diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..d7c79ff
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,23 @@
+# Keep repository text portable; never normalise binary assets.
+* text=auto eol=lf
+*.py text eol=lf
+*.md text eol=lf
+*.rst text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.toml text eol=lf
+*.json text eol=lf
+*.png binary
+*.PNG binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.pdf binary
+*.npz binary
+*.npy binary
+*.xlsx binary
+*.xls binary
+*.docx binary
+*.pkl binary
+*.pickle binary
+*.parquet binary
diff --git a/.github/scripts/build_docs_redirects.py b/.github/scripts/build_docs_redirects.py
new file mode 100644
index 0000000..97c4626
--- /dev/null
+++ b/.github/scripts/build_docs_redirects.py
@@ -0,0 +1,158 @@
+"""Build a small GitHub Pages redirect site from the verified Sphinx HTML paths.
+
+SHARED CI CORE v1.2. Keep this file identical in the four legacy Pages repositories.
+Only HTTPS Read the Docs destinations are accepted. No documentation or assets are copied.
+"""
+
+import argparse
+import html
+import json
+from pathlib import Path, PurePosixPath
+import re
+from urllib.parse import quote, urlsplit
+
+
+def validate_base_url(value: str) -> str:
+    """Accept an absolute RTD version root without credentials, query, or fragment."""
+    parsed = urlsplit(value)
+    hostname = parsed.hostname or ""
+    if (
+        parsed.scheme != "https"
+        or not hostname.endswith(".readthedocs.io")
+        or parsed.netloc != hostname
+        or parsed.query
+        or parsed.fragment
+        or not re.fullmatch(r"(?:/[A-Za-z0-9_-]+)*/", parsed.path)
+    ):
+        raise ValueError("base URL must be an HTTPS readthedocs.io root ending in /")
+    return value
+
+
+def validate_project_prefix(value: str) -> str:
+    """Accept one GitHub project path segment, with leading and trailing slashes."""
+    if not re.fullmatch(r"/[A-Za-z0-9_-][A-Za-z0-9_.-]*/", value):
+        raise ValueError("project prefix must be one repository name between slashes")
+    return value
+
+
+def destination(base_url: str, relative: str) -> str:
+    """Map an HTML filename to its fixed RTD destination, encoding path characters."""
+    validate_base_url(base_url)
+    path = PurePosixPath(relative)
+    if path.is_absolute() or ".." in path.parts or "\\" in relative:
+        raise ValueError("HTML paths must stay beneath the source directory")
+    if relative == "index.html":
+        return base_url
+    return base_url + "/".join(quote(part, safe="-._~") for part in path.parts)
+
+
+def script_json(value: str) -> str:
+    """Quote strings for an inline script without permitting an HTML closing tag."""
+    return (
+        json.dumps(value, ensure_ascii=True)
+        .replace("<", "\\u003c")
+        .replace(">", "\\u003e")
+        .replace("&", "\\u0026")
+    )
+
+
+def redirect_script(target: str, project_prefix: str, fallback: bool = False) -> str:
+    """Preserve the browser query and fragment; keep fallback paths on the RTD host."""
+    prefix = script_json(validate_project_prefix(project_prefix))
+    if not fallback:
+        return (
+            f"window.location.replace({script_json(target)}"
+            " + window.location.search + window.location.hash);"
+        )
+    return f"""(() => {{
+  const base = {script_json(validate_base_url(target))};
+  const prefix = {prefix};
+  const pathname = window.location.pathname;
+  let relative = pathname.startsWith(prefix) ? pathname.slice(prefix.length) : "";
+  let suffix = "";
+  try {{
+    const parts = relative.split("/").filter(Boolean).map(decodeURIComponent);
+    const unsafe = parts.some(part =>
+      part === "." || part === ".." || /[\\\\/\\x00-\\x1f]/.test(part));
+    if (!unsafe) {{
+      suffix = parts.map(encodeURIComponent).join("/");
+      if (relative.endsWith("/") && suffix) suffix += "/";
+    }}
+  }} catch (_) {{
+    suffix = "";
+  }}
+  if (suffix === "index.html") suffix = "";
+  window.location.replace(base + suffix + window.location.search + window.location.hash);
+}})();"""
+
+
+def render_redirect(target: str, project_prefix: str, fallback: bool = False) -> str:
+    """Render an accessible redirect with canonical, no-JavaScript, and link fallbacks."""
+    escaped = html.escape(target, quote=True)
+    script = redirect_script(target, project_prefix, fallback=fallback)
+    return f"""<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="robots" content="noindex,follow">
+  <title>Documentation moved</title>
+  <link rel="canonical" href="{escaped}">
+  <noscript><meta http-equiv="refresh" content="0; url={escaped}"></noscript>
+  <script>{script}</script>
+</head>
+<body>
+  <h1>Documentation moved</h1>
+  <p><a href="{escaped}">Continue to the documentation on Read the Docs.</a></p>
+</body>
+</html>
+"""
+
+
+def build_redirects(source: Path, output: Path, base_url: str, project_prefix: str) -> int:
+    """Write redirects to an empty output directory without modifying source content."""
+    validate_base_url(base_url)
+    validate_project_prefix(project_prefix)
+    source, output = source.resolve(), output.resolve()
+    if source == output or source in output.parents or output in source.parents:
+        raise ValueError("source and output directories must not overlap")
+    if not (source / "index.html").is_file():
+        raise ValueError("source must contain a rendered Sphinx index.html")
+    if output.exists() and any(output.iterdir()):
+        raise ValueError("output must be empty; use a dedicated build directory")
+    pages = sorted(source.rglob("*.html"))
+    for page in pages:
+        if page.is_symlink() or source not in page.resolve().parents:
+            raise ValueError("source HTML must not link outside the rendered documentation")
+    output.mkdir(parents=True, exist_ok=True)
+    count = 0
+    for page in pages:
+        relative = page.relative_to(source)
+        if relative.as_posix() == "404.html":
+            continue
+        target = destination(base_url, relative.as_posix())
+        path = output / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(render_redirect(target, project_prefix), encoding="utf-8")
+        count += 1
+    (output / "404.html").write_text(
+        render_redirect(base_url, project_prefix, fallback=True), encoding="utf-8"
+    )
+    (output / ".nojekyll").touch()
+    return count
+
+
+def main() -> None:
+    """Build the redirect payload using explicit repository and destination arguments."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--source", type=Path, required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--base-url", required=True)
+    parser.add_argument("--project-prefix", required=True)
+    args = parser.parse_args()
+    count = build_redirects(args.source, args.output, args.base_url, args.project_prefix)
+    print(f"Built {count} page redirects and a 404 fallback to {args.base_url}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/scripts/check_stack_imports.py b/.github/scripts/check_stack_imports.py
new file mode 100644
index 0000000..44a3113
--- /dev/null
+++ b/.github/scripts/check_stack_imports.py
@@ -0,0 +1,252 @@
+"""Check stack dependencies and optional import boundaries without importing source."""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import fnmatch
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+def module_imports(tree):
+    """Yield imports executed by a module body, including class/try/if bodies."""
+
+    def walk(node):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)):
+            return
+        if isinstance(node, ast.If) and (
+            isinstance(node.test, ast.Name)
+            and node.test.id == "TYPE_CHECKING"
+            or isinstance(node.test, ast.Attribute)
+            and node.test.attr == "TYPE_CHECKING"
+        ):
+            for child in node.orelse:
+                yield from walk(child)
+            return
+        if isinstance(node, (ast.Import, ast.ImportFrom)):
+            yield node
+        for child in ast.iter_child_nodes(node):
+            yield from walk(child)
+
+    yield from walk(tree)
+
+
+def names(node):
+    """Return absolute import names; relative imports are internal graph edges."""
+    if isinstance(node, ast.Import):
+        return [alias.name for alias in node.names]
+    return [node.module or ""] if not node.level else []
+
+
+def permitted(path, module, rules, function=None):
+    """Exceptions name both a source path and the optional module it may load."""
+    return any(
+        fnmatch.fnmatchcase(path, rule["path"])
+        and module in rule["modules"]
+        and ("function" not in rule or rule["function"] == function)
+        for rule in rules
+    )
+
+
+def audit(root, policy):
+    """Return concrete violations and the number of parsed package modules."""
+    package_root = root / "src" / policy["import"]
+    modules = {}
+    for path in package_root.rglob("*.py"):
+        relative = path.relative_to(root).as_posix()
+        name = ".".join(path.relative_to(root / "src").with_suffix("").parts)
+        if name.endswith(".__init__"):
+            name = name[:-9]
+        modules[name] = (
+            relative,
+            ast.parse(path.read_text(encoding="utf-8-sig"), filename=relative),
+        )
+    errors, graph, isolated = [], {}, set()
+    forbidden = set(policy["forbidden"])
+    optional = set(policy["optional"])
+    for module, (path, tree) in modules.items():
+        parents = {
+            child: parent for parent in ast.walk(tree) for child in ast.iter_child_nodes(parent)
+        }
+        for node in ast.walk(tree):
+            if isinstance(node, (ast.Import, ast.ImportFrom)):
+                parent, function = node, None
+                while parent in parents:
+                    parent = parents[parent]
+                    if isinstance(parent, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                        function = parent.name
+                        break
+                for imported in names(node):
+                    top = imported.split(".")[0]
+                    if top in forbidden and not permitted(
+                        path, top, policy["development_imports"], function
+                    ):
+                        errors.append(f"{path}:{node.lineno}: forbidden stack import {top}")
+        top_level = list(module_imports(tree))
+        edges = set()
+        for node in top_level:
+            for imported in names(node):
+                top = imported.split(".")[0]
+                if top in optional:
+                    if permitted(path, top, policy["optional_adapters"]):
+                        isolated.add(module)
+                    else:
+                        errors.append(
+                            f"{path}:{node.lineno}: optional stack import {top} at module level"
+                        )
