hr_lite 0.58.0 → 0.60.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c02612fcf572f2b42eab074882c2c07b975e9e272b6b94eb58b3a40edb00cdc
-  data.tar.gz: a537c7010fc7e5c5bbfc5e85eaa62d4afb4bc5b04eae953500d64ed5f4d1530e
+  metadata.gz: 051c3d4efb869bb1c40f819e884e245c5d45462c2664a62464c84ec2686b750e
+  data.tar.gz: 263dbc61a8861a69b06b0b6597542e496feac6fd3bb6eb78cadd04a947681f41
 SHA512:
-  metadata.gz: 54ca6bb8b70ce33601c8d163caf80556bdec2c653b0360f4d3ff418b0180a14fe2487292ef83499d989c5b064b919857bb083197789fef628bf42f736544a6c5
-  data.tar.gz: cf2c5930379f973d7a08870b87e3b3c7c28117e4f09921f5465702117c931195203df20292d4532e4b40ce4708479be770627acf7fa5e0a524791c5c81e1db5a
+  metadata.gz: c4b151e5a71926157f4976df9ad3fd55f3b60468c6f0d10f7877d2fc9c2363e1ebe7d5d9a86961660848744a840e9b96f597cc1207d86168f20dd7410096ba60
+  data.tar.gz: c457f267dc96c0b89278bf870f431174204cb258879cb68e90b152ef37d224354068732b2b118678e6b1329cf24351c5a26dca8672e120549d83c3b906e622a1

data/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.60.0] - 2026-10-21
+
+Background failures reach a person. No migrations.
+
+- **"Failed in the background" card on the HR overview.** A failed event email, leadership email or bell, host notify hook, WFH or work-location notice, audit row, onboarding checklist or calendar read used to write only a log line. Each is now recorded once in the audit trail (`failure.<event>`, with the error class, a 200-character message and the affected user) through `HrLite.record_failure`, and the ten most recent show on the overview to anyone who can open the audit trail. Money-tier subjects stay superadmin-only, as on the audit trail.
+
+## [0.59.0] - 2026-10-21
+
+No silent failures where a person is waiting on the answer. No migrations. Audit: `docs/audits/silent_failures.md`.
+
+- **Decisions say why they failed.** 24 admin and employee actions answered every failed save with a stock line such as "Only pending requests can be decided." They now show the record's own reason, and keep the stock line for the genuine not-pending case.
+- **Offboarding no longer claims access was revoked when it was not.** A failing `offboard_user` hook (offboard, or accepting a resignation on its last day) or `on_designation_change` hook now shows an alert with the cause and what to do by hand.
+- **Search, live tax, lead search and @mentions say when they could not load.** They no longer look like "no results" or show a stale figure. An unreadable ID-card photo (HEIC on desktop) now says so.
+
 ## [0.58.0] - 2026-10-21
 
 Leave and birthdays for the whole team, Keka-style. No migrations. Hosts schedule `HrLite::TeamNoticesJob` daily at 10am.

data/app/assets/javascripts/hr_lite/crm_picker.js

@@ -12,12 +12,14 @@
       if (q.length < 2) return;
       timer = setTimeout(function () {
         fetch(box.dataset.hrlCrm + "?q=" + encodeURIComponent(q), { headers: { Accept: "application/json" }, credentials: "same-origin" })
-          .then(function (r) { return r.ok ? r.json() : []; })
+          .then(function (r) { if (!r.ok) throw r; return r.json(); })
           .then(function (leads) {
             select.length = 1;
+            select.options[0].text = "No lead";
             leads.forEach(function (lead) { select.add(new Option(lead.label, lead.id)); });
             if (leads.length) select.selectedIndex = 1;
-          });
+          })
+          .catch(function () { select.length = 1; select.options[0].text = "Lead search failed. Type again to retry."; });
       }, 250);
     });
   }

data/app/assets/javascripts/hr_lite/mention.js

@@ -59,9 +59,9 @@
 
     var lookup = debounce(function (query) {
       fetch(url + "?q=" + encodeURIComponent(query), { headers: { Accept: "application/json" } })
-        .then(function (r) { return r.ok ? r.json() : []; })
+        .then(function (r) { if (!r.ok) throw r; return r.json(); })
         .then(renderResults)
-        .catch(close);
+        .catch(function () { close(); menu.textContent = "Could not load names. Keep typing to retry."; menu.hidden = false; });
     }, 200);
 
     textarea.addEventListener("input", function () {

data/app/assets/javascripts/hr_lite/photo_crop.js

@@ -30,6 +30,10 @@
       zoom.closest("[data-hrl-photo-adjust]").hidden = false;
       place();
     };
+    img.onerror = function () {
+      input.value = "";
+      alert("Could not read that picture. Choose a JPG or PNG photo.");
+    };
     img.src = URL.createObjectURL(file);
   });
 

data/app/assets/javascripts/hr_lite/search.js

@@ -31,8 +31,9 @@
     clearTimeout(timer);
     timer = setTimeout(function () {
       fetch(form.action + "?frame=1&q=" + encodeURIComponent(input.value), { credentials: "same-origin", cache: "no-store" })
-        .then(function (response) { return response.ok ? response.text() : ""; })
-        .then(function (html) { out.innerHTML = html; });
+        .then(function (response) { if (!response.ok) throw response; return response.text(); })
+        .then(function (html) { out.innerHTML = html; })
+        .catch(function () { out.innerHTML = '<p class="hrl-errors" role="alert">Search failed. Check your connection and try again.</p>'; });
     }, 180);
   });
 

