### reproduction input
# A local Rails runner created a WhatsApp Cloud channel, inbox, visitor contact,
# and ContactInbox, then invoked IdentifierSyncService with this source list:

```ruby
["", nil, "919745786257", "IN." + ("a" * 129)]
```

### observed failure
# The synchronization failed while create_contact_inboxes attempted to persist
# the malformed source ID.

ActiveRecord::RecordInvalid
Source invalid source id for whatsapp inbox. valid Regex ...

# The exception occurred before update_contact_type_for_bsuid_identity. The
# invalid-only case did not complete, and the appended-valid comparison could
# not be executed.

### service path
```ruby
def perform(source_ids: [], username: nil, phone_number: nil)
  create_contact_inboxes(source_ids)
  update_contact(source_ids, username, phone_number)
end

def create_contact_inboxes(source_ids)
  source_ids.compact_blank.uniq.each do |source_id|
    next if inbox.contact_inboxes.exists?(source_id: source_id)
    inbox.contact_inboxes.create!(contact: synced_contact, source_id: source_id)
```

```ruby
  return if synced_contact.blank?

  update_contact_phone_number(phone_number)
  update_contact_username(username)
  update_contact_type_for_bsuid_identity(source_ids)
end

def update_contact_type_for_bsuid_identity(source_ids)
  return unless synced_contact.visitor?
  return unless source_ids.any? { |source_id| whatsapp_bsuid_source_id?(source_id) }

  synced_contact.update!(contact_type: :lead)
end
```

### validation path
```ruby
WHATSAPP_BSUID_PATTERN = '[A-Z]{2}\\.(?:ENT\\.)?[A-Za-z0-9]{1,128}'.freeze
WHATSAPP_BSUID_REGEX = Regexp.new("\\A#{WHATSAPP_BSUID_PATTERN}\\z")
WHATSAPP_CHANNEL_REGEX = Regexp.new("\\A(?:\\d{1,15}|#{WHATSAPP_BSUID_PATTERN})\\z")
```

```ruby
  return if WHATSAPP_CHANNEL_REGEX.match?(source_id)

  errors.add(:source_id, "invalid source id for whatsapp inbox. valid Regex #{WHATSAPP_CHANNEL_REGEX}")
end
```

# The BSUID suffix allows 1-128 characters. The 129-character suffix therefore
# fails ContactInbox validation, and create! raises before the any?-based lead
# classification can inspect the remaining source IDs.

### execution context
# Local-only API and WhatsApp webhook authentication bypasses plus a test-only
# channel validation stub were used to create fixtures and reach the service.
# The failing alias creation and source-ID validation path is application
# behavior, not a bypass effect.
# Local browser execution was not used as proof: the relevant backend behavior
# was exercised through the Rails service path.

### final result
# final result: BF-BOUND-2 failed - a malformed overlong WhatsApp ID aborts
# ContactInbox alias creation, so synchronization cannot continue to evaluate a
# valid BSUID and promote the visitor to a lead.