Carry unsealed slot through ConstantArrayType::spliceArray()

`array_splice` removes a slice at an explicit offset and inserts a
replacement at that position. Real unsealed extras live at
positions past the explicit keys, so they're not affected by either
operation; the re-indexing of int keys also leaves a `<int, V>`
unsealed range unchanged.

Pass the source's unsealed tuple into the builder before producing
the result for each replacement variant.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ondrejmirtes

src/Type/Constant/ConstantArrayType.php

@@ -1857,6 +1857,16 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 				);
 			}
 
+			// `array_splice` removes a slice at an explicit offset and
+			// inserts a replacement there. Real unsealed extras live at
+			// positions past the explicit keys, so they're unaffected
+			// by the operation (re-indexing of int keys keeps the
+			// `<int, V>` range intact). Carry the slot through.
+			if ($this->isUnsealed()->yes() && $this->unsealed !== null) {
+				[$unsealedKey, $unsealedValue] = $this->unsealed;
+				$builder->makeUnsealed($unsealedKey, $unsealedValue);
+			}
+
 			$builtType = $builder->getArray();
 			if ($allKeysInteger && !$builtType->isList()->yes()) {
 				$builtType = TypeCombinator::intersect($builtType, new AccessoryArrayListType());

tests/PHPStan/Analyser/nsrt/unsealed-derivations.php

@@ -514,6 +514,23 @@ public function shufflePreservesUnsealedValues(array $arr): void
 
 }
 
+class SpliceArray
+{
+
+	/**
+	 * @param list{int, int, int, ...<float>} $arr
+	 */
+	public function splicePreservesUnsealed(array $arr): void
+	{
+		array_splice($arr, 1, 1);
+		// `array_splice` removes a slice from an explicit position;
+		// the unsealed extras at the tail are unaffected and survive
+		// on the result.
+		assertType('array{int, int, ...<float>}', $arr);
+	}
+
+}
+
 class CountNarrowing
 {