Most PHP projects hardcode their ID generation strategy. Calls to Uuid::uuid4() are scattered across handlers, entities, and tests. When you need to switch to UUID v7 for chronological sorting or ULID for shorter URLs, you end up modifying dozens of files - and hoping you found them all.
A controller reaches into middleware to run business logic. It looks convenient. The middleware has the session, the user, the request body, everything you need. So why bounce through a handler when you can just validate the cart right there? Because the moment you do, your business rule only runs inside an HTTP pipeline, and you just lost the ability to invoke it from anywhere else.
Mocking a repository in tests does not verify your query; it only verifies that the method was called. Run a real database instead and the test suite slows to a crawl, so you run it less often. Either way, your filter logic ends up duplicated: once in the production code that hits the database, once in the mocks that bypass it. The two drift apart silently until a bug ships to production.
Open a typical PHP project. You see Controllers/, Services/, Repositories/, Entities/. You know it uses Symfony or Laravel. You don't know if it manages a library, processes invoices, or tracks shipments. The structure tells you about the framework, not the business.
You have 100% code coverage. Every line is executed. The CI badge is green. Then you refactor a condition from > to >=, and not a single test fails. Your tests ran the code, but they didn't verify it.