Replay the recorded fixpoint pass instead of repeating the final loop walk

[ondrejmirtes]

Second extraction chunk from the single-pass analyser branch (follow-up to #6248).

Loop convergence walks the body repeatedly until the entry scope reaches a fixpoint, then walks it once more with the real node callback. When the final walk's entry scope equals the last pass's entry, that final walk reproduces the pass exactly — walking is deterministic in the entry scope. This PR records the last pass's (node, scope) emissions and its expression-result storage, and when the equality holds, replays the recording through the real callback instead of walking again.

• RecordingNodeCallback records raw walk scopes — recording pays no callback-scope construction and no storage binding (short-circuited in callNodeCallback); pairs are wrapped via toNodeCallbackScope() only at replay time.
• Replay sites: while (cond + body), do-while (body only — its condition walks stay real), non-unrolled foreach, and closure by-ref convergence.
• isReplayableConvergenceBody() excludes bodies with context-sensitive constructs (nested loops, labels, class-likes) where deep vs top-level analysis differs.
• ExpressionResultStorage::mergeResults() adopts the recorded pass's stored results into the surrounding storage (PHP twin + turbo mirror, smoke-covered).

Benchmarks (user CPU, 3+3 interleaved legs, toggled within one checkout):

corpus	before	after	Δ
self-analysis (--debug src)	77.99s	75.63s	−3.0%
WordPress core (e2e corpus, level 0)	173.47s	167.97s	−3.2%

Analysis output is unchanged (full test suite; turbo on/off self-analysis output byte-identical).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GnwgpaeUXRkgSDyg95tfK8

[ondrejmirtes]

Some examples of what this PR skips and where it changes nothing.

The shape of the optimization

A top-level loop has always been analysed as N convergence passes (silent, NoopNodeCallback — no rules fire) followed by one more full walk with the real node callback so that rules and collectors see the body under the settled scope. That last walk re-runs all type inference over the body — method call resolution, narrowing, scope threading — purely to re-produce scopes that are state-equal to what the last silent pass already computed.

This PR records the last pass's (node, scope) emissions and, when the final walk's entry scope equals() the recorded pass's entry, replays the recording through the real callback instead of walking again. Rules fire on the same nodes with state-equal scopes; one full inference walk of the loop body disappears.

Where it fires

$total = 0;
$names = [];
foreach ($items as $item) {
    if ($item->isActive()) {
        $total += $item->getPrice();
    }
    $names[] = $item->getName();
}

• pass 1 (silent): entry has $total = 0, $names = array{}; body walked, exit types widen.
• pass 2 (silent): entry has the merged/generalized types (int, list<string>); body walked; exit entry-scope equals pass 2's entry → fixpoint.
• final: previously a third full inference walk of the body with rules attached. Now: the final entry scope equals pass 2's entry, so pass 2's recording is replayed — every MethodCall resolution, += arithmetic, offset-assign inference in the body happened twice instead of three times, and the rules observed exactly what they would have.

The same applies to while (condition and body are replayed):

while ($row = $stmt->fetch()) {
    $data[] = process($row);
}

and to do-while bodies (its trailing condition walks stay real, they run on the exit scope, not the entry). Closure by-ref-use convergence uses the same mechanism:

$sum = 0;
$fn = function () use (&$sum) { $sum += $this->next(); };

The saving scales with body size × rule count: big loop bodies over rich APIs (WordPress's wp-includes loops, PHPStan's own NodeScopeResolver loops) are precisely where the redundant final walk was most expensive — hence the −3% user CPU on both corpora.

Where it deliberately does what it always did

Nested loops in the body (also labels and class-likes) — the body is not replayable:

foreach ($matrix as $row) {
    foreach ($row as $cell) {   // ← outer body excluded
        $out[] = $cell * 2;
    }
}

A nested loop is analysed differently deep vs. top-level (during the outer loop's silent passes the inner loop is walked once at deep context; in the real final walk it runs its own convergence). The recorded emissions would not match what the final walk produces, so isReplayableConvergenceBody() refuses and the final walk runs as before. Closures inside the body are fine — their statements aren't traversed inline.

Unrolled foreach over a known constant array — PHPStan analyses each iteration exactly, there is no fixpoint pass to reuse:

foreach (['a', 'b', 'c'] as $letter) { ... }

Loops that never converge cleanly — the entry-scope equality gate fails and the real final walk runs:

$x = 0;
while (cond()) {
    $x = [$x];   // ever-deepening type, generalization keeps shifting the entry
}

for loops — not a replay site at all (inferForLoopExpressions needs the real final walk).

Why the replay is safe

Walking is deterministic in the entry scope. The replay only fires when the final walk's entry scope is equals()-identical to the recorded pass's entry, so the recorded scopes are state-equal to what the repeated walk would emit — no rule, collector, or extension can observe the difference. Backing that up empirically: analysis output is byte-identical on full self-analysis and on WordPress core, with the whole test suite green.