diff --git a/docs/trust-validation/HOST-MATRIX.md b/docs/trust-validation/HOST-MATRIX.md
index 91689fb5..02a0e22a 100644
--- a/docs/trust-validation/HOST-MATRIX.md
+++ b/docs/trust-validation/HOST-MATRIX.md
@@ -7,8 +7,11 @@ and required live-check scope.
 The historical results below do not define the current required host set;
 see [Live-check scope](TRUST-VALIDATION-SPEC.md#live-check-scope).
 
-Release 1.4.0 uses frozen candidate `cab24a78d31ba41d9d1b357dd72aeae00775ef2d`
-from main on 2026-10-07, matching the failed Release run 37660774035. Every host in the release
+Release 1.5.0 uses frozen candidate `cab24a78d31ba41d9d1b357dd72aeae00775ef2d`
+from main on 2026-10-07. Its receipts were recorded as package 1.4.0 before the
+version change and stay in `evidence/releases/1.4.0/`; a version-only change
+does not invalidate them. The published 1.4.0 used candidate
+`6d3e38ed525831217cf7d4790674feebd8afc75f`; tag `v1.4.0` has its receipts. Every host in the release
 scope has a validated full-milestone receipt and a passing external CLI
 acceptance check. The complete release gate remains required before
 publication; see the [release contract](../../RELEASE.md#release-contract).
diff --git a/package-lock.json b/package-lock.json
index 13248404..1c8828a4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@opengsd/gsd-path",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@opengsd/gsd-path",
-      "version": "1.4.0",
+      "version": "1.5.0",
       "license": "MIT",
       "bin": {
         "gsd-path": "scripts/install.mjs"
diff --git a/package.json b/package.json
index 1986d0ae..06b00109 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-path",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Disk-backed AI agent pipeline. Docs: DOCS.md (start here), QUICK.md, FULL.md, UPDATE.md",
   "license": "MIT",
   "repository": {