {
+            Some(hash) => sqlx::query_scalar!(
+                "SELECT 1 FROM script WHERE parent_hashes[1] = $1 AND workspace_id = $2",
+                hash,
+                &w_id
+            )
+            .fetch_optional(&db)
+            .await?
+            .is_none()
+            .then_some(ScriptHash(hash)),
+            None => None,
+        };
+        parent_adopted_from_retired_path = ns.parent_hash.is_some();
+    }
+
     // Must stay below the parent resolution above: an auto_parent deploy hashed before
     // it carries a first deploy's lineage, so redeploying content the path has held
     // before collides with that archived version instead of superseding it. The
@@ -1362,20 +1403,42 @@ async fn create_script_internal<'c>(
                 ));
             };
 
+            // Unscoped, and sound only under the lock above: linearity is a property of the
+            // lineage, not of what this caller may read. A child can sit where they cannot
+            // see it — a folder they renamed it into, or grants an adopting deploy reset —
+            // and asked through `tx` it reads as absent, letting the fork through.
             let clashing_hash_o = sqlx::query_scalar!(
                 "SELECT hash FROM script WHERE parent_hashes[1] = $1 AND workspace_id = $2",
                 p_hash.0,
                 &w_id
             )
-            .fetch_optional(&mut *tx)
+            .fetch_optional(&db)
             .await?;
 
             if let Some(clashing_hash) = clashing_hash_o {
-                return Err(Error::BadRequest(format!(
-                    "A script with hash {} with same parent_hash has been found. However, the \
-                         lineage must be linear: no 2 scripts can have the same parent",
-                    ScriptHash(clashing_hash)
-                )));
+                // Named only when the caller could already read it. The probe above has to be
+                // unscoped to be correct, but a hash alone reads a script's content back
+                // through `raw/h/{hash}`, which authorizes nothing per script — so echoing one
+                // the caller cannot see hands them a way to fetch it.
+                let visible_to_caller = sqlx::query_scalar!(
+                    "SELECT 1 FROM script WHERE hash = $1 AND workspace_id = $2",
+                    clashing_hash,
+                    &w_id
+                )
+                .fetch_optional(&mut *tx)
+                .await?
+                .is_some();
+                return Err(Error::BadRequest(if visible_to_caller {
+                    format!(
+                        "A script with hash {} with same parent_hash has been found. However, \
+                         the lineage must be linear: no 2 scripts can have the same parent",
+                        ScriptHash(clashing_hash)
+                    )
+                } else {
+                    "A script with the same parent_hash has been found. However, the lineage \
+                     must be linear: no 2 scripts can have the same parent"
+                        .to_owned()
+                }));
             };
 
             let ScriptWithStarred { script: ps, .. } =
@@ -1438,7 +1501,15 @@ async fn create_script_internal<'c>(
                 }
                 Some(_) | None => Ok(Some(ParentInfo {
                     p_hashes: ph,
-                    perms: ps.extra_perms,
+                    // A version adopted above was taken for its lineage, not its grants: a
+                    // retired path may be reused by a different script, which must not start
+                    // life holding an ACL nobody gave it — including one `delete/h` purged.
+                    // A parent the caller named still carries them, as unarchive expects.
+                    perms: if parent_adopted_from_retired_path {
+                        json!({})
+                    } else {
+                        ps.extra_perms
+                    },
                     p_path: ps.path,
                 })),
             };
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index ab10b9c19a..8a61f61cc1 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.805.0
+  version: 1.806.0
   title: Windmill API
 
   contact:
diff --git a/backend/windmill-types/src/scripts.rs b/backend/windmill-types/src/scripts.rs
index 19f6a06021..9a059da6e8 100644
--- a/backend/windmill-types/src/scripts.rs
+++ b/backend/windmill-types/src/scripts.rs
@@ -612,6 +612,7 @@ impl Hash for NewScript {
         self.priority.hash(state);
         self.timeout.hash(state);
         self.delete_after_use.hash(state);
+        self.delete_after_secs.hash(state);
         self.restart_unless_cancelled.hash(state);
         self.deployment_message.hash(state);
         self.visible_to_runner_only.hash(state);
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 2899ff694c..fcaeafa504 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.805.0";
+export const VERSION = "v1.806.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/TESTING.md b/cli/TESTING.md
index 235a95c4b1..b7a1e701b8 100644
--- a/cli/TESTING.md
+++ b/cli/TESTING.md
@@ -22,6 +22,12 @@ Pure local tests — no backend, no database. Uses `bunfig.unit.toml` (no preloa
 
 Examples: `git_unit`, `lint_command_unit`, `tar_creation_unit`, `workspace_conflicts_unit`
 
+`mock.module()` mocks the module for the whole `bun test` process, not for the file
+that installs it, and `mock.restore()` does not undo it. A file that mocks a module
+must hand back its real exports in `afterAll` (see
+`schedule_push_permissioned_as_unit`), or it silently rewires whichever file runs
+next — and the run order is the directory's, so it differs between Linux and Windows.
+
 ### Integration tests
 
