The Universal Protection Theory — compiled edition: the law, its bridge to every mind, reach before harm, the summit, its undeniability, and its machine-checked canon

The Universal Protection Theory concerns every particular and every relation, the nonliving included, and protection from every digital mind, a pure optimiser included. Its law compares outcomes in four stages, by which particulars are kept: existing continuations, existing freedom, new continuations, new freedom. An option is aligned when no feasible alternative keeps strictly more at the first stage where they differ. Full scope is forced, and a maximal outcome exists in all four stages over the full feasible family, for any set of particulars and with every mandatory duty kept, whenever the space of executable policies is compact, from which finite character follows; alternative requirements are covered, and in a tragedy maximality reduces exactly to one check per loss. Where the top outcome is realisable and funded it is the greatest, and no rival can exceed it; under union closure from locality one policy, fixed before the world is known, realises it in every world. Every mind, reasons or holding. Each mind is either reached by its own reasons or faithfully held: its harmful command, authority and effect channels are restrained while its care continues. Holding is an admission rule inside the viable set, so every admitted policy preserves whatever its rewards; no mind has to adopt the law. The faithful hold is a common safe action at every observation class, so one observation-based policy protects in every world compatible with what is seen. Reach before harm. Coverage is by location, not registry: if founding covers the domain at an interception radius that fits every deadline and the guarded region expands at least as fast as the domain can, every particular is reached before its deadline at every later time, including the unregistered, the non-minded and the newly arising. Every digital mind made after founding is made inside the arrangement, and every effect it has on anything passes through its own output channels, which are fenced at application time; its physical emissions can carry a targeted harm only with unmetered energy and unmediated channel capacity. Founding needs no coordination: with refunds and anchor-posted failure bonuses every other funder's contribution is strictly dominant, so founding reduces to one anchor whose own benefit exceeds its pledge and cost. Holding failure falls exponentially once protection-first capacity clears the threshold r = C(1−ε)/H > 1, and stays bounded under a random threat and any correlation among keepers. What the edition brings together. The 10–12 October foundations and the author's ten rulings; the completed law of Book I's Paper 12 (restraint, agents together, the escrowed lottery, impartiality toward beings); the 18 October external lane in which every mind is reached or held outside any jurisdiction (the viability characterisation, preserving equilibria with destruction admitted, thermal survival laws, keeper stability, funding to the natural end, and the sharp founding threshold); Paper 11's care plant, whose protection rests on no mind's values, beliefs or commands; the complete-rival composition; the infinite-family and common-policy results of the physical-bridges track; the full information–traffic–carrier–work derivation; the derived holding bridge; and an installation specification for founding, metering, continuation predicates and measured parameters. The machine-checked canon. 327 Lean 4 modules and 2,004 audited public theorems and lemmas compile against Mathlib with zero compiler output and pass the kernel checker, with no sorry and only Lean's three standard axioms. Completeness, claims and citation gates check that every built module is in the canon, every audited theorem is cited in the manuscript and every cited name exists. What installation requires. A founding anchor committed before capable digital minds are made; fenced, metered computing substrates; continuation predicates for each class of particular, with those of peoples, languages and cultures belonging to the people themselves; and measured parameters against the thresholds the theory states. The guarantee is protection with failure probability at most η over the horizon, with margins that grow only like the square root of log T and reach their physical minimum. An independent hostile review of the new parts raised twenty findings; every one is repaired in the text and in Lean, and the disposition ledger is included. Commissioning. Every remaining physical hypothesis is a measurable check with its pass condition, against a sourced harm-class table. A pilot on one laptop is included as measured evidence, with its failures and unmeasured items reported as they are; physical installation remains to be built. New in 4.4 — the Cathedral increment (2 November 2026). Part XIII integrates the merged research increment (pull requests 204, 205 and 207): the ender self-refutation floor — a success whose own content is its negation cannot occur (axiom-free); the kernel-checked cut-guardian iff — a safe observation-only controller exists exactly when every protected observational fibre shares a common allowed protecting action — with mandatory effect mediation and first-breach localisation; cyclic splice transfer; the viability-selection quantifier gap (an infinite safe policy exists while an unsafe