Tool
PHPStan
Static analysis: types and dead code before runtime, with levels from “noise” to “strict”.
PHPStan reads the AST; it does not execute the app. That particularity catches impossible calls, wrong array shapes and nulls that unit tests never hit. Levels 0–9 are a dial: raise them as the codebase can take it.
Baselines exist so you can adopt it on a brownfield project without lying. Extensions (Symfony, Doctrine, PHPUnit) understand containers and entities.
A senior treats a red PHPStan in CI like a red test. Psalm is the cousin; picking one and sticking to it matters more than the brand.