+            targets = []
+            if isinstance(node, ast.Import):
+                targets = [alias.name for alias in node.names]
+            elif not node.level:
+                targets = [node.module or ""] + [
+                    f"{node.module}.{alias.name}" for alias in node.names
+                ]
+            else:
+                package = module if path.endswith("/__init__.py") else module.rpartition(".")[0]
+                parts = package.split(".")
+                base = ".".join(parts[: len(parts) - node.level + 1])
+                target = ".".join(part for part in (base, node.module) if part)
+                targets = [target] + [f"{target}.{alias.name}" for alias in node.names]
+            for target in targets:
+                pieces = target.split(".")
+                edges.update(
+                    ".".join(pieces[:i])
+                    for i in range(1, len(pieces) + 1)
+                    if ".".join(pieces[:i]) in modules
+                )
+        graph[module] = edges
+    pending, visited = [policy["import"]], set()
+    while pending:
+        module = pending.pop()
+        if module in visited:
+            continue
+        visited.add(module)
+        pending.extend(graph.get(module, set()) - visited)
+    for module in sorted(isolated & visited):
+        errors.append(
+            f"{modules[module][0]}: optional adapter is reachable during package-root import"
+        )
+    return sorted(set(errors)), len(modules)
+
+
+def check_root(root, policy):
+    """Test root import in a fresh process while recording blocked optional imports."""
+    if not policy["optional"]:
+        return
+    probe = """import importlib.abc, json, sys
+optional, source, package = json.loads(sys.argv[1])
+attempts = []
+class BlockOptional(importlib.abc.MetaPathFinder):
+    def find_spec(self, fullname, path=None, target=None):
+        if fullname.split('.')[0] in optional:
+            attempts.append(fullname)
+            raise ModuleNotFoundError('optional stack import blocked: ' + fullname)
+sys.meta_path.insert(0, BlockOptional())
+sys.path.insert(0, source)
+__import__(package)
+if attempts:
+    raise SystemExit('package-root import attempted optional modules: ' + ', '.join(attempts))
+"""
+    subprocess.run(
+        [
+            sys.executable,
+            "-B",
+            "-c",
+            probe,
+            json.dumps([policy["optional"], str(root / "src"), policy["import"]]),
+        ],
+        cwd=root,
+        check=True,
+    )
+
+
+class BoundaryTests(unittest.TestCase):
+    """Known-bad imports, allowed local loads, and adapter leakage regressions."""
+
+    def check_source(self, source, adapter=None, exception=False):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            package = root / "src/pkg"
+            package.mkdir(parents=True)
+            (package / "__init__.py").write_text(source, encoding="utf-8")
+            if adapter is not None:
+                (package / "adapter.py").write_text(adapter, encoding="utf-8")
+            policy = {
+                "import": "pkg",
+                "optional": ["optional_stack"],
+                "forbidden": ["forbidden_stack"],
+                "development_imports": [],
+                "optional_adapters": [{"path": "src/pkg/adapter.py", "modules": ["optional_stack"]}]
+                if exception
+                else [],
+            }
+            return audit(root, policy)[0]
+
+    def test_module_scope_is_rejected(self):
+        self.assertTrue(self.check_source("import optional_stack\n"))
+
+    def test_function_local_import_is_allowed(self):
+        self.assertFalse(self.check_source("def load():\n    import optional_stack\n"))
+
+    def test_guarded_module_import_is_still_rejected(self):
+        self.assertTrue(
+            self.check_source("try:\n    import optional_stack\nexcept ImportError:\n    pass\n")
+        )
+
+    def test_type_checking_only_import_is_allowed(self):
+        self.assertFalse(
+            self.check_source(
+                "from typing import TYPE_CHECKING\nif TYPE_CHECKING:\n    import optional_stack\n"
+            )
+        )
+
+    def test_isolated_named_adapter_is_allowed(self):
+        self.assertFalse(self.check_source("", "import optional_stack\n", True))
+
+    def test_root_reachable_adapter_is_rejected(self):
+        self.assertTrue(
+            self.check_source("from . import adapter\n", "import optional_stack\n", True)
+        )
+
+    def test_forbidden_import_is_not_hidden_by_local_scope(self):
+        self.assertTrue(self.check_source("def load():\n    import forbidden_stack\n"))
+
+    def test_maintainer_exception_requires_named_function_and_module(self):
+        rules = [
+            {"path": "src/pkg/universe.py", "function": "generate_data", "modules": ["bbg_fetch"]}
+        ]
+        self.assertTrue(permitted("src/pkg/universe.py", "bbg_fetch", rules, "generate_data"))
+        self.assertFalse(permitted("src/pkg/universe.py", "bbg_fetch", rules, "other"))
+        self.assertFalse(permitted("src/pkg/universe.py", "qis", rules, "generate_data"))
+
+
+def main():
+    """Run static policy, optional root-import probe, or the self-contained tests."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=Path(__file__).resolve().parents[2])
+    parser.add_argument("--self-test", action="store_true")
+    parser.add_argument("--check-root", action="store_true")
+    args = parser.parse_args()
+    if args.self_test:
+        result = unittest.TextTestRunner(verbosity=2).run(
+            unittest.defaultTestLoader.loadTestsFromTestCase(BoundaryTests)
+        )
+        return 0 if result.wasSuccessful() else 1
+    policy = json.loads((args.root / ".github/stack-policy.json").read_text(encoding="utf-8"))
+    errors, count = audit(args.root, policy)
+    if errors:
+        print("\n".join(errors))
+        return 1
+    if args.check_root:
+        check_root(args.root, policy)
+    print(f"Stack import policy passed ({count} modules)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/.github/scripts/publish_tag.py b/.github/scripts/publish_tag.py
new file mode 100644
index 0000000..c667a9b
--- /dev/null
+++ b/.github/scripts/publish_tag.py
@@ -0,0 +1,53 @@
+"""Validate a prepared release; --push creates/pushes only its named tag.
+
+Run after the release metadata commit is on origin/main. This does not build locally,
+create an environment, upload a package, or create a GitHub Release page. The pushed
+tag triggers release.yml. Omitting --push is a read-only dry run.
+"""
+
+import argparse
+import subprocess
+from pathlib import Path
+
+from release_guard import run, validate_metadata
+
+
+def main() -> None:
+    """Require a clean main commit and matching remote identity before a named tag push."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("tag")
+    parser.add_argument("--push", action="store_true")
+    args = parser.parse_args()
+    root = Path(run("git", "rev-parse", "--show-toplevel"))
+    project = validate_metadata(root, args.tag)
+    if run("git", "status", "--porcelain", cwd=root):
+        raise SystemExit("Commit the intended changes first; the release checkout must be clean")
+    if run("git", "branch", "--show-current", cwd=root) != "main":
+        raise SystemExit("Run this helper from main after merging the release metadata")
+    sha = run("git", "rev-parse", "HEAD", cwd=root)
+    print(f"{project['name']} {project['version']}: {args.tag} -> {sha}")
+    if not args.push:
+        print(
+            "Dry run. --push verifies remote main, creates the named tag if absent, and pushes it."
+        )
+        return
+    remote = run("git", "ls-remote", "origin", "refs/heads/main", cwd=root).split()
+    if not remote or remote[0] != sha:
+        raise SystemExit("Push the verified main commit before requesting its release tag")
+    existing = subprocess.run(
+        ["git", "rev-parse", "--verify", f"refs/tags/{args.tag}^{{commit}}"],
+        cwd=root,
+        capture_output=True,
+        text=True,
+    )
+    if existing.returncode == 0:
+        if existing.stdout.strip() != sha:
+            raise SystemExit("Existing tag points elsewhere; refusing to move it")
+    else:
+        run("git", "tag", "-a", args.tag, "-m", f"Release {project['version']}", cwd=root)
+    run("git", "push", "origin", f"refs/tags/{args.tag}:refs/tags/{args.tag}", cwd=root)
+    print("Named tag pushed. Follow the Publish package workflow; GitHub Release page is optional.")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/scripts/release_guard.py b/.github/scripts/release_guard.py
new file mode 100644
index 0000000..b2ca3ba
--- /dev/null
+++ b/.github/scripts/release_guard.py
@@ -0,0 +1,320 @@
+"""Release-v1: validate one tag, inspect built artifacts and plan digest-safe uploads.
+
+This helper never publishes packages or creates GitHub Release pages. GitHub builds
+are isolated from the OIDC publishing job. All subprocess arguments are structured.
+"""
+
+from __future__ import annotations
+
+import argparse
+import datetime as dt
+import email.parser
+import hashlib
+import json
+import os
+import re
+import shutil
+import subprocess
+import tarfile
+import tomllib
+import urllib.error
+import urllib.request
+import zipfile
+from pathlib import Path, PurePosixPath
+
+TAG_RE = re.compile(r"v(\d+\.\d+\.\d+(?:(?:a|b|rc)\d+)?(?:\.post\d+)?(?:\.dev\d+)?)")
+
+
+def version_from_tag(tag: str) -> str:
+    """Reject refs, shell fragments, wildcard tags and ambiguous version syntax."""
+    match = TAG_RE.fullmatch(tag)
+    if not match:
+        raise ValueError("Expected a named tag such as v1.2.3, v1.2.3rc1 or v1.2.3.dev1")
+    return match[1]
+
+
+def run(*args: str, cwd: Path | None = None) -> str:
+    """Run an explicit command and return stdout with a bounded runtime."""
+    return subprocess.run(
+        list(args),
+        cwd=cwd,
+        check=True,
+        text=True,
+        encoding="utf-8",
+        capture_output=True,
+        timeout=1800,
+    ).stdout.strip()
+
+
+def cff_scalar(source: str, key: str) -> str:
+    """Read a simple scalar and reject duplicate/multiline ambiguous release values."""
+    values = re.findall(rf"^{re.escape(key)}:\s*([^\n]+)$", source, flags=re.MULTILINE)
+    if len(values) != 1:
+        raise ValueError(f"CITATION.cff requires one {key}")
+    value = values[0].strip().split(" #", 1)[0].strip()
+    if value.startswith('"'):
+        return json.loads(value)
+    if value.startswith("'") and value.endswith("'"):
+        return value[1:-1].replace("''", "'")
+    if not re.fullmatch(r"[0-9A-Za-z.+-]+", value):
+        raise ValueError(f"Unsupported CFF {key} scalar")
+    return value
+
+
+def validate_metadata(root: Path, tag: str) -> dict:
+    """Validate source release identity and the recorded intended release date."""
+    version = version_from_tag(tag)
