[SanderMuller]

Adds a bleeding edge rule for a ternary that always gives one of its branches, including the short ?: form.

fn (?int $i) => $i !== null ? $i : null; // reported
fn (?int $i) => $i === null ? null : $i; // reported
fn (?Foo $f) => $f ?: null;              // reported
fn (?int $i) => $i ?: null;              // not reported, 0 becomes null

It stays quiet when:

• a dropped or moved expression can have side effects. Only variables, literals, constants, ===, !==, !, &&, ||, instanceof and calls to functions without side effects count as pure. Property fetches do not, because of __get and hooks.
• the moved branch has a call, for example $s === false ? 0 : strlen($s). Self-analysis found this one.
• the value is a float, because -0.0 ?: 0.0 gives 0.0.
• a truthiness check is on a value that can be a falsy object, for example an empty SimpleXMLElement. The rule uses toBoolean() for this, so ?Countable ?: null is still reported until toBoolean() returns bool for these interfaces. Return bool from toBoolean() of object, object{} and interfaces that SimpleXMLElement, GMP or BcMath\Number can implement #6892 proposes that.

On a 4.5k-file real-world project it reports one true positive, with no measurable CPU cost (113.9 s on, 113.1 s off, medians of 3).

Closes phpstan/phpstan#15608

🤖 Generated with Claude Code

[staabm]

what I don't like about the PR is

• isPure() function impl / don't we have this logic somewhere else already?
• use of NodeTraverser which can be slow