Function restore_bootstrap 

pub fn restore_bootstrap(
    snapshot: impl AsRef<Path>,
    target: impl AsRef<Path>,
    source: &str,
) -> Result<Option<String>, ReplicaError>

Restore a follower’s data file from a self-describing snapshot — the §10.4 bootstrap path, taken by a brand-new follower OR one that fell off the master’s retention window (cursor-too-old, CHANGE-SOURCE-DESIGN.md §10.2). The snapshot is an ordinary, consistent SQLite follower snapshot (including a canonical portable base materialized by rindle-backup), so restoring is:

1. drop any stale WAL/wal2/shm siblings of target and copy the snapshot over it — a fresh lineage, not a merge;
2. the wal→wal2 rollback hop (journal_mode=delete then =wal2): wal2 cannot be switched into directly from wal (§10.3), and the snapshot arrives in rollback (delete) mode;
3. if present for backward-compatible follower snapshots, truncate _rindle_change_log — frozen dead weight on a follower, which tails the master live rather than serving the log;

then returns the file’s own cursor for source (the resume point: a follower opens the cluster normally and subscribes from here). The snapshot’s _rindle_source_offsets row is keyed by the upstream source name, which is exactly the follower’s resume key — no rewrite.

Restores into wal2 — the follower/backup fleet contract (docs/SQLITE_WAL2.md); restore_bootstrap_with_journal is the plain-WAL branch (design 306 D5) for a deployment that runs its replicas on ordinary wal.