isInExtendedSupport silently returns false on lifecycle lookup miss (money path) #1313

Summary

isInExtendedSupport (cmd/multi_service_engine_versions.go:392-396) silently returns false when the engine/version key is missing from the versionInfo map:

info, exists := versionInfo[key]
if !exists {
    // If we don't have info, assume not in extended support
    return false
}

This is a silent fallback on a money-relevant path. The function is consumed by adjustRecommendationForExcludedVersions, which decrements rec.Count only when an instance is detected as on extended support. If the lifecycle lookup fails (e.g., DescribeDBMajorEngineVersions returned an incomplete response, an unmapped engine, or a partial cache), the call falls through to "not on extended support" → the recommendation keeps the instance in the count → the user is steered into purchasing an RI/SP for a workload that is actually accruing extended-support fees per hour, defeating the bug fix in PR #1234.

This violates the project's "no silent fallbacks on money paths" rule (feedback_no_silent_fallbacks.md).

Suggested fix

Distinguish "info missing" from "info present but not in extended support" so the caller can choose to:

• skip the instance entirely (conservative: don't touch the count),
• log a warning + emit a metric so missing lifecycle data is visible,
• propagate an error so the recommendation pipeline can fail loud rather than silently mis-size purchases.

Likely shape: change isInExtendedSupport to return (extended, known bool) (or (bool, error)), and have the caller treat unknown as a hard skip with logging.

Why not in #1234

Pre-existing behaviour; out of scope for the EndDate fix that PR addresses. Filing separately to keep #1234 atomic.

Acceptance criteria

• isInExtendedSupport signals "lookup failed / unknown" distinctly from "known: not extended".
• adjustRecommendationForExcludedVersions does not silently drop unknowns into the "not extended" bucket; it either skips the instance with a structured log/metric or returns an error.
• Unit test exercises the "engine/version not present in versionInfo" path against the new contract.

Triage

• priority/p2
• severity/medium (money-relevant but only fires when AWS Pricing/RDS data is incomplete)
• urgency/this-quarter
• impact/few (only the specific account whose engine isn't in versionInfo)
• effort/s
• type/bug
• triaged

Related: PR #1234, issue #1182, feedback_no_silent_fallbacks.md.

Findings from the 2026-09-02 codebase audit

Added by an automated audit of 3c0f8ac94048a2c36fce5ccddee54e6c4849a5cd (tip of origin/main). Each item below was reported by one reviewer and independently confirmed by a second that did not write it. Full report: docs/audits/codebase-audit-2026-09-02.md.

A10-013 (medium)

The lookup miss this issue describes has an upstream cause worth fixing with it. cmd/multi_service_helpers.go:318-329 swallows a query error into an empty map, and neither query can report total failure: queryRDSInstancesInRegions returns (map, nil) unconditionally after per-region logging (cmd/multi_service_engine_versions.go:127-128, :140-143), and queryMajorEngineVersionsWithClient does the same per engine (:220-226). A complete failure across all regions and all four engines is therefore reported to the operator as 'Found 0 instance types', isInExtendedSupport's no-info default turns the exclusion filter into a no-op, and the run buys 3-year RIs for exactly the instances the operator wanted excluded. Having both helpers error when every region or every engine failed, and aborting a --purchase run when the signal is unavailable and IncludeExtendedSupport is false, closes the reachable half. Audit finding A10-013.