fix(rds): deduct expiring RIs from family coverage in target-coverage sizing

cmd/archera_comparison.go

@@ -81,7 +81,7 @@ func runArcheraComparison(cmd *cobra.Command, _ []string) error {
 
 	// Config and client stay local to this call; never store them in a
 	// package variable or struct.
-	client, err := insurance.NewClient(insurance.Config{APIKey: key, OrgID: orgID}, archeraHTTPClient)
+	client, err := insurance.NewClient(insurance.Config{APIKey: insurance.NewSecret(key), OrgID: orgID}, archeraHTTPClient)
 	if err != nil {
 		return err
 	}

cmd/archera_comparison_key_test.go

@@ -145,6 +145,11 @@ func TestArcheraLongKeyVisibleDisguisesAreWithheld(t *testing.T) {
 	}
 	for name, echo := range echoes {
 		forArcheraErrorPaths(t, echo, []int{0}, func(path, got string) {
+			if path == "decode" {
+				// pkg/insurance no longer echoes vendor values in decode errors.
+				assert.Empty(t, archeraReadableKeyFragment(got), "%s %s: %q", path, name, got)
+				return
+			}
 			assert.Contains(t, got, archeraWithheld, "%s %s: %q", path, name, got)
 		})
 	}

cmd/archera_comparison_test.go

@@ -497,7 +497,8 @@ func TestArcheraErrorsMaskObfuscatedKey(t *testing.T) {
 		out, errOut, err := runArchera(t, fullEnv())
 		require.Error(t, err)
 		assert.NotContains(t, out+errOut+err.Error(), k)
-		assert.Contains(t, err.Error(), "[redacted]")
+		// pkg/insurance no longer echoes the rejected value at all.
+		assert.Contains(t, err.Error(), "not shown")
 	})
 	t.Run("plain key as enum value", func(t *testing.T) {
 		body := strings.Replace(archeraComparisonFixture(), `"payment_option":"no_upfront"`, `"payment_option":"`+k+`"`, 1)
@@ -567,7 +568,11 @@ func TestArcheraErrorsWithholdKeyHiddenBehindSurvivingCharacters(t *testing.T) {
 				out, errOut, err := runArchera(t, fullEnv())
 				require.Error(t, err)
 				assert.NotContains(t, out+errOut, k)
-				checkMsg(t, err.Error())
+				// pkg/insurance no longer echoes the rejected value, so there is
+				// nothing to withhold; the key must still not appear.
+				assert.NotContains(t, err.Error(), k)
+				assertArcheraNoControlChars(t, err.Error())
+				assert.LessOrEqual(t, len(err.Error()), archeraMaxErrorSize)
 			})
 			for kind, wrapped := range map[string]error{
 				"transport": errors.New(msg),

cmd/multi_service.go

@@ -51,10 +51,7 @@ func fetchExistingCoverage(ctx context.Context, awsCfg aws.Config, recClient pro
 		// not subject to the fail-closed behavior below.
 		return nil, nil
 	}
-	lookbackDays := cfg.CoverageLookbackDays
-	if lookbackDays <= 0 {
-		lookbackDays = 30
-	}
+	lookbackDays := coverageLookbackDays(cfg)
 	regions := cfg.Regions
 	if len(regions) == 0 {
 		allRegions, err := getAllAWSRegions(ctx, awsCfg)
@@ -1059,3 +1056,12 @@ func exitOnExclusionError(err error) {
 		log.Fatalf("Cannot apply extended-support exclusion: %v", err)
 	}
 }
+
+// coverageLookbackDays is the Cost Explorer coverage lookback: the one value
+// given to GetRICoverageMap and to the RDS family sizing, which must agree.
+func coverageLookbackDays(cfg Config) int {
+	if cfg.CoverageLookbackDays <= 0 {
+		return 30
+	}
+	return cfg.CoverageLookbackDays
+}

