One missing final-file check: your last answer said bootstrap_dimension.py was not reviewed. Here is the COMPLETE current file directly, without a large bundle. Please inspect the two named-location updates, namespace binding, lease and validation-before-rename. Return at most 400 words: any concrete release blocker, or ACCEPT WITH LIMITS. Do not execute tools. The previously reported real native acceptance already passed.

"""Create a NEW Dimension from a verified composition. Never modifies an existing one.

The Vercy skill path is an explicitly trusted caller input, not package content.
Semantic packages are kept in a separate registry; only explicit native bindings
enter the current V1-V3 registry. Nested semantic validation remains mandatory.
"""
from pathlib import Path
import argparse, json, os, shutil, subprocess, sys, tempfile, uuid
import composition as c

def bootstrap(stage,policy,lock,skill,target,name,namespace):
    stage=Path(stage).resolve();skill=Path(skill).resolve();target=Path(target).absolute()
    plan_raw=(stage/'composition-plan.json').read_bytes();plan=json.loads(plan_raw)
    receipt=c.load(stage/'receipt.json')
    c.require(receipt.get('status')=='assets-staged' and receipt.get('planDigest')==c.digest(plan_raw),'STAGE','unrecognized or changed staged plan')
    policy_raw=Path(policy).read_bytes();lock_raw=Path(lock).read_bytes()
    c.require(c.load(lock).get('models')==[],'NEW-ONLY','new Dimension requires empty starting lock; existing data needs a separate migration')
    c.validate(plan,stage/'assets',policy_raw,lock_raw)
    c.require(namespace==plan['dimensionId'],'OWNER','created Dimension namespace must equal the authorized dimensionId')
    c.require(target.parent.is_dir() and not target.exists(),'NEW-ONLY','target must not exist; create its parent first')
    c.require((skill/'scripts/create_dimension.py').is_file() and (skill/'scripts/vercy.py').is_file(),'SKILL','trusted local Vercy skill is required')
    lease=target.parent/('.'+target.name+'.composition-write.lock')
    try:lease.mkdir()
    except FileExistsError:raise c.Invalid('BUSY: another bootstrap or stale lease exists')
    temp=None
    try:
        (lease/'owner.json').write_bytes(c.encode({'pid':os.getpid(),'nonce':str(uuid.uuid4()),'createdAt':c.now()}))
        temp=Path(tempfile.mkdtemp(prefix='.'+target.name+'.bootstrap-',dir=target.parent))
        cmd=[sys.executable,str(skill/'scripts/create_dimension.py'),'--target',str(temp),'--name',name,'--namespace',namespace,'--owner',plan['authority']['owner'],'--preset','commercial-company','--purpose',plan['authority']['purpose']]
        proc=subprocess.run(cmd,capture_output=True,text=True,encoding='utf-8')
        c.require(proc.returncode==0,'BOOTSTRAP',proc.stderr or proc.stdout)
        # Change only the two location fields in the current trusted template.
        dimension=c.load(temp/'dimension.yaml')
        c.require(dimension['id']==namespace and dimension['canonical']['location']==str(temp),'BOOTSTRAP','unexpected trusted Dimension template')
        dimension['canonical']['location']=str(target)
        (temp/'dimension.yaml').write_bytes(c.encode(dimension))
        guide=temp/'AGENTS.md';text=guide.read_text(encoding='utf-8')
        old='- Canonical location: '+str(temp)
        c.require(text.splitlines().count(old)==1,'BOOTSTRAP','unexpected canonical-location entry')
        guide.write_text('\n'.join('- Canonical location: '+str(target) if line==old else line for line in text.splitlines())+'\n',encoding='utf-8',newline='\n')
        native=[];semantic=[];pins=[]
        for r in plan['releases']:
            prefix='models/composed/'
            for _,d in c.descriptors(r):
                raw=c.safe_path(stage/'assets',d['path']).read_bytes()
                c.require(c.digest(raw)==d['digest'],'STALE','asset changed after verification')
                dest=c.safe_path(temp,prefix+d['path'],exists=False);dest.parent.mkdir(parents=True,exist_ok=True);dest.write_bytes(raw)