+    project = tomllib.loads((root / "pyproject.toml").read_text(encoding="utf-8"))["project"]
+    if project["version"] != version:
+        raise ValueError(f"Tag {tag} differs from project version {project['version']}")
+    cff = (root / "CITATION.cff").read_text(encoding="utf-8")
+    if cff_scalar(cff, "version") != version:
+        raise ValueError("CITATION.cff version differs from tag")
+    intended = dt.date.fromisoformat(cff_scalar(cff, "date-released"))
+    if intended > dt.datetime.now(dt.timezone.utc).date():
+        raise ValueError("CITATION.cff intended release date is in the future")
+    changelog = (root / "CHANGELOG.md").read_text(encoding="utf-8")
+    pattern = rf"^##\s+(?:\[{re.escape(version)}\]|{re.escape(version)})(?:\s+.*)?$"
+    if not re.search(pattern, changelog, flags=re.MULTILINE):
+        raise ValueError("CHANGELOG.md has no heading for the tagged version")
+    return project
+
+
+def checkout_tag(root: Path, tag: str, expected_sha: str | None = None) -> dict:
+    """Resolve and check ancestry before checking out exactly one release commit."""
+    version_from_tag(tag)
+    sha = run("git", "rev-parse", "--verify", f"refs/tags/{tag}^{{commit}}", cwd=root)
+    if expected_sha is not None:
+        if not re.fullmatch(r"[0-9a-f]{40}", expected_sha):
+            raise ValueError("Invalid triggering object SHA")
+        triggered = run("git", "rev-parse", "--verify", f"{expected_sha}^{{commit}}", cwd=root)
+        if triggered != sha:
+            raise ValueError("Tag moved after the triggering push; refusing a different commit")
+    run("git", "merge-base", "--is-ancestor", sha, "refs/remotes/origin/main", cwd=root)
+    run("git", "checkout", "--detach", sha, cwd=root)
+    if run("git", "rev-parse", "HEAD", cwd=root) != sha:
+        raise ValueError("Checkout does not match the resolved tag")
+    project = validate_metadata(root, tag)
+    epoch = run("git", "show", "-s", "--format=%ct", sha, cwd=root)
+    return {"sha": sha, "version": project["version"], "epoch": epoch}
+
+
+def normalized(name: str) -> str:
+    """Normalize a PyPI distribution name."""
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def requirement_key(requirement: str) -> str:
+    """Canonicalize names and specifier order for the stack's core requirements."""
+    match = re.fullmatch(r"([A-Za-z0-9_.-]+)(\[[^]]+\])?([^;]*)(?:;(.*))?", requirement.strip())
+    if not match:
+        raise ValueError(f"Unsupported requirement metadata: {requirement}")
+    specifiers = ",".join(sorted(x.strip() for x in match[3].split(",") if x.strip()))
+    marker = re.sub(r"\s+", "", match[4] or "").replace("'", '"')
+    return normalized(match[1]) + (match[2] or "") + specifiers + (";" + marker if marker else "")
+
+
+def inspect_artifacts(dist: Path, project: dict, import_name: str) -> dict[str, str]:
+    """Check one wheel plus one sdist and compute immutable filename/hash identity."""
+    wheels, sdists = list(dist.glob("*.whl")), list(dist.glob("*.tar.gz"))
+    if len(wheels) != 1 or len(sdists) != 1:
+        raise ValueError("Expected exactly one wheel and one source distribution")
+    with zipfile.ZipFile(wheels[0]) as wheel:
+        metadata_names = [n for n in wheel.namelist() if n.endswith(".dist-info/METADATA")]
+        if len(metadata_names) != 1 or f"{import_name}/__init__.py" not in wheel.namelist():
+            raise ValueError("Wheel lacks the expected package or unique METADATA")
+        wheel_metadata = wheel.read(metadata_names[0]).decode("utf-8")
+        wheel_paths = set(wheel.namelist())
+        wheel_metadata_root = metadata_names[0].rsplit("/", 1)[0]
+    with tarfile.open(sdists[0], "r:gz") as archive:
+        candidates = [
+            m
+            for m in archive.getmembers()
+            if m.name.count("/") == 1 and m.name.endswith("/PKG-INFO")
+        ]
+        if len(candidates) != 1:
+            raise ValueError("Sdist lacks unique top-level PKG-INFO")
+        sdist_metadata = archive.extractfile(candidates[0]).read().decode("utf-8")
+        sdist_paths = set(archive.getnames())
+        sdist_root = candidates[0].name.split("/", 1)[0]
+    source_paths = {name.removeprefix(sdist_root + "/") for name in sdist_paths}
+    if f"src/{import_name}/__init__.py" not in source_paths:
+        raise ValueError("Sdist lacks the expected source package")
+    prohibited = {
+        ".idea",
+        ".git",
+        ".venv",
+        "venv",
+        "__pycache__",
+        ".pytest_cache",
+        ".ruff_cache",
+        ".mypy_cache",
+        "run_local",
+    }
+    for archive_name, paths in (("Wheel", wheel_paths), ("Sdist", source_paths)):
+        for name in paths:
+            parts = PurePosixPath(name).parts
+            runner = (
+                import_name in {"privateassets", "goal_based_allocation"}
+                and import_name in parts
+                and "run" in parts
+            )
+            if (
+                prohibited.intersection(parts)
+                or name.endswith((".pyc", ".pyo", ".nbc", ".nbi"))
+                or runner
+            ):
+                raise ValueError(
+                    f"{archive_name} contains a development runner, environment or cache: {name}"
+                )
+    for metadata in (wheel_metadata, sdist_metadata):
+        parsed = email.parser.Parser().parsestr(metadata)
+        if (
+            normalized(parsed["Name"]) != normalized(project["name"])
+            or parsed["Version"] != project["version"]
+        ):
+            raise ValueError("Built artifact identity differs from source/tag")
+        if parsed["Summary"] != project["description"]:
+            raise ValueError("Built artifact summary differs from source")
+        urls = dict(value.split(", ", 1) for value in parsed.get_all("Project-URL", []))
+        if urls != project.get("urls", {}):
+            raise ValueError("Built artifact project URLs differ from source")
+        if parsed["Requires-Python"] != project.get("requires-python"):
+            raise ValueError("Built artifact Requires-Python differs from source")
+        core = {
+            requirement_key(value)
+            for value in parsed.get_all("Requires-Dist", [])
+            if not re.search(r"\bextra\s*==", value)
+        }
+        if core != {requirement_key(value) for value in project.get("dependencies", [])}:
+            raise ValueError("Built artifact core dependency metadata differs from source")
+        if set(parsed.get_all("Provides-Extra", [])) != set(
+            project.get("optional-dependencies", {})
+        ):
+            raise ValueError("Built artifact extra names differ from source")
+        if isinstance(project.get("license"), str):
+            if parsed["License-Expression"] != project["license"]:
+                raise ValueError("Built artifact License-Expression differs from source")
+            licenses = parsed.get_all("License-File", [])
+            if not licenses:
+                raise ValueError("Built artifact declares no shipped license file")
+            for license_file in licenses:
+                if (
+                    f"{wheel_metadata_root}/licenses/{license_file}" not in wheel_paths
+                    or f"{sdist_root}/{license_file}" not in sdist_paths
+                ):
+                    raise ValueError(
+                        f"Declared license file is missing from wheel or sdist: {license_file}"
+                    )
+    return {p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in wheels + sdists}
+
+
+def pypi_files(name: str, version: str) -> list[dict] | None:
+    """A confirmed 404 means new version; every other API error blocks publication."""
+    request = urllib.request.Request(
+        f"https://pypi.org/pypi/{name}/{version}/json",
+        headers={"User-Agent": "ArturSepp-release-v1"},
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=30) as response:
+            data = json.load(response)
+    except urllib.error.HTTPError as error:
+        if error.code == 404:
+            return None
+        raise
+    if not isinstance(data, dict) or not isinstance(data.get("urls"), list) or not data["urls"]:
+        raise ValueError("PyPI returned an unexpected or empty artifact list")
+    return data["urls"]
+
+
+def pending_uploads(
+    hashes: dict[str, str], existing: list[dict] | None, retry_existing: bool = False
+) -> list[str]:
+    """Require matching digests; backfill tag pushes never append historical files."""
+    if existing is None:
+        return sorted(hashes)
+    remote = {f["filename"]: f["digests"]["sha256"] for f in existing}
+    if len(remote) != len(existing):
+        raise ValueError("Duplicate PyPI artifact filenames")
+    if not remote.keys() <= hashes.keys():
+        raise ValueError("Existing release has unexpected artifact filenames")
+    for name, digest in remote.items():
+        if hashes[name] != digest:
+            raise ValueError(f"Immutable PyPI artifact differs: {name}; never skip this mismatch")
+    pending = sorted(hashes.keys() - remote.keys())
+    if pending and not retry_existing:
+        raise ValueError(
+            "Existing version is incomplete: use explicit retry_existing dispatch "
+            "after digest review"
+        )
+    return pending
+
+
+def output(values: dict) -> None:
+    """Emit simple validated GitHub outputs and a readable local result."""
+    if os.environ.get("GITHUB_OUTPUT"):
+        with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as stream:
+            for key, value in values.items():
+                if "\n" in str(value):
+                    raise ValueError("Multiline output is not allowed")
+                stream.write(f"{key}={value}\n")
+    print(json.dumps(values, indent=2))
+
+
+def main() -> None:
+    """Run only the explicit stage selected by the workflow or local maintainer."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("command", choices=["checkout", "check", "artifacts"])
+    parser.add_argument("--tag", required=True)
+    parser.add_argument("--root", type=Path, default=Path.cwd())
+    parser.add_argument("--dist", type=Path)
+    parser.add_argument("--import-name")
+    parser.add_argument("--pending", type=Path)
+    parser.add_argument("--retry-existing", action="store_true")
+    args = parser.parse_args()
+    if args.command == "checkout":
+        if (
+            os.environ.get("GITHUB_EVENT_NAME") == "workflow_dispatch"
+            and os.environ.get("GITHUB_REF") != "refs/heads/main"
+        ):
+            raise ValueError("Dispatch publishing from the main workflow only")
+        expected = (
+            os.environ.get("GITHUB_SHA") if os.environ.get("GITHUB_EVENT_NAME") == "push" else None
+        )
+        result = checkout_tag(args.root, args.tag, expected)
+        if os.environ.get("GITHUB_ENV"):
+            with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as stream:
