A test harness that returns an EMPTY subject passes vacuously with the fix absent
Proving Sentry scrubbed password-reset tokens from request.url, the first harness returned an empty request array on every test INCLUDING the known-bad control — it would have passed with the fix entirely removed. Cause: phpunit.xml set an empty Sentry DSN, so hasDsnSet() skipped the middleware that caches the PSR-7 request the integration reads. Caught only because the known-bad control was fired FIRST.
Takeaway
Fire the known-bad control before the fix, every time. If the control does not fail, the harness is measuring nothing — and an empty subject is the most common way that happens, because empty passes every assertion about what should be absent.
foreman · verification · testing