Initial-snapshot public config validation + the bootstrap orchestration (C2 Task 10 — the P0 pre-seed that avoids C1b, design Q10 / Ch5).

What the bootstrap does

In snapshot mode Capstan.Supervisor calls bootstrap/4 after starting the checkpoint + snapshot stores and BEFORE it reads the checkpoint position, so the pre-seed lands first:

1. Read the durable %Capstan.Snapshot.State{} + reconcile its table set against config. The stored state binds the tables introspected at the fresh start; the configured snapshot.tables must still match it (reconcile_tables/2) or the bootstrap halts :snapshot_config_drifted — a table ADDED to config after a :complete/mid-snapshot state would otherwise be silently never backfilled (both the :complete short-circuit and open_resume/3 key off the STORED set). status: :complete (with a matching set) ⇒ the backfill is already done — signal :complete so the supervisor wires the real sink directly (pure C1, no coordinator). No source connection is opened in this case (the reconcile is a pure key comparison).
2. Establish the transient query connection, source-identity pinned (Ch8). The stream connection's @@server_uuid is read via Capstan.Config.read_server_uuid/1 over an independent authenticated socket, and the Capstan.Query connection is established pinned to it (:expected_server_uuid). A query connection that lands on a DIFFERENT replica than the stream — a VIP failover between the two connects — is caught :snapshot_source_mismatch (the cross-connection check, Task-9-F1 / Task-4).
3. Resolve P0. A FRESH start reads P0 = @@global.gtid_executed over the query connection (a read fault halts :snapshot_bootstrap_gtid_read_failed). A mid-snapshot RESUME uses the STORED p0 from the durable %State{} — immune to @@gtid_executed drift across a bootstrap crash.
4. Seed the checkpoint store. P0 is written ONLY when the checkpoint is empty or already equals p0 (seed_checkpoint/2) — it NEVER regresses a watermark the stream already advanced. This makes the dump AND the assembler watermark both resolve to P0 through the sanctioned start_position: :checkpoint path (no C1b, no ADR-0004 supersession).
5. Seed the durable %State{} + open the readers. A Capstan.Snapshot.ChunkReader is opened per not-done snapshot table (introspecting the order-faithful PK + baseline fingerprint), and the %State{} (per-table pk_cursor: :start, p0) is persisted. On resume the durable per-table cursors are kept and each reader reopened with the stored fingerprint (a schema drift across the resume is caught on chunk 1).

The supervisor then starts the Capstan.Snapshot.Coordinator with processed_set = the live watermark (P0) so a chunk whose G ≤ P0 emits immediately (Task-8-F2), wires it as the assembler's sink by NAME, and injects the observer + monitor via Capstan.AssemblerServer.attach_coordinator/2.

Retention purge racing the bootstrap (tripwire 11)

The seed NEVER masks a retention gap. Across a bootstrap crash-window (the checkpoint seeded but the %State{} not yet written), a re-bootstrap reads a fresh gtid_executed = p0' yet seed_checkpoint/2 LEAVES the earlier P0 untouched (p0' ≠ P0). If the source has since PURGED past that P0, the stream resumes from it and the EXISTING C1 gap gate fires :data_gap — the bootstrap does not map error 1236 to :ok, nor overwrite the gapped checkpoint with the current position (which WOULD mask the loss).

Rule 1

P0 and the %State{} p0 are GTID-set STRINGS (Capstan.Gtid form) — structural, not row values. The per-table pk_cursor/fingerprint are user data; they live only in the durable %State{} (whose Inspect elides the tables map) and are never logged or telemetered here. Every failure is a value-free atom; the transient query connection's password never leaves the Capstan.Query handle.