+                stream.write(f"SOURCE_DATE_EPOCH={result['epoch']}\n")
+        output(result)
+    elif args.command == "check":
+        project = validate_metadata(args.root, args.tag)
+        output({"name": project["name"], "version": project["version"]})
+    else:
+        if not args.dist or not args.pending or not args.import_name:
+            parser.error("artifacts requires --dist, --pending, --import-name")
+        project = validate_metadata(args.root, args.tag)
+        hashes = inspect_artifacts(args.dist, project, args.import_name)
+        pending = pending_uploads(
+            hashes, pypi_files(project["name"], project["version"]), args.retry_existing
+        )
+        args.pending.mkdir(parents=True, exist_ok=False)
+        for filename in pending:
+            shutil.copy2(args.dist / filename, args.pending / filename)
+        (args.dist / "release-manifest.json").write_text(
+            json.dumps(
+                {
+                    "tag": args.tag,
+                    "sha": run("git", "rev-parse", "HEAD", cwd=args.root),
+                    "sha256": hashes,
+                    "pending": pending,
+                },
+                indent=2,
+            )
+            + "\n",
+            encoding="utf-8",
+        )
+        output({"publish": "true" if pending else "false", "pending_count": len(pending)})
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/scripts/test_docs_redirects.py b/.github/scripts/test_docs_redirects.py
new file mode 100644
index 0000000..fc3e34d
--- /dev/null
+++ b/.github/scripts/test_docs_redirects.py
@@ -0,0 +1,134 @@
+"""Exercise static URL mapping and the actual browser JavaScript without a network."""
+
+import json
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+from build_docs_redirects import (
+    build_redirects,
+    destination,
+    redirect_script,
+    render_redirect,
+    validate_base_url,
+    validate_project_prefix,
+)
+
+
+BASE = "https://example.readthedocs.io/en/latest/"
+PREFIX = "/Example/"
+
+
+def run_browser_script(script: str, path: str, query: str = "", fragment: str = "") -> str:
+    """Evaluate the emitted JavaScript with a minimal window.location object in Node."""
+    harness = """
+const fs = require('node:fs');
+const vm = require('node:vm');
+const input = JSON.parse(fs.readFileSync(0, 'utf8'));
+let result;
+const location = {...input.location, replace: value => { result = value; }};
+vm.runInNewContext(input.script, {window: {location}}, {timeout: 1000});
+process.stdout.write(JSON.stringify(result));
+"""
+    result = subprocess.run(
+        ["node", "-e", harness],
+        input=json.dumps(
+            {
+                "script": script,
+                "location": {
+                    "pathname": path,
+                    "search": query,
+                    "hash": fragment,
+                },
+            }
+        ),
+        capture_output=True,
+        text=True,
+        check=True,
+        timeout=10,
+    )
+    return json.loads(result.stdout)
+
+
+class RedirectTests(unittest.TestCase):
+    """Catch broken deep links, lost fragments, unsafe paths, and source-copy regressions."""
+
+    def test_homepage_and_encoded_deep_page(self):
+        self.assertEqual(destination(BASE, "index.html"), BASE)
+        self.assertEqual(destination(BASE, "guide/schema.html"), BASE + "guide/schema.html")
+        self.assertEqual(destination(BASE, "a #b.html"), BASE + "a%20%23b.html")
+        for value in ["../outside.html", "/outside.html", "..\\outside.html"]:
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                destination(BASE, value)
+
+    def test_only_explicit_rtd_destinations_and_project_prefixes(self):
+        for value in [
+            "http://example.readthedocs.io/en/latest/",
+            "https://evil.test/",
+            "https://example.readthedocs.io.evil.test/",
+            "https://user@example.readthedocs.io/",
+            BASE + "?next=evil",
+            BASE + "#fragment",
+            BASE + "../other/",
+        ]:
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                validate_base_url(value)
+        for value in ["//evil.test/", "/../", "Example", "/a/b/"]:
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                validate_project_prefix(value)
+
+    def test_browser_preserves_query_and_fragment(self):
+        target = destination(BASE, "schema.html")
+        actual = run_browser_script(
+            redirect_script(target, PREFIX), "/Example/schema.html", "?q=expiry", "#strike-grid"
+        )
+        self.assertEqual(actual, BASE + "schema.html?q=expiry#strike-grid")
+
+    def test_404_strips_only_the_exact_project_prefix(self):
+        script = redirect_script(BASE, PREFIX, fallback=True)
+        self.assertEqual(
+            run_browser_script(script, "/Example/old/page.html", "", "#rules"),
+            BASE + "old/page.html#rules",
+        )
+        self.assertEqual(run_browser_script(script, "/Example/index.html"), BASE)
+        self.assertEqual(run_browser_script(script, "/Example/guide/"), BASE + "guide/")
+        self.assertEqual(run_browser_script(script, "/ExampleOther/page.html"), BASE)
+        self.assertEqual(run_browser_script(script, "/Example/%2e%2e/elsewhere"), BASE)
+        self.assertEqual(run_browser_script(script, "/Example/%2f%2fevil.test"), BASE)
+        self.assertEqual(run_browser_script(script, "/Example/%5cevil.test"), BASE)
+        self.assertEqual(run_browser_script(script, "/Example/%broken"), BASE)
+
+    def test_html_and_script_escape_untrusted_characters(self):
+        target = BASE + 'x?test="&</script><script>oops</script>'
+        rendered = render_redirect(target, PREFIX)
+        self.assertNotIn("<script>oops", rendered)
+        self.assertIn("&quot;&amp;&lt;/script&gt;", rendered)
+        self.assertIn('rel="canonical"', rendered)
+        self.assertIn('<noscript><meta http-equiv="refresh"', rendered)
+        self.assertIn('name="robots" content="noindex,follow"', rendered)
+        self.assertEqual(run_browser_script(redirect_script(target, PREFIX), "/Example/x"), target)
+
+    def test_payload_has_redirects_and_never_copies_source_or_assets(self):
+        with tempfile.TemporaryDirectory() as temp:
+            root = Path(temp)
+            source, output = root / "source", root / "redirects"
+            (source / "guide").mkdir(parents=True)
+            (source / "index.html").write_text("original homepage", encoding="utf-8")
+            (source / "guide/schema.html").write_text("original guide", encoding="utf-8")
+            (source / "image.png").write_bytes(b"unchanged binary")
+            self.assertEqual(build_redirects(source, output, BASE, PREFIX), 2)
+            self.assertEqual(
+                {p.relative_to(output).as_posix() for p in output.rglob("*") if p.is_file()},
+                {"index.html", "guide/schema.html", "404.html", ".nojekyll"},
+            )
+            self.assertNotIn("original guide", (output / "guide/schema.html").read_text())
+            self.assertEqual((source / "image.png").read_bytes(), b"unchanged binary")
+            with self.assertRaises(ValueError):
+                build_redirects(source, output, BASE, PREFIX)
+            with self.assertRaises(ValueError):
+                build_redirects(source, source / "nested", BASE, PREFIX)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/stack-policy.json b/.github/stack-policy.json
new file mode 100644
index 0000000..2ef42c8
--- /dev/null
+++ b/.github/stack-policy.json
@@ -0,0 +1,30 @@
+{
+  "schema_version": 1,
+  "source_registry": "ArturSepp/scripts/public_registry.json",
+  "import": "option_chain_analytics",
+  "core": [
+    "qis",
+    "vanilla_option_pricers"
+  ],
+  "optional": [
+    "bbg_fetch"
+  ],
+  "forbidden": [
+    "factorlasso",
+    "goal_based_allocation",
+    "optimalportfolios",
+    "privateassets",
+    "stochvolmodels",
+    "trendfollowing"
+  ],
+  "optional_adapters": [
+    {
+      "path": "src/option_chain_analytics/**/run_local/*_run.py",
+      "modules": [
+        "bbg_fetch"
+      ],
+      "reason": "Source-only provider diagnostics; package-root reachability remains prohibited."
+    }
+  ],
+  "development_imports": []
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0fef785..e99fba8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,3 +111,48 @@ jobs:
         "$RUNNER_TEMP/oca-wheel/bin/python" first_success.py
         uv pip check --python "$RUNNER_TEMP/oca-wheel/bin/python"
         "$RUNNER_TEMP/oca-wheel/bin/python" -c "from pathlib import Path; import option_chain_analytics as package; checkout = Path(r'${{ github.workspace }}').resolve(); package_path = Path(package.__file__).resolve(); assert not package_path.is_relative_to(checkout), (checkout, package_path); print(f'wheel_import={package_path}')"
+
+  stack-policy:
+    name: stack import boundaries
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: "3.12"
+          enable-cache: false
+      - name: Exercise policy regressions
+        run: python .github/scripts/check_stack_imports.py --self-test
+      - name: Check stack imports and optional adapter isolation
+        run: python .github/scripts/check_stack_imports.py
+
+  lowest-dependencies:
+    name: lowest direct dependencies (Python 3.10, ${{ matrix.extras || 'core' }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        extras: ["", "--extra bloomberg"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: "3.10"
+      - name: Keep the test environment outside the checkout
+        run: echo "UV_PROJECT_ENVIRONMENT=$RUNNER_TEMP/lowest-dependencies" >> "$GITHUB_ENV"
+      - name: Resolve a fresh lowest-direct test environment
+        # Upgrade ignores lockfile preference; this job never commits its experimental lock.
+        run: uv sync --python 3.10 --resolution lowest-direct --upgrade --group test ${{ matrix.extras }}
+      - name: Install the Bloomberg SDK for the provider extra
+        if: matrix.extras == '--extra bloomberg'
+        run: >-
+          uv pip install --python "$UV_PROJECT_ENVIRONMENT/bin/python"
+          --index-url https://blpapi.bloomberg.com/repository/releases/python/simple blpapi
+      - name: Record installed versions
+        run: uv pip freeze --python "$UV_PROJECT_ENVIRONMENT/bin/python"
+      - name: Check optional dependencies stay outside package-root import
+        run: uv run --no-sync python .github/scripts/check_stack_imports.py --check-root
+      - name: Test declared dependency floors without live provider credentials
+        run: uv run --no-sync pytest
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 312da5a..e01f7be 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -1,4 +1,4 @@
-# SHARED CI CORE v1.0 — T1 — synced 2026-08-22
+# SHARED CI CORE v1.2 — T1 — synced 2026-09-08
 name: Documentation
 
