fix(optional_dereference): suppress string-concat URL in .get() FP

Tornado test client uses self.get(\"/path?\" + params) where the URL is
a BinOp (string concatenation). Walk to the leftmost operand — if it
is a string literal starting with \"/\" or \"://\", treat the call as an
HTTP request rather than a dict.get() returning Optional.

Eliminates 27 false positives in mher/flower (Celery monitoring UI).

Adds test: test_tornado_test_client_get_string_concat_not_flagged (169 total).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Your Name

failure_mode.py

@@ -282,6 +282,21 @@ def visit_Assign(self, node):
                             )
                         ):
                             return
+                    # HTTP client .get("/path?" + params) — string concat where
+                    # the leftmost literal looks like a URL path or absolute URL.
+                    if len(call_args) >= 1 and isinstance(call_args[0], _ast.BinOp):
+                        left = call_args[0].left
+                        while isinstance(left, _ast.BinOp):
+                            left = left.left
+                        if (
+                            isinstance(left, _ast.Constant)
+                            and isinstance(left.value, str)
+                            and (
+                                left.value.startswith("/")
+                                or "://" in left.value
+                            )
+                        ):
+                            return
                     # Known HTTP client receiver names: requests.get(), session.get(),
                     # self.client.get() (Django test client), async_client.get(), etc.
                     _HTTP_CLIENTS = frozenset(

test_checker.py

@@ -669,6 +669,30 @@ def test_it(self):
     assert not v, "self.client.get() (Django test client) must not be flagged as optional"
 
 
+def test_tornado_test_client_get_string_concat_not_flagged(tmp_path):
+    # Corpus: mher/flower — r = self.get('/api/tasks?' + '&'.join(...))
+    # Tornado AsyncHTTPTestCase.get() returns HTTPResponse, never None.
+    # String-concat URL: leftmost literal starts with '/'.
+    _write_src(
+        tmp_path,
+        "test_tasks.py",
+        """
+        import json
+
+        class TaskTest:
+            def test_list(self):
+                params = dict(limit=4, offset=0)
+                r = self.get('/api/tasks?' + '&'.join(
+                    '%s=%s' % x for x in params.items()))
+                table = json.loads(r.body.decode('utf-8'))
+                self.assertEqual(200, r.code)
+        """,
+    )
+    violations = check_codebase(tmp_path)
+    v = [v for v in violations if v.context == "optional_dereference"]
+    assert not v, "self.get('/path?' + params) Tornado test client must not be flagged as optional"
+
+
 def test_ternary_guard_not_flagged(tmp_path):
     # Corpus: paperless-ngx/suitenumerique — request.user if request else None
     # When `request` is tested as the ternary condition, access in the body is safe.