Add comment explaining Variable exception and add variable-equivalent test cases

Address review comment by VincentLanglet asking why the guard is restricted
to non-Variable expressions.

The Variable exception is needed because:
- Non-Variable expressions (array dim fetches, property fetches) are always
  queryable; absence from a branch means "not narrowed", not "doesn't exist"
- Variables are different: absence means genuinely "not defined", and
  conditional expressions for newly-defined variables are essential for
  variable certainty tracking (e.g. bug-14411-regression where $order must
  be recognised as always-defined when two conditions cover all cases)
- Pre-defined variables (present in both branches) are already handled by
  the existing check that tests array_key_exists($exprString, $theirExpressionTypes)

Added variable-equivalent test cases to both the rule test data and NSRT
test to demonstrate that pre-defined variables work correctly with the
existing guard-overlap check.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/MutatingScope.php

@@ -3649,6 +3649,18 @@ private function createConditionalExpressions(
 				) {
 					continue;
 				}
+				// Skip non-Variable expressions absent from the other branch when
+				// the guard overlaps with the other branch's guard type.
+				// Non-Variable expressions (array dim fetches, property fetches)
+				// are always queryable, so absence from a branch means "not
+				// narrowed", not "doesn't exist". Creating a conditional
+				// expression would incorrectly narrow the type when the guard
+				// fires from the branch that never referenced the expression.
+				// Variables are exempt: their absence means genuinely "not
+				// defined", and conditional expressions for newly-defined
+				// variables are needed for variable certainty tracking (e.g.
+				// bug-14411-regression). Pre-defined variables (present in both
+				// branches) are handled by the check above.
 				if (
 					!array_key_exists($exprString, $theirExpressionTypes)
 					&& !$holder->getExpr() instanceof Variable

tests/PHPStan/Analyser/nsrt/bug-14469.php

@@ -17,3 +17,19 @@ function t(array $R, bool $var1, object $user): void {
 		assertType('mixed', $R['aa']);
 	}
 }
+
+/** Variable equivalent: pre-defined variable stays mixed inside if ($aa) */
+function variableEquivalent(mixed $input, bool $var1, object $user): void {
+	$aa = null;
+	$bb = $input;
+
+	if ($var1) {
+		$aa = $user->id === 10 ? 2 : null;
+	} elseif ($bb) {
+		$aa = $bb;
+	}
+
+	if ($aa) {
+		assertType('mixed', $bb);
+	}
+}

tests/PHPStan/Rules/Comparison/data/bug-14469.php

@@ -71,3 +71,27 @@ function multipleElseif(array $R, bool $var1, bool $var2, object $user): void {
         }
     }
 }
+
+/**
+ * Variable equivalent: pre-defined variable used in elseif condition.
+ * Same pattern as the array dim fetch case but $bb is a Variable defined
+ * before the if/elseif, so it's present in both branches' expression types.
+ * The existing guard-overlap check (lines that test array_key_exists($exprString,
+ * $theirExpressionTypes)) handles this case correctly.
+ */
+function variableEquivalent(bool $var1, object $user, mixed $input): void {
+	$aa = null;
+	$bb = $input;
+
+	if ($var1) {
+		$aa = $user->id === 10 ? 2 : null;
+	} elseif ($bb) {
+		$aa = $bb;
+	}
+
+	if ($aa) {
+		if (!$bb) {
+			return;
+		}
+	}
+}