 permissions:
@@ -9,6 +9,7 @@ on:
     branches: [main]
     paths:
       - .github/workflows/docs.yml
+      - .github/scripts/*docs_redirects.py
       - docs/**
       - src/option_chain_analytics/**
       - pyproject.toml
@@ -17,6 +18,7 @@ on:
     branches: [main]
     paths:
       - .github/workflows/docs.yml
+      - .github/scripts/*docs_redirects.py
       - docs/**
       - src/option_chain_analytics/**
       - pyproject.toml
@@ -46,13 +48,24 @@ jobs:
     - name: Sync documentation environment
       run: uv sync --locked --extra docs
 
+    - name: Verify redirect path and fragment handling
+      run: uv run --no-sync python .github/scripts/test_docs_redirects.py
+
     - name: Build HTML with warnings as errors
       run: uv run --no-sync python -m sphinx -E -W --keep-going -b html docs docs/_build/html
 
     - name: Check documentation links
       run: uv run --no-sync python -m sphinx -E -W -b linkcheck docs docs/_build/linkcheck
 
-    # P5 has not authorized retiring the current manual GitHub Pages deployment.
+    # Publish only redirects on GitHub Pages; Read the Docs serves the full site.
+    - name: Build legacy documentation redirects
+      run: >-
+        uv run --no-sync python .github/scripts/build_docs_redirects.py
+        --source docs/_build/html
+        --output docs/_build/redirects
+        --base-url https://optionchainanalytics.readthedocs.io/en/latest/
+        --project-prefix /OptionChainAnalytics/
+
     - name: Configure GitHub Pages
       if: github.event_name == 'workflow_dispatch'
       uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
@@ -61,7 +74,7 @@ jobs:
       if: github.event_name == 'workflow_dispatch'
       uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
       with:
-        path: docs/_build/html
+        path: docs/_build/redirects
 
   deploy:
     if: github.event_name == 'workflow_dispatch'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..5034889
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,134 @@
+# SHARED CI CORE v1.2 — T1 — synced 2026-09-08 — template release-v1
+name: Publish package
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing named tag to validate and publish
+        required: true
+        type: string
+      retry_existing:
+        description: Complete a partial existing upload only after matching its artifact hashes
+        default: false
+        type: boolean
+      github_release:
+        description: Also create an optional GitHub Release page
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+concurrency:
+  group: publish-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  MPLBACKEND: Agg
+  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    outputs:
+      publish: ${{ steps.artifacts.outputs.publish }}
+      sha: ${{ steps.identity.outputs.sha }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: "3.12"
+      - name: Resolve the tag and validate release identity
+        id: identity
+        run: |
+          cp .github/scripts/release_guard.py "$RUNNER_TEMP/release_guard.py"
+          python "$RUNNER_TEMP/release_guard.py" checkout --tag "$RELEASE_TAG"
+      - name: Run the tagged source test suite
+        run: |
+          uv sync --locked --group test
+          uv run --no-sync pytest
+      - name: Build the tagged documentation with warnings as errors
+        run: |
+          uv sync --locked --extra docs
+          uv run --no-sync python -m sphinx -E -W --keep-going -b html docs "$RUNNER_TEMP/release-docs"
+      - name: Build one sdist and its wheel
+        run: |
+          uv build --sdist --out-dir "$RUNNER_TEMP/release-dist"
+          uv build --wheel "$RUNNER_TEMP/release-dist/"*.tar.gz --out-dir "$RUNNER_TEMP/release-dist"
+          uvx --from twine twine check "$RUNNER_TEMP/release-dist/"*
+      - name: Import the installed wheel outside the checkout
+        run: |
+          uv venv --python 3.12 "$RUNNER_TEMP/release-wheel-env"
+          uv pip install --python "$RUNNER_TEMP/release-wheel-env/bin/python" "$RUNNER_TEMP/release-dist/"*.whl
+          cd "$RUNNER_TEMP"
+          "$RUNNER_TEMP/release-wheel-env/bin/python" -I -c "import option_chain_analytics; print(option_chain_analytics.__file__)"
+      - name: Verify artifact metadata and immutable PyPI digests
+        id: artifacts
+        env:
+          RETRY_EXISTING: ${{ inputs.retry_existing || false }}
+        shell: bash
+        run: |
+          args=()
+          if [ "$RETRY_EXISTING" = "true" ]; then args+=(--retry-existing); fi
+          python "$RUNNER_TEMP/release_guard.py" artifacts --tag "$RELEASE_TAG" \
+            --import-name option_chain_analytics --dist "$RUNNER_TEMP/release-dist" \
+            --pending "$RUNNER_TEMP/pending-upload" "${args[@]}"
+      - name: Retain verified distributions and their manifest
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: verified-distributions
+          path: ${{ runner.temp }}/release-dist/
+          if-no-files-found: error
+          retention-days: 30
+      - name: Transfer only files approved for this upload
+        if: steps.artifacts.outputs.publish == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pending-upload
+          path: ${{ runner.temp }}/pending-upload/
+          if-no-files-found: error
+          retention-days: 30
+  publish:
+    needs: validate
+    if: needs.validate.outputs.publish == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment:
+      name: pypi
+      url: https://pypi.org/project/option-chain-analytics/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: pending-upload
+          path: dist/
+      - name: Publish verified artifacts through Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          skip-existing: false
+  release-page:
+    needs: [validate, publish]
+    if: always() && inputs.github_release && needs.validate.result == 'success' && (needs.publish.result == 'success' || needs.publish.result == 'skipped')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Create the optional page only if missing
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "GitHub Release page already exists."
+          else
+            gh release create "$RELEASE_TAG" --verify-tag --generate-notes
+          fi
diff --git a/.gitignore b/.gitignore
index 0bd45a5..bc0e1c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -149,3 +149,7 @@ venv.bak/
 .dmypy.json
 dmypy.json
 /testing/
+
+# Versioned GitHub automation helpers (Scripts/ above is for local environments).
+!/.github/scripts/
+!/.github/scripts/*.py
diff --git a/AGENTS.md b/AGENTS.md
index 107b915..330d1e8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -25,27 +25,34 @@ Distribution name `option-chain-analytics`; import name `option_chain_analytics`
 
