Add comment explaining why Pass 1 does not need No-certainty check

Address review feedback: Pass 1 uses exact matching which cannot produce
the asymmetry that causes the bug in Pass 2. The supertype match in
Pass 2 is inherently asymmetric - a broader condition type (the
"undefined" branch) is more likely to be a supertype of a narrowed type
than a narrower condition type (the "defined" branch). Exact matching
has no such asymmetry.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/MutatingScope.php

@@ -3237,6 +3237,14 @@ public function filterBySpecifiedTypes(SpecifiedTypes $specifiedTypes): self
 				}
 
 				// Pass 2: Supertype match. Only runs when Pass 1 found no exact match for this expression.
+				// Skip No-certainty holders here because supertype matching is asymmetric:
+				// a broader condition type (the "undefined" branch) is more likely to match
+				// as a supertype of a narrowed specified type than a narrower condition type
+				// (the "defined" branch), causing conditionally-defined variables to be
+				// incorrectly resolved as never defined.
+				// Pass 1 does not need this check because exact matching cannot produce
+				// this asymmetry - if the specified type exactly equals the No branch's
+				// condition, the scope genuinely corresponds to the "undefined" state.
 				foreach ($conditionalExpressions as $conditionalExpression) {
 					if ($conditionalExpression->getTypeHolder()->getCertainty()->no()) {
 						continue;