            pin={'id':r['modelId'],'version':r['version'],'status':'published','digest':r['specification']['digest'],'specUrl':r['specification']['sourceUrl'],'agentsUrl':r['agents']['sourceUrl'],'location':str(Path(prefix+r['specification']['path']).parent).replace('\\','/'),'readiness':r['installationMode']}
            pins.append(pin)
            row={'id':r['modelId'],'version':r['version'],'agents':prefix+r['agents']['path'],'specification':prefix+r['specification']['path'],'specificationDigest':r['specification']['digest']}
            if r['binding']:
                row['runtimeSchema']=prefix+r['binding']['runtime']['path'];row['runtimeSchemaDigest']=r['binding']['runtime']['digest'];row['bindingScope']=r['binding']['scope'];native.append(row)
            else:semantic.append({**row,'readiness':'semantic-only','nativeFactsAllowed':False})
        registry=c.load(temp/'registries/meta-models.yaml');registry['models']=native;(temp/'registries/meta-models.yaml').write_bytes(c.encode(registry))
        (temp/'registries/semantic-models.yaml').write_bytes(c.encode({'format':'vercy-semantic-model-registry','version':1,'models':semantic,'note':'Semantic references, not native V1-V3 model entries.'}))
        newlock=c.load(temp/'vercy.lock');newlock['models']=pins;(temp/'vercy.lock').write_bytes(c.encode(newlock))
        links=c.load(temp/'registries/model-links.yaml');links['links']=[{'source':r['modelId'],'type':'requires','target':t['modelId'],'version':t['version']} for r in plan['releases'] for t in r['requires']];(temp/'registries/model-links.yaml').write_bytes(c.encode(links))
        events=c.load(temp/'registries/events.yaml');events.setdefault('events',[]).append({'id':plan['planId']+':bootstrap','type':'composition-bootstrapped','occurredAt':c.now(),'actor':plan['authority']['actor'],'subject':plan['dimensionId'],'planDigest':c.digest(plan_raw),'nativeBoundModels':len(native),'semanticOnlyModels':len(semantic)});(temp/'registries/events.yaml').write_bytes(c.encode(events))
        proof=temp/'composition';proof.mkdir();(proof/'plan.json').write_bytes(plan_raw);(proof/'staging-receipt.json').write_bytes(c.encode(receipt))
        proc=subprocess.run([sys.executable,str(skill/'scripts/vercy.py'),'validate',str(temp)],capture_output=True,text=True,encoding='utf-8')
        report=json.loads(proc.stdout);c.require(proc.returncode==0 and report.get('valid'),'NATIVE','staged Dimension failed V1-V3 validation: '+proc.stdout)
        report.pop('dimension',None)
        (proof/'bootstrap-validation.json').write_bytes(c.encode(report))
        c.require(Path(policy).read_bytes()==policy_raw and Path(lock).read_bytes()==lock_raw,'STALE','policy or starting lock changed')
        c.validate(plan,stage/'assets',policy_raw,lock_raw)
        c.require(not target.exists(),'NEW-ONLY','target appeared before activation')
        os.rename(temp,target);temp=None
        return {'created':True,'target':str(target),'nativeBoundModels':len(native),'semanticOnlyModels':len(semantic),'nativeControlValidation':report,'limits':'No instance facts created. Native binding checks do not execute companion validators or certify nested semantics. Existing Dimensions are not changed.'}
    finally:
        if temp is not None and temp.parent==target.parent and temp.name.startswith('.'+target.name+'.bootstrap-'):shutil.rmtree(temp)
        shutil.rmtree(lease)

def main():
    p=argparse.ArgumentParser(description=__doc__)
    for name in ['stage','policy','lock','skill','target','name','namespace']:p.add_argument('--'+name,required=True)
    a=p.parse_args()
    try:print(json.dumps(bootstrap(a.stage,a.policy,a.lock,a.skill,a.target,a.name,a.namespace),ensure_ascii=False,indent=2));return 0
    except (c.Invalid,ValueError,OSError,KeyError,TypeError) as e:print(json.dumps({'created':False,'error':str(e)},indent=2));return 1
if __name__=='__main__':sys.exit(main())