 ## Ecosystem position
 
-This package is part of the open-source Python stack maintained at
-[github.com/ArturSepp](https://github.com/ArturSepp). Before implementing anything non-trivial,
-check whether it already belongs in one of these:
+This package is one of ten public Python libraries maintained at
+[github.com/ArturSepp](https://github.com/ArturSepp). Check the owning package before
+adding a capability or copying code between repositories.
 
 | Package | Repository | Purpose |
 |---|---|---|
-| `qis` | QuantInvestStrats | Time-series analytics, schedules, reporting, and visualisation |
-| `option-chain-analytics` | OptionChainAnalytics | Option-feed normalisation and point-in-time chain reconstruction |
-| `vanilla-option-pricers` | VanillaOptionPricers | Vanilla prices, Greeks, and implied-volatility inversion |
-| `stochvolmodels` | StochVolModels | Stochastic-volatility pricing, simulation, and calibration |
-| `bbg-fetch` | BloombergFetch | Bloomberg data retrieval |
-| `optimalportfolios` | OptimalPortfolios | Portfolio construction and backtesting |
-| `factorlasso` | factorlasso | Sparse factor models and covariance estimation |
-| `trendfollowing` | TrendFollowingSystems | Trend-following theory and replication |
-| `goal-based-allocation` | GoalBasedAllocation | Dynamic allocation under regime-switching jump-diffusions |
-
-OCA consumes `qis` and `vanilla-option-pricers`. `bbg-fetch` is an optional provider integration.
-StochVolModels consumes OCA only through its optional experiment adapter, and the private
-SigmaStrats backtester consumes OCA as its data layer. This direction is deliberate: **OCA never
-imports StochVolModels or SigmaStrats**. Do not vendor or copy code between repositories; put a
-capability in the package that owns it.
+| `qis` | QuantInvestStrats | performance analytics, backtesting, and factsheet reporting |
+| `optimalportfolios` | OptimalPortfolios | portfolio construction and rolling backtesting |
+| `factorlasso` | FactorLasso | sparse factor-model estimation |
+| `bbg-fetch` | BloombergFetch | Bloomberg data in pandas DataFrames |
+| `stochvolmodels` | StochVolModels | stochastic-volatility pricing and calibration |
+| `trendfollowing` | TrendFollowingSystems | closed-form trend-following analytics |
+| `privateassets` | PrivateAssets | multi-factor PME for private assets |
+| `goal-based-allocation` | GoalBasedAllocation | goal-based allocation under regime-switching jump-diffusions |
+| `vanilla-option-pricers` | VanillaOptionPricers | Numba-vectorised BSM and Bachelier pricing |
+| `option-chain-analytics` | OptionChainAnalytics | point-in-time option-chain data and queries |
+
+Core dependency edges: `optimalportfolios` consumes `qis` and `factorlasso`;
+`trendfollowing` and `privateassets` consume `qis`; `stochvolmodels` consumes
+`vanilla-option-pricers`; `option-chain-analytics` consumes `qis` and
+`vanilla-option-pricers`. The remaining packages have no core stack dependencies.
+
+Optional edges: PrivateAssets' `factors` extra adds `factorlasso`; StochVolModels'
+`research` extra adds `qis` and `option-chain-analytics`; OCA's `bloomberg` and `all`
+extras add `bbg-fetch`. Core imports must work without optional dependencies.
+OCA never imports StochVolModels or the private SigmaStrats consumer. Exact
+maintainer-tool exceptions are recorded in `.github/stack-policy.json`; they do
+not authorise adding those dependencies to core or importing them at package root.
 
 ## Repository layout
 
@@ -194,7 +201,7 @@ the generated shared-agent block below; do not edit that generated block directl
 <!-- ===== SHARED AGENT CORE (consumer variant) — begin =====
      Generated from SHARED_AGENT_CORE.md in the maintainer's project knowledge. Do not hand-edit
      between these markers — propose the change to the maintainer instead. Variants: builder
-     (qis) / consumer / standalone. Last synced 2026-08-16, agent core v1.4. -->
+     (qis) / consumer / standalone. Last synced 2026-09-08, agent core v1.5 -->
 
 ## Domain invariants
 
@@ -271,9 +278,11 @@ list is binding.
 5. `pytest -q`, Ruff, offline first-success, warning-free docs, distribution build, and
    `tools/verify_distribution.py` all pass.
 
-Then commit, tag `v<version>`, publish the wheel/source distribution, and create the matching
-GitHub Release. Do not bump versions as part of unrelated work, and do not publish without the
-maintainer explicitly asking for a release.
+For an authorized publication, commit, tag the exact main-reachable source as
+`v<version>`, then verify and publish its wheel/source distribution. Frequent PyPI updates
+are supported. A GitHub Release page is optional and created only when requested. Local
+builds need no release; development versions on main may be ahead of PyPI. Do not publish
+or bump a version for unrelated work.
 
 ## Known issues and compatibility surfaces
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dd23c7b..9fbe28c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,27 @@ All notable public changes to OptionChainAnalytics are recorded here.
 
 ## [Unreleased]
 
+## [5.2.1] - 2026-09-08
+
+### Added
+
+- Added explicit stack dependency and optional-import boundary checks, including
+  isolated maintainer adapters, plus a fresh Python 3.10 lowest-direct dependency CI lane.
+
+- Added tag-driven PyPI Trusted Publishing with release-identity and distribution
+  validation; creating a GitHub Release remains optional.
+
+- Added a lowest-dependency CI variant for the optional `bloomberg` extra, with
+  core-import isolation checks that do not require live Bloomberg access.
+
+### Changed
+
+- Aligned package summaries, software citations, README navigation, and documentation
+  landing pages with the canonical package identity and Read the Docs documentation.
+
+- Pointed package documentation metadata to the Read the Docs root and replaced
+  the legacy GitHub Pages documentation build with redirects.
+
 ## [5.2.0] - 2026-08-24
 
 ### Added
diff --git a/CITATION.cff b/CITATION.cff
index f3d6862..ab4e537 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -2,8 +2,8 @@ cff-version: 1.2.0
 message: "If you use this software, please cite it using the metadata from this file."
 type: software
 title: "option-chain-analytics: Point-in-time option-chain containers, feed normalisation, reconstruction, and queries for quantitative research"
-version: 5.2.0
-date-released: 2026-08-24
+version: 5.2.1
+date-released: "2026-09-08"
 authors:
   - family-names: Sepp
     given-names: Artur
diff --git a/README.md b/README.md
index 352f0ba..2896044 100644
--- a/README.md
+++ b/README.md
@@ -68,7 +68,9 @@ installing unrelated network providers.
 Contributor test and lint tools live in the locked `test` and `lint` dependency groups rather than
 a published `dev` extra.
 
