P0: Correct effect confidence, resource identity, and preset coverage

[shaggitza]

Priority

P0 — prevent HIGH-confidence non-effects and incorrect resource coupling.

Problem

Effect observation, resource identity, argument flow, and bundled presets contain proven precision and recall gaps.

Evidence:

• src/fastapi_endpoint_detector/analyzer/effect_analyzer.py:139-228,480-570
• src/fastapi_endpoint_detector/analyzer/resource_coupling.py:145-232
• src/fastapi_endpoint_detector/analyzer/mypy_analyzer.py:2444-2514,2642-2678
• src/fastapi_endpoint_detector/presets/effects_object_storage_v1.yaml:10-29
• bundled SQLAlchemy, HTTP, filesystem, Redis, and MongoDB effect presets

Reproduced failures:

• Mutation inside a never-called nested function was promoted to established HIGH returned mutation.
• Reassignment to an unrelated object did not kill returned-alias evidence.
• S3 calls used only Key: different buckets with the same key received identical exact resource identities and a false coupling edge.
• Literal argument flow through an endpoint helper was lost, preventing an otherwise exact shared-resource edge.

Additional gaps:

• SQLAlchemy misses common execute, Core DML, and sessionmaker begin paths.
• HTTP omits common module-level requests/httpx operations and generic request methods.
• Filesystem misses mode-dependent open and common os/shutil mutations.
• Redis handles only a narrow set and only the first delete key.
• MongoDB/Motor receiver-resource origin is unavailable.

Required design

• Exclude deferred nested scopes and add assignment kills/branch-aware alias joins.
• Restrict .copy() freshness claims to proven built-in containers.
• Support domain-separated composite resource selectors, e.g. (Bucket, Key), with bounded Cartesian expansion; omit identity if any required component is unresolved or exceeds caps.
• Add per-endpoint finite argument propagation without unioning values at shared physical helper calls.
• Add exact-symbol predicates for mode/statement-dependent APIs rather than broad method-name matching.

Acceptance criteria

• Never-called nested mutations and killed aliases cannot become HIGH effects.
• Same key/different bucket does not couple; same bucket/key does.
• Endpoint/value correlation survives bounded helper forwarding without cross-product edges.
• Preset additions include exact-symbol negative controls.
• Real supported dependency versions are compatibility-tested where available.
• Unsupported dynamic resources remain unavailable rather than guessed.

Related: #97, #99.

[shaggitza]

Partial composite-resource tranche merged in PR #302 (165a828). Schema-v4 resource selectors now support ordered, domain-separated bounded composites; typed S3 direct get/put/delete can identify exact (Bucket, Key) pairs and fail closed on missing/oversized components. Full Python 3.10–3.12 CI and independent tranche adjudication passed. #282 remains open for endpoint-local helper correlation, deferred-scope/alias confidence, proven built-in copy freshness, boundary regression expansion, and broader preset evidence.