cmd/multi_service_helpers.go

@@ -469,6 +469,8 @@ func processRegionRecommendations(
 	// fetch expiring commitments — expiry-aware sizing only runs via the
 	// main pipeline in fetchAndFilterRegionRecs, which has access to the
 	// regional service client at the right moment. Drop tracking skipped (nil).
+	// nil commitments: no expiry deduction, so family sizing is identical to
+	// ApplyFamilyNUSizingRDS (documented on applyCoverageAndOverrides).
 	filteredRecs := applyCoverageAndOverrides(recs, cfg, coverageMap, nil, nil)
 
 	result.recommendations = filteredRecs
@@ -616,6 +618,13 @@ func applyRegionFilters(
 // ExistingCoveragePct further by the share of pool demand attributable to
 // RIs expiring within the window, so --target-coverage recommends
 // replacements before the cliff. Doesn't run if either input is empty.
+// RDS recs sized by the family-NU pass (target-coverage mode) ignore that
+// per-rec adjustment and instead get the same commitments and window through
+// ApplyFamilyNUSizingRDSWithExpiryOptions, which deducts expiring normalized units
+// from the family's coverage and credits replacement RIs bought inside the
+// coverage lookback (so a re-run does not buy them again); this deliberately
+// raises RDS counts and costs when RIs are about to expire (cli#2132). Callers passing nil commitments
+// get the plain ApplyFamilyNUSizingRDS behavior.
 //
 // drops accumulates per-reason drop counts for the end-of-run summary.
 // Pass nil to skip tracking.
@@ -640,7 +649,12 @@ func applyCoverageAndOverrides(recs []common.Recommendation, cfg Config, coverag
 	rest := recs
 	if cfg.TargetCoverage > 0 {
 		var familyDrops recommendations.FamilyDropCounts
-		sizedRDS, rest, familyDrops = recommendations.ApplyFamilyNUSizingRDS(recs, coverageMap, cfg.TargetCoverage)
+		var expiry recommendations.FamilyExpiryReport
+		lookbackDays := coverageLookbackDays(cfg)
+		sizedRDS, rest, familyDrops, expiry = recommendations.ApplyFamilyNUSizingRDSWithExpiryOptions(
+			recs, coverageMap, cfg.TargetCoverage, expiringCommitments,
+			recommendations.FamilyExpiryOptions{WindowDays: cfg.RebuyWindowDays, CoverageLookbackDays: lookbackDays})
+		logFamilyExpiry(expiry, cfg.RebuyWindowDays, lookbackDays)
 		drops.Add(common.DropFamilyAlreadyAtTarget, familyDrops.AlreadyAtTarget)
 		drops.Add(common.DropFamilyNoNUSignal, familyDrops.NoNUSignal)
 		drops.Add(common.DropFamilySizedToZero, familyDrops.SizedToZero)
@@ -662,6 +676,21 @@ func applyCoverageAndOverrides(recs []common.Recommendation, cfg Config, coverag
 	return filteredRecs
 }
 
+// logFamilyExpiry reports how rebuy-window expiry was folded into the RDS
+// family-NU sizing. Unusable RIs (unparsable instance class, or an engine
+// spelled differently from the coverage report) were NOT deducted, so they are
+// warned about rather than read as "no expiry".
+func logFamilyExpiry(expiry recommendations.FamilyExpiryReport, windowDays, lookbackDays int) {
+	if expiry.ExpiringNU > 0 {
+		// The exact deduction is capped by the covered and active NU per family
+		// (go#342); report the inputs rather than claim a net figure.
+		AppLogger.Printf("  ⏰ RDS family sizing: %.0f normalized units of RIs expiring within %d days considered against family coverage; %.0f units of replacement RIs started in the last %d days credited back\n", expiry.ExpiringNU, windowDays, expiry.ReplacementNU, lookbackDays)
+	}
+	if expiry.Unusable > 0 {
+		AppLogger.Printf("  ⚠️  %d RDS reserved instances expiring within %d days could not be applied to family sizing (unparsable instance class or no matching coverage family); their expiry was NOT deducted\n", expiry.Unusable, windowDays)
+	}
+}
+
 // checkDuplicates adjusts recommendations against already-owned RIs so the run
 // does not double-purchase existing capacity.
 //