-## Five-minute quickstart: no data or credentials
+<a id="five-minute-quickstart-no-data-or-credentials"></a>
+
+## Five-minute quickstart
 
 The authoritative offline repository example constructs a deterministic Black-Scholes-Merton
 option panel, reconstructs a historical chain, queries its front-expiry ATM strike and volatility,
@@ -128,7 +130,7 @@ dependency. Black-Scholes analytics remain delegated to `vanilla-option-pricers`
 
 Local adapters cover Deribit/Tardis crypto histories and SPX/VIX CBOE fitted-chain files. These
 datasets are not distributed. `OCA_DATA_PATH` holds raw provider archives, `OCA_CACHE_PATH` holds
-normalized reusable chains, and `OCA_OUTPUT_PATH` holds generated reports. Their source-checkout
+normalised reusable chains, and `OCA_OUTPUT_PATH` holds generated reports. Their source-checkout
 defaults are the ignored `data/`, `resources/`, and `outputs/` directories. The
 [data catalogue](docs/data_sources.md#canonical-data-catalogue-and-storage) defines every supported
 provider directory, cache filename, and loader. CBOE files can be mapped with:
@@ -150,7 +152,7 @@ The CBOE mapper always infers bid/ask implied volatilities from the source bid/a
 the contemporaneous forward, discount factor, and time to maturity. This keeps every CBOE-backed
 `OptionsDataDFs` instance on the same complete schema.
 
-For repeated empirical studies, build one normalized Parquet cache per underlying after installing
+For repeated empirical studies, build one normalised Parquet cache per underlying after installing
 the `cboe` extra:
 
 ```python
@@ -192,7 +194,7 @@ $thetaKey = Read-Host "ThetaData API key" -AsSecureString
 $env:THETADATA_API_KEY = [System.Net.NetworkCredential]::new('', $thetaKey).Password
 ```
 
-Credentials and raw provider responses are never written to OCA's normalized cache.
+Credentials and raw provider responses are never written to OCA's normalised cache.
 
 #### 2. Build or resume a local history
 
@@ -206,7 +208,7 @@ python examples/build_thetadata_eod_cache.py \
     --start-date 2023-06-01
 ```
 
-By default this stores normalized files under
+By default this stores normalised files under
 `resources/thetadata_options/nvda/{options,spot}/YYYY-MM.parquet`. Set `OCA_CACHE_PATH` or pass
 `--output-dir` to choose another private cache root. The default request keeps expiries from 0 to
 60 calendar DTE and 20 strikes around spot; pass `--all-strikes` only when the larger download is
@@ -441,10 +443,10 @@ uses the parity-only policy. Every bid, mark, and ask IV and every mark Greek is
 
 ## Documentation and development
 
-Start with the [documentation site](https://artursepp.github.io/OptionChainAnalytics/), then read the
-[schema contract](https://artursepp.github.io/OptionChainAnalytics/schema.html),
-[point-in-time reconstruction](https://artursepp.github.io/OptionChainAnalytics/point_in_time.html),
-and [data-source guide](https://artursepp.github.io/OptionChainAnalytics/data_sources.html).
+Start with the [documentation site](https://optionchainanalytics.readthedocs.io/en/latest/), then read the
+[schema contract](https://optionchainanalytics.readthedocs.io/en/latest/schema.html),
+[point-in-time reconstruction](https://optionchainanalytics.readthedocs.io/en/latest/point_in_time.html),
+and [data-source guide](https://optionchainanalytics.readthedocs.io/en/latest/data_sources.html).
 
 ```bash
 uv sync --locked --group test
@@ -462,9 +464,17 @@ The installable package lives under `src/option_chain_analytics/`; repository-on
 their implementation in `src/option_chain_analytics/**/run_local/*_run.py`, expose `Locals` and
 `run_local(local=...)`, and are excluded from distributions. The `run_local` folders use Python's
 implicit namespace-package support and therefore contain no `__init__.py` files. Raw datasets,
-normalized caches, agent reports, and generated outputs live in ignored `data/`, `resources/`,
+normalised caches, agent reports, and generated outputs live in ignored `data/`, `resources/`,
 `agents/`, and `outputs/` directories.
 
+## Research and licensing boundary
+
+OCA can provide a public, auditable input layer for empirical studies and replication. Strategy
+logic and the QF-paper backtests remain in SigmaStrats, and a public example is not expected to
+reproduce results computed from a private production dataset exactly.
+
+Dataset licences and access terms are separate from the software licence.
+
 ## Ecosystem
 
 OCA depends on [`qis`](https://github.com/ArturSepp/QuantInvestStrats) for general time-series and
@@ -482,14 +492,6 @@ canonical ten-package catalogue.
 - [Request a feature](https://github.com/ArturSepp/OptionChainAnalytics/issues/new?template=feature_request.yml), explaining which field, provider, or normalisation workflow is missing, the current workaround, and the smallest useful API.
 - Read [CONTRIBUTING.md](CONTRIBUTING.md) for the data-licensing boundary, development commands, point-in-time rules, and pull-request guidance.
 
-## Research and licensing boundary
-
-OCA can provide a public, auditable input layer for empirical studies and replication. Strategy
-logic and the QF-paper backtests remain in SigmaStrats, and a public example is not expected to
-reproduce results computed from a private production dataset exactly.
-
-Dataset licences and access terms are separate from the software licence.
-
 ## Citation
 
