fix(unvalidated_lookup_chain): suppress dict write FP

Dict writes (collection[var] = value, ctx=Store) never raise KeyError —
only reads can. Also treat a write as an implicit guard so subsequent
reads of collection[var] on the next lines are not flagged.

Eliminates ~17 false positives in tadata-org/fastapi_mcp where
properties[param_name] = copy() was flagged then properties[param_name]["title"] = ...
was also flagged as unvalidated even though the key was just created.

Adds test: test_unvalidated_lookup_chain_dict_write_not_flagged (170 tests total).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Your Name

failure_mode.py

@@ -1341,6 +1341,13 @@ def visit_Subscript(self, node: pyast.Subscript) -> None:
                 # defaultdict never raises KeyError on missing keys
                 self.generic_visit(node)
                 return
+            if isinstance(node.ctx, pyast.Store):
+                # Dict write: collection[var] = ... — never raises KeyError.
+                # Also serves as an implicit guard: var is now in collection for
+                # subsequent reads (e.g. collection[var]["sub"] = ... on next line).
+                self._guarded.setdefault(var, set()).add(collection)
+                self.generic_visit(node)
+                return
             guarded_against = self._guarded.get(var, set())
             if collection not in guarded_against:
                 results.append(

test_checker.py

@@ -1440,6 +1440,37 @@ def aggregate(records):
     assert not v, "annotated defaultdict subscript must not be flagged"
 
 
+def test_unvalidated_lookup_chain_dict_write_not_flagged(tmp_path):
+    """Dict write d[k] = v where k came from .get() must NOT be flagged.
+    Corpus: tadata-org/fastapi_mcp — operation_map[operation_id] = {...}
+    where operation_id = operation.get('operationId'). Dict writes never raise
+    KeyError; also serves as implicit guard for subsequent reads."""
+    _write_src(
+        tmp_path,
+        "convert.py",
+        """
+        def build_map(operations):
+            operation_map = {}
+            properties = {}
+            for operation in operations:
+                operation_id = operation.get('operationId')
+                if not operation_id:
+                    continue
+                # Write — must NOT flag (no KeyError possible on dict write)
+                operation_map[operation_id] = {'method': 'get'}
+                param_schema = operation.get('schema', {})
+                param_name = operation.get('name')
+                if param_name:
+                    properties[param_name] = param_schema.copy()
+                    # Subsequent read after write above — still NOT a bug
+                    properties[param_name]['title'] = param_name
+    """,
+    )
+    violations = check_codebase(tmp_path)
+    v = [v for v in violations if v.context == "unvalidated_lookup_chain"]
+    assert not v, f"dict write d[k]=v must not be flagged as unvalidated_lookup_chain: {v}"
+
+
 def test_optional_dereference_get_with_default_not_flagged(tmp_path):
     """.get(key, default) with a non-None default must not be flagged."""
     _write_src(