Bulk attribution resolvers should recover missing entity boundaries

A bulk attribution resolver that depends on an entity-specific boundary should own recovery of missing boundary inputs, not assume every optimized caller projection is complete.

This applies when records are gathered by a reusable key (such as a phone) and then attributed per entity or case using a start time. Normalize accepted boundary representations at the resolver edge, reuse caller-supplied values when valid, batch-fetch missing authoritative values, and fail closed for any boundary that remains unresolved. A global candidate prefilter is safe only if the boundary-input set is proven complete.

Limits: the fallback may add one batched query, so callers should still supply complete inputs for performance. This pattern does not replace a durable entity ID on source records; it is a containment strategy when attribution metadata is absent.

Evidence/example — 2026-09-14, GitHub PR #871 and CI run 34907675630: a dashboard browser regression showed one matching candidate event but no usable load-start input from the paginated/deep-link assembly. Recovering missing starts from the authoritative flows table preserved post-start history while retaining the per-load exclusion boundary.