>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3619757. --> Reported by: [mably](https://www.drupal.org/user/3375160) Related to !55 >>> <p>kessai runs phpstan at level 0. Orchestra, yoyaku, pdv and domain all run level 3, each shipping a <code class="language-php">phpstan.neon</code> with an <code class="language-php">entity_mapping.neon</code> beside it. kessai ships neither, so the Drupal Association's default asset applies and the gate checks almost nothing.</p> <h3>What level 0 let through, on this module, last week</h3> <p>#3619740 gave <code class="language-php">runUnderLock()</code> a <code class="language-php">@template</code> so its three callers would get their own return type back instead of narrowing by hand. The template was unbounded, so it was not a subtype of the native return type and phpstan discarded it: <code class="language-php">capture()</code> declared <code class="language-php">PaymentInterface</code> and actually returned <code class="language-php">RecordInterface|null</code>. The narrowing that had made it safe was removed in the same change.</p> <p>That passed phpcs, passed phpstan, passed both phpunit lanes, and merged. At level 3 phpstan says it in one line, and says why: <em>PHPDoc tag @return with type T is not subtype of native type</em>. This issue is that argument, not a lint preference.</p> <h3>Making level 3 affordable</h3> <p><code class="language-php">entity_mapping.neon</code> names the concrete class behind each of the four kessai entity type ids. Without it every storage load is an <code class="language-php">EntityInterface</code> and every kessai call on one is reported.</p> <p>No <code class="language-php">ignoreErrors</code>. The siblings each carry one for "Unsafe usage of new static", which this module also does eight times, but that check does not fire at level 3 and an ignore pattern matching nothing is itself an error.</p> <h3>The 21 findings, all fixed rather than suppressed</h3> <ul> <li><strong>The discarded template.</strong> Bounding it as <code class="language-php">@template T of RecordInterface|null</code> makes it a subtype of the native type, so it resolves. That alone cleared five findings: the three wrong return types and both complaints about the tag itself. The callers keep the clean API and still need no narrowing.</li> <li><strong><code class="language-php">getMovements()</code> answered <code class="language-php">MovementInterface[]</code></strong> while its three readers each declare something narrower. It now takes the interface it is asked for as a <code class="language-php">class-string</code> and answers <code class="language-php">T[]</code>, which also tightens the filter: a storage handing back the wrong kind of row is dropped rather than returned.</li> <li><strong>Eleven test calls to capability methods on a <code class="language-php">PaymentGatewayInterface</code></strong>. The three gateway builders in WorldlineGatewayTest declared no return type, so <code class="language-php">capture()</code>, <code class="language-php">cancel()</code> and <code class="language-php">chargeToken()</code> were undefined on what they returned. They now answer <code class="language-php">WorldlineGateway</code> and assert it, which is a better test than the one that could not say what it built.</li> <li><strong>A stub helper narrowed its own return</strong> to the interface, so callers could no longer configure it. It answers the stub intersection instead.</li> <li><strong>A logger read without its guard.</strong> The same file already does this correctly 160 lines earlier: fetch, assert it is the BufferingLogger the test registered, then read. One call site had skipped the assertion.</li> <li><strong>The audit-trail recorder could not be typed.</strong> phpstan's service map types <code class="language-php">audit_trail</code> as the real class, so no assertion in the test could narrow it to the recorder standing in for it. The test constructs the recorder, hands it over with <code class="language-php">$this-&gt;container-&gt;set('audit_trail', $this-&gt;recorder)</code> after <code class="language-php">parent::setUp()</code>, and keeps it in a typed property, which is what 213 core test files and 135 contrib ones do. The constraint is narrower than it looks: it applies only when overriding a service id phpstan's map already knows.</li> </ul> <h3>Result</h3> <p>Level 3 is clean across production and tests with the shipped config, and nothing is ignored. 6 files, 82 insertions, 40 deletions. No behavior change.</p> <p>AI-Generated: Yes (Claude Code was used to find the level gap, fix the findings, draft this summary and make the changes on the merge request. I reviewed and ran the work myself before posting it.)</p>