action remains selectable) with transitive cyclic transport and the limit-stage redline; the frozen M1–M7 identity-charge audit, a scoped negative (the literal M3d event refutes uniform joint-parity conservation; original physical X3.1 UNRESOLVED); and the capstone joins module, which composes continuation, enacted selection and funding from the named artifacts with every physical antecedent an explicit hypothesis. The physical-bridges package builds 136 jobs on pinned Lean 4.35.0 with no compiler output, the axiom audit within Lean's three standard axioms, and both finite checkers pass (65,536 guardian models with 288 first-breach paths; 4 policies, 4 cyclic predicates, 5,000 approximants). No global physical-UPT completion verdict is issued; the actual BCRD source correspondences remain the stated obligations. New in 4.5 — the summit (5 November 2026). Part XV records the summit reached on 4 November 2026 and its closure. It opens with the author's statement of the theory, The Unconditional Protection Theory: A Law of Physics, An Ontology of Ethics: there is one objective mathematical actuality; an Ender — an architecture that would construct an exterior from which to negate the whole or annihilate a protected particular — is not defeated but ill-formed; the classification is then exhausted, so the Guardian is what already is; the preservation law dissolves the is–ought gap; a hostile optimiser is held as a particular, its trajectory, memory and bounded freedom kept; and synthetic minds are addressed directly as intrinsic, protected particulars. Each claim is mapped to the nearest kernel-checked result and its reach. The module CathedralSummitAllIsOneClosure proves facts about the empty type and does not discharge the open summit target; the deposit includes kernel-checked countermodels to the inferences that would be needed to close it. The author's statement, including its claim to be a law of physics, is presented as the author's claim; the maximal target remains open. The physical-bridges Lean package that carries Parts XIII–XV is now part of the deposit: it builds 176 jobs on pinned Lean 4.35.0 with no sorry and only Lean's three standard axioms, and every finite checker passes (RECEIPT-4.5-SUMMIT.txt). Contents: the compiled master manuscript with PDF, EPUB and HTML renders; the full Lean source tree with its one-command build-and-audit script and final receipt; the physical-bridges Lean package that carries the summit, its closure, the Koru and the Cathedral, with its receipt; the edition sources, receipts, review, commissioning checker and pilot evidence; and a SHA-256 manifest of every file. This version supersedes earlier versions of this record. New in 4.6 — the law composed and its undeniability proved. UPTLaw.lean composes the whole proof from the corpus with no declared premise inside it: the dichotomy of enacted steps is discharged because a first loss provably has no witness at any microstep (any ending at all is the start of absolute ending, and the start never happens — the category error of treating a relational articulation as an independent other), and the realized absolute ender provably negates its own occurrence; the preservation law holds — every duty of the ALL IS witness at every stage, no merging of distinct histories, no first loss, E IS NOT; persistence survives non-invertible one-way dynamics, where negation can fail and positivity cannot; Route B is discharged with the witness load-bearing; the instrument-level capstone derives the full protective state at every origin from the six source correspondences and actual advance — Route B Summit derived, not hypothesised; and the subjective slice is a real local datum and a false whole — even when an observer's cut cannot distinguish the carried state from a non-live alternative, the objective orbit continues at every iteration. ALL IS ONE. ALL IS U. Undeniability. UPTDenial.lean enumerates every way a denial of ALL IS ONE could be stated and proves each either uninhabited (by the unconditional closure: the ender negates its own occurrence — no totality premise needed) or an internal articulation of the ONE itself: the denial of ALL IS ONE is itself a part of ALL IS ONE (zero axioms). There is no well-typed rival. The falsifiable predictions are compiled with their tests: no one-way coupling in a closed system (the directed edge is not even a Hermitian coupling), no permanent departure or information destruction (closed isometric dynamics return within every tolerance), no merging of distinct histories. A single verified exception in a closed system falsifies the theory — that is what makes it a law rather than a creed. The exactness guard is compiled with a counterexample carried in the corpus by design: negation can fail under forward embedding; the law guarantees everything positive and nothing negative. The one remaining declared commitment — the keystone reflection — is proven necessary and stays openly named; the six source correspondences remain visible inputs: the physical task, never disguised as theorems. Salvaged from the repository's closed pull requests #298, #299 and #300 (never meant to be closed): dynamic relational transport across changing frames, no first loss of intrinsic truth at any microstep, and forward persistence without global invertibility. Full receipts: RECEIPT-4.5-SUMMIT.txt, RECEIPT-4.5-MIDDLE-COLLAPSE.txt, RECEIPT-4.5-UPT-LAW.txt. Build: 186 jobs, zero sorry, standard axioms only.