diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 77c4c83..82c4e71 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -34,7 +34,7 @@ body:
     attributes:
       label: Version
       description: Output of `dikw version`.
-      placeholder: "0.6.4"
+      placeholder: "0.6.5"
     validations:
       required: true
   - type: dropdown
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a539945..6cc8750 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,23 @@ on each entry call out exactly what shape changes break.
 
 ## Unreleased
 
+## 0.6.5 — Default scaffold ships Gitee embed + rerank; eval cache keys retrieval config and surfaces absolute relevance scores
+
+### Added
+
+- **Eval rows surface absolute relevance scores for OOD calibration.**
+  (#249) Each retrieval-eval per-query and negative row now carries
+  `top1_score` (the top hit's score) and `top1_vec_cosine` — the
+  reranker/fusion-independent raw top-1 vector cosine, captured by an
+  eval-internal `HybridSearcher.top_vector_cosine` probe (the production
+  `search()` path and its ranking are untouched). Fusion scores (RRF is
+  rank-based; combsum/combmnz are per-leg min-max normalized) can't carry an
+  absolute magnitude, so `expect_none` / out-of-distribution robustness was
+  previously immeasurable from rank order alone; the absolute cosine makes it
+  observable (covered query high, OOD query low). The vector probe is skipped
+  for pure-`bm25` ablations so they stay embedding-free. A score-based OOD
+  *metric* is deferred — this release only surfaces the signals.
+
 ### Changed
 
 - **Default scaffold ships Gitee embed + rerank; unified rerank/embed
@@ -26,6 +43,20 @@ on each entry call out exactly what shape changes break.
   bad key/model) still fail fast on both the read path (→ 500) and the write
   path (ingest aborts) — the fail-fast-on-misconfig invariant is unchanged.
 
+### Fixed
+
+- **Eval snapshot cache keys the ingest-time tokenizer and reads query-time
+  retrieval config live.** (#250) The eval corpus-snapshot cache key omitted
+  `RetrievalConfig`, so under the default `--cache read_write` changing any
+  retrieval knob (`rrf_k` / weights / `fusion` / `rerank_enabled` / `graph_*`)
+  and re-running silently hit the stale snapshot and reused the *previous*
+  config — no error, wrong numbers, exactly on the retrieval-ablation workflow.
+  The cache key now includes the only ingest-time retrieval field,
+  `cjk_tokenizer` (a change forces re-ingest); every search-time knob is read
+  from the live config on each `_run_queries`, so ablations sharing one
+  `cache_root` are now both fast and correct. A defensive guard re-raises if a
+  cache hit's baked tokenizer ever disagrees with the live one.
+
 ## 0.6.4 — K-layer system prompts extracted to packaged `.md`; product self-reference unified to `dikw`
 
 ### Changed
diff --git a/docs/deployment-docker.md b/docs/deployment-docker.md
index ea953b1..4ef5c83 100644
--- a/docs/deployment-docker.md
+++ b/docs/deployment-docker.md
@@ -42,8 +42,8 @@ keeps the quick-start under a screenful.
   against it too:
 
   ```bash
-  docker run --rm -v ./base:/base ghcr.io/opendikw/dikw-core:0.6.4 init /base
-  docker run --rm ghcr.io/opendikw/dikw-core:0.6.4 version
+  docker run --rm -v ./base:/base ghcr.io/opendikw/dikw-core:0.6.5 init /base
+  docker run --rm ghcr.io/opendikw/dikw-core:0.6.5 version
   ```
 
   There is intentionally **no floating `:latest`** — downstream pins an
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 68174c7..b5076e9 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -23,7 +23,7 @@ dikw init my-base --description "my research base"
 cd my-base
 ```
 
-Pin an exact version (`uv pip install 'dikw-core[postgres]==0.6.4'`) so your
+Pin an exact version (`uv pip install 'dikw-core[postgres]==0.6.5'`) so your
 client stays on the same release as the server it talks to — `dikw client`
 runs a [version handshake](server.md) and hard-fails on a mismatch.
 
diff --git a/examples/docker/.env.example b/examples/docker/.env.example
index a416985..e700401 100644
--- a/examples/docker/.env.example
+++ b/examples/docker/.env.example
@@ -2,7 +2,7 @@
 # released version (https://github.com/OpenDIKW/dikw-core/releases); compose
 # fails closed until it's set, so the debug environment never rides a stale
 # default. Bump deliberately when you want to debug against a newer release.
-DIKW_VERSION=0.6.4
+DIKW_VERSION=0.6.5
 
 # Required — leave blank to force compose to fail-closed until set.
 # Generate strong values, e.g. `openssl rand -base64 24` for both.
diff --git a/examples/docker/docker-compose.yml b/examples/docker/docker-compose.yml
index c14bec3..1dfb701 100644
--- a/examples/docker/docker-compose.yml
+++ b/examples/docker/docker-compose.yml
@@ -26,7 +26,7 @@ services:
     # (``docker compose up --build``); it does NOT auto-pull. Its ``args``
     # forward the same DIKW_VERSION so a local build matches the pinned tag
     # instead of the Dockerfile's ARG default.
-    image: ghcr.io/opendikw/dikw-core:${DIKW_VERSION:?set DIKW_VERSION in .env to a released version, e.g. 0.6.4}
+    image: ghcr.io/opendikw/dikw-core:${DIKW_VERSION:?set DIKW_VERSION in .env to a released version, e.g. 0.6.5}
     build:
       context: .
       dockerfile: Dockerfile
diff --git a/pyproject.toml b/pyproject.toml
index f987ef1..b21433d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dikw-core"
-version = "0.6.4"
+version = "0.6.5"
 description = "AI-native knowledge engine across the DIKW pyramid (Data → Information → Knowledge → Wisdom)"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/uv.lock b/uv.lock
index bd61013..57f0b99 100644
--- a/uv.lock
+++ b/uv.lock
@@ -263,7 +263,7 @@ wheels = [
 
 [[package]]
 name = "dikw-core"
-version = "0.6.4"
+version = "0.6.5"
 source = { editable = "." }
 dependencies = [
     { name = "anthropic" },