## Problem `audit_trail_user_auth` attaches three form handlers as **bound object callables**: ```php $form['#validate'][] = [$this, 'logFailedLogin']; $form['#submit'][] = [$this, 'logPasswordResetRequest']; array_unshift($form['#validate'], [$this, 'logPasswordResetFloodBlock']); ``` `$this` is the hook service `Hook\AuditTrailUserAuthHooks`, and that class holds a closure: ```php private readonly \Closure $auditTrail; ``` The closure is deliberate and right: it is what keeps a login page from building the whole audit graph to read one config flag. What is not right is putting the object holding it inside the form array, because Drupal serializes that array. ## Where it is serialized `FormBuilder::rebuildForm()` calls `$form_state->setCached()` for every POST form it rebuilds, and the form cache stores the form structure through the key-value expirable store, which serializes it. A form is rebuilt whenever it is submitted, produced no errors and executed no submit callback: an `#ajax` element on the login form is the ordinary way to get there, and a captcha, a second-factor widget or any module calling `$form_state->setRebuild()` will do it too. The result is a fatal on the login page: ``` Exception: Serialization of 'Closure' is not allowed ``` Reproduced against 1.x by building the real forms and serializing them, which is exactly what the form cache does: ```php $form = \Drupal::formBuilder()->getForm(UserLoginForm::class); serialize($form); // Exception: Serialization of 'Closure' is not allowed $form = \Drupal::formBuilder()->getForm(UserPasswordForm::class); serialize($form); // same ``` Both forms are affected: the login form through `logFailedLogin`, `/user/password` through the other two. ## Why the suite does not see it `AuditTrailUserAuthHooksTest` says so in its own docblock: "Form-driven events are tested by invoking the public callbacks directly with a hand-built `FormState`, not by submitting the real form." The two tests that do build the form read `#validate` and assert the handler is in it, which is the shape that cannot be cached. ## Proposed change Register the handlers as class-string callables, which serialize as two strings, and resolve the hook service inside them: ```php $form['#validate'][] = [self::class, 'validateLoginForm']; ``` ```php public static function validateLoginForm(array &$form, FormStateInterface $form_state): void { \Drupal::service(self::class)->logFailedLogin($form, $form_state); } ``` The service id is the class name, which `audit_trail_user_auth.services.yml` already declares, so the static entry point costs a container lookup on a submission that was going to build this class anyway. The three public handlers keep their names, their signatures and their tests. The closure stays as it is. It is the reason the bridge is cheap, and nothing about it needed changing: what changes is that the object holding it no longer travels in the form array. ## Test coverage `AuditTrailUserAuthHooksTest` gains a test that builds both real forms and serializes them, the way the form cache does. It fails on 1.x with the exception above and passes with the change. The two existing shape assertions move to the new callable. AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the fix and its test on the merge request. The fatal was reproduced against unpatched 1.x in a kernel test before the fix was written, and the test was confirmed to fail there and pass with the change.)