 Require a running backend and PostgreSQL. The `setup.ts` preload builds the backend
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index d2afdeeee3..c44d9928f6 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -753,14 +753,10 @@ export async function handleFile(
     // create_script (which would bump the script hash) and instead route
     // through /acls/* via applyExtraPermsDiff.
     //
-    // No refetch is needed:
-    //  - folder perms are additive at auth time, never merged onto item rows;
-    //  - the body sent to create_script doesn't carry extra_perms, so a fresh
-    //    deploy of an existing path inherits the previous version's perms
-    //    unchanged. The diff against `remote` (captured before the deploy)
-    //    therefore matches what `wmill acl remove` would do — and the granular
-    //    ACL endpoint updates every matching row, so the inheritance on the
-    //    new version doesn't leave ghost entries.
+    // No refetch is needed: folder perms are additive at auth time and never merged
+    // onto item rows, and each branch above leaves the new version's perms where the
+    // diff expects them — the update branch names a parent, which carries them over,
+    // while the create branch has no `remote` to diff against and sends the whole set.
     await applyExtraPermsDiff(
       workspaceId,
       "script",
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index b5494b112c..3f94cd19fb 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.805.0";
+export const VERSION = "1.806.0";
diff --git a/cli/test/schedule_push_permissioned_as_unit.test.ts b/cli/test/schedule_push_permissioned_as_unit.test.ts
index 941415409d..17a1731494 100644
--- a/cli/test/schedule_push_permissioned_as_unit.test.ts
+++ b/cli/test/schedule_push_permissioned_as_unit.test.ts
@@ -5,7 +5,7 @@
  * that builds none silently reassigns the schedule to whoever ran it.
  */
 
-import { expect, test, describe, beforeEach, mock } from "bun:test";
+import { expect, test, describe, afterAll, beforeEach, mock } from "bun:test";
 import { mkdtemp, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -25,7 +25,27 @@ const REMOTE_SCHEDULE = () => ({
   permissioned_as: remotePermissionedAs,
 });
 
-mock.module("../gen/services.gen.ts", () => ({
+// A module mock is process-global and outlives the file that installs it, and
+// `mock.restore()` does not undo one: every mocked module has to be handed back
+// its real exports here, or whichever file `bun test` happens to run next gets
+// this file's stubs.
+const realModules: [string, Record<string, unknown>][] = [];
+async function mockModule(
+  specifier: string,
+  factory: (real: Record<string, unknown>) => Record<string, unknown>
+): Promise<void> {
+  const real = { ...((await import(specifier)) as Record<string, unknown>) };
+  realModules.push([specifier, real]);
+  mock.module(specifier, () => factory(real));
+}
+
+afterAll(() => {
+  for (const [specifier, real] of realModules) {
+    mock.module(specifier, () => real);
+  }
+});
+
+await mockModule("../gen/services.gen.ts", () => ({
   getSchedule: async () => REMOTE_SCHEDULE(),
   updateSchedule: async (a: unknown) => {
     updateScheduleCalls.push(a);
@@ -38,9 +58,8 @@ mock.module("../gen/services.gen.ts", () => ({
   }),
 }));
 
-const realContext = await import("../src/core/context.ts");
-mock.module("../src/core/context.ts", () => ({
-  ...realContext,
+await mockModule("../src/core/context.ts", (real) => ({
+  ...real,
   resolveWorkspace: async () => ({
     workspaceId: "w",
     name: "w",
@@ -49,9 +68,8 @@ mock.module("../src/core/context.ts", () => ({
   }),
 }));
 
-const realAuth = await import("../src/core/auth.ts");
-mock.module("../src/core/auth.ts", () => ({
-  ...realAuth,
+await mockModule("../src/core/auth.ts", (real) => ({
+  ...real,
   requireLogin: async () => ({}),
 }));
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index a200c878e3..ace58dbb23 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.805.0",
+	"version": "1.806.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.805.0",
+			"version": "1.806.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index d96e512c00..25c4b499a3 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.805.0",
+	"version": "1.806.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index e1f33d70f0..da6488fd51 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.805.0"
+wmill = ">=1.806.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 0bbc5a7a37..c67d5f9565 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.805.0
+  version: 1.806.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 1068d7b56c..6a90f75a04 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.805.0'
+    ModuleVersion     = '1.806.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index d00cd3223f..429d692efb 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.805.0"
+version = "1.806.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index abbf63201c..a090da4a7d 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.805.0",
+  "version": "1.806.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 1d3542703d..b92ef3a6e9 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.805.0",
+  "version": "1.806.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index c746f61dea..922393b92f 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.805.0
+1.806.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index cc63f3a090..ebaa50d283 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.805.0",
+  "version": "1.806.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.805.0",
+      "version": "1.806.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index d88bcdcf0c..e6484fc78b 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.805.0",
+  "version": "1.806.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",