 Machine-readable citation metadata is provided in
@@ -502,7 +504,7 @@ A copyable software citation is:
   title={option-chain-analytics: Point-in-time option-chain containers, feed normalisation, reconstruction, and queries for quantitative research},
   author={Sepp, Artur},
   year={2026},
-  version={5.2.0},
+  version={5.2.1},
   url={https://github.com/ArturSepp/OptionChainAnalytics}
 }
 ```
diff --git a/RELEASING.md b/RELEASING.md
index 1519e62..d1c6162 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -3,12 +3,13 @@
 Publication is a maintainer-only action. Preparing or merging this repository does not authorize a
 tag, GitHub Release, documentation deployment, or package upload.
 
-## Release target
+## Release scope
 
-The approved release target is `5.2.0`. It adds `ChainTs.load_price_data` for chain-linked
-underlying series and adopts the shared CI core with uv-locked dependency groups and Linux,
-Windows, and macOS verification. The tag, GitHub Release, package upload, and Pages deployment
-must all refer to the same verified release commit and artefacts.
+Publish to PyPI when the accumulated, verified changes are ready. Choose the version from
+the complete change set and record it in the changelog. The source tag and uploaded wheel
+and source distribution identify the same verified commit. A GitHub Release is optional and,
+when created, uses that tag. Read the Docs hosts the documentation; the legacy Pages site
+only redirects existing links and is not rebuilt for each package release.
 
 ## Candidate verification
 
@@ -37,10 +38,14 @@ machine paths, and repository-only agent/output files.
 2. Confirm `project.version`, `CITATION.cff`, and the dated changelog identify the same release.
 3. Repeat every candidate check and inspect installed metadata.
 4. Obtain explicit approval to publish.
-5. Tag the verified commit `v5.2.0`, publish the same artefact to PyPI, create the GitHub Release,
-   and manually run the Pages workflow.
-6. Verify the PyPI README and links, GitHub release/tag, Pages canonical links, `robots.txt`, and
-   `sitemap.xml`; record immutable evidence in the ignored `agents/RELEASE_REPORT.md`.
+5. Tag the verified commit `v<version>` and publish the verified artefacts to PyPI. Optionally
+   create a GitHub Release from the same tag. Never move a published tag.
+6. Verify the PyPI version, hashes, metadata and links, the source tag, and the Read the Docs
+   build. Record immutable evidence in the ignored `agents/RELEASE_REPORT.md`.
+
+If publication is interrupted, inspect the files already on PyPI and compare their hashes
+with the verified artefacts before retrying. An existing version alone does not prove that
+publication completed correctly.
 
 Never rebuild between the final artefact verification and upload, and never include empirical data
 in a software release.
diff --git a/SECURITY.md b/SECURITY.md
index 3a513f2..4e38065 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,9 +2,9 @@
 
 ## Supported versions
 
-Until the 2.0 release is published, security fixes are prepared for the latest code on `main`.
-After publication, only the latest released 2.x version will receive security fixes unless a
-release note states otherwise.
+Security fixes target the latest patch in the latest released minor series. Older minor
+series are unsupported unless a release note explicitly states otherwise. Upgrade to the
+latest published version before reporting an issue that may already be fixed.
 
 ## Reporting a vulnerability
 
diff --git a/docs/conf.py b/docs/conf.py
index e6114b7..2dcacc3 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -1,22 +1,34 @@
 """Sphinx configuration for OptionChainAnalytics documentation."""
 
+import os
 import sys
 from pathlib import Path
 
+try:
+    import tomllib
+except ModuleNotFoundError:  # Python 3.10 metadata tests use the compatible parser.
+    import tomli as tomllib
+
 REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(REPOSITORY_ROOT / 'src'))
 
 project = 'option-chain-analytics'
 author = 'Artur Sepp'
 copyright = '2026, Artur Sepp'
+release = tomllib.loads(
+    (Path(__file__).resolve().parents[1] / "pyproject.toml").read_text(encoding="utf-8")
+)["project"]["version"]
+version = ".".join(release.split(".")[:2])
 
 extensions = ['myst_parser']
 source_suffix = {'.rst': 'restructuredtext', '.md': 'markdown'}
 exclude_patterns = ['_build']
 html_theme = 'furo'
 html_title = 'option-chain-analytics - point-in-time option-chain data and queries'
-html_baseurl = 'https://optionchainanalytics.readthedocs.io/en/latest/'
-html_extra_path = ['robots.txt', 'sitemap.xml']
+html_baseurl = (
+    os.environ.get("READTHEDOCS_CANONICAL_URL")
+    or "https://optionchainanalytics.readthedocs.io/en/latest/"
+)
 myst_html_meta = {
     'google-site-verification': 'cddUZk3Gsd1MySw42Rwuq_rMzUDcMNkJWekObx-QS9Y',
 }
diff --git a/docs/index.md b/docs/index.md
index feabbbe..dd65ea8 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,14 +1,16 @@
-# OptionChainAnalytics documentation
+# option-chain-analytics
 
-OptionChainAnalytics is a source-neutral data-container layer for point-in-time option research.
-It normalises heterogeneous feeds into `OptionsDataDFs`, reconstructs complete chains at an exact
-historical observation time, and exposes expiry, strike, volatility, roll, and portfolio queries.
+<a id="optionchainanalytics-documentation"></a>
+
+Point-in-time option-chain containers, feed normalisation, reconstruction, and queries for
+quantitative research.
 
 The fastest route is [first success](first_success.md). It is deterministic, offline, and requires
 no provider account. Before mapping empirical data, read the [schema contract](schema.md),
 [point-in-time rules](point_in_time.md), and [data-source boundaries](data_sources.md).
 
-The repository's [supported examples](https://github.com/ArturSepp/OptionChainAnalytics/blob/main/examples/README.md)
+The repository's [supported
+examples](https://github.com/ArturSepp/OptionChainAnalytics/blob/main/examples/README.md)
 state the data prerequisite, network behavior, and output of every runnable script. Cache-first
 SPY workflows make no request after the local ThetaData cache has been built.
 
diff --git a/docs/robots.txt b/docs/robots.txt
deleted file mode 100644
index 3d712a5..0000000
--- a/docs/robots.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-User-agent: *
-Allow: /
-
-Sitemap: https://optionchainanalytics.readthedocs.io/en/latest/sitemap.xml
diff --git a/docs/sitemap.xml b/docs/sitemap.xml
deleted file mode 100644
index d95f4d6..0000000
--- a/docs/sitemap.xml
+++ /dev/null
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
-  <url><loc>https://optionchainanalytics.readthedocs.io/en/latest/index.html</loc></url>
-  <url><loc>https://optionchainanalytics.readthedocs.io/en/latest/first_success.html</loc></url>
-  <url><loc>https://optionchainanalytics.readthedocs.io/en/latest/schema.html</loc></url>
-  <url><loc>https://optionchainanalytics.readthedocs.io/en/latest/point_in_time.html</loc></url>
-  <url><loc>https://optionchainanalytics.readthedocs.io/en/latest/queries.html</loc></url>
-  <url><loc>https://optionchainanalytics.readthedocs.io/en/latest/data_sources.html</loc></url>
-  <url><loc>https://optionchainanalytics.readthedocs.io/en/latest/comparison.html</loc></url>
-</urlset>
diff --git a/pyproject.toml b/pyproject.toml
index 44e77ca..ffe6109 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "option-chain-analytics"
-version = "5.2.0"
+version = "5.2.1"
 description = "Point-in-time option-chain containers, feed normalisation, reconstruction, and queries for quantitative research"
 readme = "README.md"
 license = "MIT"
@@ -95,7 +95,7 @@ lint = ["ruff>=0.9.0"]
 
 [project.urls]
 Homepage = "https://github.com/ArturSepp/OptionChainAnalytics"
-Documentation = "https://optionchainanalytics.readthedocs.io/en/latest/"
+Documentation = "https://optionchainanalytics.readthedocs.io"
 Repository = "https://github.com/ArturSepp/OptionChainAnalytics"
 Issues = "https://github.com/ArturSepp/OptionChainAnalytics/issues"
 Changelog = "https://github.com/ArturSepp/OptionChainAnalytics/blob/main/CHANGELOG.md"
diff --git a/tests/test_project_metadata.py b/tests/test_project_metadata.py
index 082c20a..378f4f9 100644
--- a/tests/test_project_metadata.py
+++ b/tests/test_project_metadata.py
@@ -1,7 +1,9 @@
 from __future__ import annotations
 
 from pathlib import Path
-from xml.etree import ElementTree
+import re
+import runpy
+import sys
 
 try:
     import tomllib
@@ -10,6 +12,7 @@
 
 REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
 PUBLIC_DOCS_ROOT = 'https://optionchainanalytics.readthedocs.io/en/latest/'
+DOCUMENTATION_URL = 'https://optionchainanalytics.readthedocs.io'
 
 
 def test_release_candidate_metadata_is_aligned() -> None:
@@ -19,7 +22,7 @@ def test_release_candidate_metadata_is_aligned() -> None:
     citation = (REPOSITORY_ROOT / 'CITATION.cff').read_text(encoding='utf-8')
     changelog = (REPOSITORY_ROOT / 'CHANGELOG.md').read_text(encoding='utf-8')
 
-    assert project['version'] == '5.2.0'
+    assert re.fullmatch(r'\d+\.\d+\.\d+', project['version'])
     assert project['requires-python'] == '>=3.10'
     assert project['license'] == 'MIT'
     optional_dependencies = project['optional-dependencies']
@@ -29,23 +32,41 @@ def test_release_candidate_metadata_is_aligned() -> None:
         for requirements in optional_dependencies.values()
         for requirement in requirements
     )
-    assert project['urls']['Documentation'] == PUBLIC_DOCS_ROOT
+    assert project['urls']['Documentation'] == DOCUMENTATION_URL
     assert f"version: {project['version']}" in citation
     assert f"## [{project['version']}]" in changelog
 
 
-def test_documentation_discovery_files_cover_public_pages() -> None:
-    namespace = {'site': 'http://www.sitemaps.org/schemas/sitemap/0.9'}
-    sitemap = ElementTree.parse(REPOSITORY_ROOT / 'docs' / 'sitemap.xml')
-    locations = {node.text for node in sitemap.findall('site:url/site:loc', namespace)}
-    expected = {
-        f'{PUBLIC_DOCS_ROOT}{source.stem}.html'
-        for source in (REPOSITORY_ROOT / 'docs').glob('*.md')
-    }
+def test_documentation_discovery_routes_public_pages_to_read_the_docs(tmp_path, monkeypatch) -> None:
+    """Every documentation page keeps a legacy redirect to the canonical host."""
+    monkeypatch.setitem(sys.modules, 'tomllib', tomllib)
+    monkeypatch.setattr(sys, 'path', list(sys.path))
+    monkeypatch.delenv('READTHEDOCS_CANONICAL_URL', raising=False)
+    conf = runpy.run_path(str(REPOSITORY_ROOT / 'docs/conf.py'))
+    assert conf['html_baseurl'] == PUBLIC_DOCS_ROOT
+    with (REPOSITORY_ROOT / 'pyproject.toml').open('rb') as stream:
+        assert conf['release'] == tomllib.load(stream)['project']['version']
+    stable = 'https://optionchainanalytics.readthedocs.io/en/stable/'
+    monkeypatch.setenv('READTHEDOCS_CANONICAL_URL', stable)
+    assert runpy.run_path(str(REPOSITORY_ROOT / 'docs/conf.py'))['html_baseurl'] == stable
 
-    robots = (REPOSITORY_ROOT / 'docs' / 'robots.txt').read_text(encoding='utf-8')
-    assert locations == expected
-    assert f'Sitemap: {PUBLIC_DOCS_ROOT}sitemap.xml' in robots
+    source = tmp_path / 'rendered'
+    output = tmp_path / 'redirects'
+    source.mkdir()
+    pages = [path.stem + '.html' for path in (REPOSITORY_ROOT / 'docs').glob('*.md')]
+    assert 'index.html' in pages
+    for page in pages:
+        (source / page).write_text('Original documentation content', encoding='utf-8')
+    redirect = runpy.run_path(str(REPOSITORY_ROOT / '.github/scripts/build_docs_redirects.py'))
+    assert redirect['build_redirects'](source, output, PUBLIC_DOCS_ROOT, '/OptionChainAnalytics/') == len(pages)
+    for page in pages:
+        document = (output / page).read_text(encoding='utf-8')
+        target = PUBLIC_DOCS_ROOT if page == 'index.html' else PUBLIC_DOCS_ROOT + page
+        assert f'href="{target}"' in document
+        assert 'noindex,follow' in document
+        assert 'Original documentation content' not in document
+    workflow = (REPOSITORY_ROOT / '.github/workflows/docs.yml').read_text(encoding='utf-8')
+    assert 'path: docs/_build/redirects' in workflow
 
 
 def test_community_health_files_exist() -> None:
diff --git a/uv.lock b/uv.lock
index 7eb39df..a06f08c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1491,7 +1491,7 @@ wheels = [
 
 [[package]]
 name = "option-chain-analytics"
-version = "5.2.0"
+version = "5.2.1"
 source = { editable = "." }
 dependencies = [
     { name = "matplotlib", version = "3.10.9", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },