How PHPStan and Psalm differ in level systems, generic type support, and security analysis — plus the baseline workflow that makes adoption on legacy code survivable.

AI review is good at a specific band of problems and confidently wrong outside it. This is about placing it where it helps and stopping it from generating noise.