Inline the variadic element type into the two parameter-out checks

The helper class held three lines of logic. Both checks now unpack the
element type themselves, and the reason for it moves to the docblock of
ParameterOutTypeCheck.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: 2 people

src/Rules/TooWideTypehints/TooWideParameterOutTypeCheck.php

@@ -9,7 +9,6 @@
 use PHPStan\Node\ReturnStatement;
 use PHPStan\Reflection\ExtendedParameterReflection;
 use PHPStan\Rules\IdentifierRuleError;
-use PHPStan\Rules\VariadicByRefParameterOutType;
 use function lcfirst;
 use function sprintf;
 
@@ -95,11 +94,12 @@ private function processSingleParameter(
 		$variableExpr = new Variable($parameter->getName());
 		$variableType = $scope->getType($variableExpr);
 
+		// a variadic out type describes one argument - see ParameterOutTypeCheck
 		if ($parameter->isVariadic()) {
-			$variableType = VariadicByRefParameterOutType::elementType($variableType);
-			if ($variableType === null) {
+			if (!$variableType->isArray()->yes()) {
 				return [];
 			}
+			$variableType = $variableType->getIterableValueType();
 		}
 
 		return $this->tooWideTypeCheck->checkParameterOutType(

src/Rules/Variables/ParameterOutTypeCheck.php

@@ -11,7 +11,6 @@
 use PHPStan\Rules\IdentifierRuleError;
 use PHPStan\Rules\RuleErrorBuilder;
 use PHPStan\Rules\RuleLevelHelper;
-use PHPStan\Rules\VariadicByRefParameterOutType;
 use PHPStan\Type\ErrorType;
 use PHPStan\Type\Type;
 use PHPStan\Type\VerbosityLevel;
@@ -23,8 +22,11 @@
  * The promise is either an explicit `@param-out` or, in its absence, the parameter's own type.
  * Which one it is only shows in the error message, so callers report it via $isParamOutType.
  *
- * For a variadic parameter the promise describes a single argument while the variable holds the
- * packed array of them, so the two sides are reconciled through VariadicByRefParameterOutType.
+ * For a variadic parameter the promise describes a single argument, as NodeScopeResolver applies it at
+ * the call site, while the variable holds the packed array of them, so its element type is compared.
+ * Once the variable no longer holds an array, rebinding it has discarded the references and nothing
+ * reaches a caller. A write through an offset, `$refs[0] = ...`, does reach the caller and leaves an
+ * array, so an array is always compared.
  *
  * @internal
  */
@@ -65,10 +67,10 @@ public function check(
 
 		$assignedExprType = $scope->getType($checkedExpr);
 		if ($isVariadic) {
-			$assignedExprType = VariadicByRefParameterOutType::elementType($assignedExprType);
-			if ($assignedExprType === null) {
+			if (!$assignedExprType->isArray()->yes()) {
 				return [];
 			}
+			$assignedExprType = $assignedExprType->getIterableValueType();
 		}
 
 		if ($outType->isSuperTypeOf($assignedExprType)->yes()) {