[sampokuokkanen]

Rails main (8.2) logs request completion through the structured event reporter. ActionController::LogSubscriber#request_completed now gets a frozen event payload built from the instrumentation payload, and passes it to log_process_action. Devise's override writes payload[:status] ||= 401 into it, so every request halted by Warden raises:

FrozenError: can't modify frozen Hash: {controller: "ProfilesController", action: "show", db_runtime: 0.0, ...}
  devise/controllers/helpers.rb:84:in 'log_process_action'
  action_controller/log_subscriber.rb:25:in 'block in ActionController::LogSubscriber#request_completed'

The event reporter rescues it and reports it as a handled error, and the "Completed" line is never logged.

Fix

The status belongs in the instrumentation payload, not the log payload. This sets it in append_info_to_payload, which runs in the ensure of process_action while that payload is still open. Every subscriber then sees it: the log line, structured events, and APM tools.

This was tried in #4375 and reverted in #4804, because append_info_to_payload could not tell an exception from a Warden throw. That no longer applies. Since Rails 7.0, the lowest version Devise supports, process_action sets the status in its rescue before the ensure runs. A completed action and a raised exception both have a status by then, so a missing one means Warden threw. That is the case #4788 was about, and it is tested here.

Tests

New tests in AuthenticationInstrumentationTest:

• a request Warden halts is instrumented as 401, and logged as "Completed 401 Unauthorized";
• a raised ActiveRecord::RecordNotFound keeps 404 (the Unexpected 401 Unauthorized response status when action is public #4788 regression);
• a signed-in request keeps 200.

The logging test fails on Rails main without this change, and passes with it on both Rails 8.1 and main. The full suite passes on the default Gemfile and on gemfiles/Gemfile-rails-main.