data/app/assets/javascripts/hr_lite/tax_preview.js

@@ -13,8 +13,9 @@
     Array.from(data.keys()).forEach(function (key) { if (/\[proofs\]/.test(key)) data.delete(key); });
     data.delete("_method");
     fetch(form.dataset.hrlTaxPreview, { method: "POST", body: data, credentials: "same-origin", headers: { "Accept": "text/html" } })
-      .then(function (response) { return response.ok ? response.text() : null; })
-      .then(function (html) { if (html) panel.innerHTML = html; });
+      .then(function (response) { if (!response.ok) throw response; return response.text(); })
+      .then(function (html) { panel.innerHTML = html; })
+      .catch(function () { panel.innerHTML = '<p class="hrl-errors" role="alert">Could not work out the tax just now. Check your connection; Save still works.</p>'; });
   }
   var rupees = new Intl.NumberFormat("en-IN", { style: "currency", currency: "INR", maximumFractionDigits: 0 });
   // The limit bar and "₹X of the ₹Y limit counts" follow the amount as typed.

data/app/controllers/hr_lite/admin/assets_controller.rb

@@ -28,8 +28,8 @@ module HrLite
         user = HrLite.user_klass.find(params[:user_id])
         asset.assign_to!(user, actor: hr_current_user)
         redirect_to admin_assets_path, notice: "#{asset.name} given to #{HrLite.display_name(user)}."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_assets_path, alert: "#{asset.name} is already with somebody."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_assets_path, alert: reason_for(e, "#{asset.name} is already with somebody.")
       end
 
       def take_back
@@ -37,8 +37,8 @@ module HrLite
         asset.return!(actor: hr_current_user, condition: params[:condition_note],
                       status: params[:status].presence_in(Asset::STATUSES) || "available")
         redirect_to admin_assets_path, notice: "#{asset.name} taken back."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_assets_path, alert: "#{asset.name} is not with anybody."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_assets_path, alert: reason_for(e, "#{asset.name} is not with anybody.")
       end
 
       private

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -87,7 +87,7 @@ module HrLite
                                notice: "Nothing to remove for that day."
           end
 
-          record.destroy
+          record.destroy!
           # Its late penalties go too, so checking in again is not charged twice.
           AttendancePenalty.active.where(attendance_record_id: record.id)
                            .find_each { |p| p.update!(removed_at: Time.current, removed_by_id: hr_current_user.id, removal_reason: note) }

data/app/controllers/hr_lite/admin/ca_reviews_controller.rb

@@ -51,8 +51,8 @@ module HrLite
       def resolve
         CaReview.find(params[:id]).resolve!(actor: hr_current_user, note: params[:note])
         redirect_back_to_list notice: "Marked resolved."
-      rescue ActiveRecord::RecordInvalid
-        redirect_back_to_list alert: "Only a flagged item can be resolved."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_back_to_list alert: reason_for(e, "Only a flagged item can be resolved.")
       end
 
       private

data/app/controllers/hr_lite/admin/comp_off_requests_controller.rb

@@ -18,8 +18,8 @@ module HrLite
                     notice: "Approved — #{request.credit_days.to_f} day credited."
       rescue CompOffRequest::MissingCompOffType, CompOffRequest::StaleOffDay => e
         redirect_to admin_comp_off_request_path(request), alert: e.message
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_comp_off_request_path(request), alert: "Only pending requests can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_comp_off_request_path(request), alert: reason_for(e, "Only pending requests can be decided.")
       end
 
       def reject
@@ -31,8 +31,8 @@ module HrLite
 
         request.reject!(actor: hr_current_user, note: note)
         redirect_to admin_comp_off_requests_path, notice: "Request rejected."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_comp_off_request_path(request), alert: "Only pending requests can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_comp_off_request_path(request), alert: reason_for(e, "Only pending requests can be decided.")
       end
 
       private

data/app/controllers/hr_lite/admin/designation_changes_controller.rb

@@ -12,7 +12,10 @@ module HrLite
         @change = DesignationChange.new(change_params.merge(
           user_id: @profile.user_id, created_by_id: hr_current_user.id
         ))
-        if @change.save
+        if @change.save && @change.hook_error
+          redirect_to admin_employee_path(@profile),
+                      alert: "Role change recorded, but it could not be applied to their login (#{@change.hook_error}) — update their access by hand."
+        elsif @change.persisted?
           redirect_to admin_employee_path(@profile), notice: "Role change recorded."
         else
           render :new, status: :unprocessable_entity

data/app/controllers/hr_lite/admin/employees_controller.rb

@@ -101,13 +101,15 @@ module HrLite
         # since an unreturned laptop and un-revoked access both outlive the
         # employment.
         ChecklistItem.open_for!(@profile.user, kind: "offboarding", anchor_date: exit_date)
+        done = "Offboarded — last day #{exit_date.strftime('%d %b %Y')}"
         begin
           HrLite.config.offboard_user.call(@profile.user)
         rescue => e
           Rails.logger.error("[hr_lite] offboard_user failed: #{e.class}: #{e.message}")
+          return redirect_to admin_employee_path(@profile),
+                             alert: "#{done}, but access was NOT revoked (#{e.message.truncate(120)}) — revoke the login by hand."
         end
-        redirect_to admin_employee_path(@profile),
-                    notice: "Offboarded — last day #{exit_date.strftime('%d %b %Y')}, access revoked."
+        redirect_to admin_employee_path(@profile), notice: "#{done}, access revoked."
       rescue ActiveRecord::RecordInvalid => e
         redirect_to admin_employee_path(@profile), alert: e.record.errors.full_messages.to_sentence
       end

data/app/controllers/hr_lite/admin/expenses_controller.rb

@@ -15,8 +15,8 @@ module HrLite
         expense = decidable.find(params[:id])
         expense.approve!(actor: hr_current_user, note: params[:decision_note].presence)
         redirect_to admin_expenses_path, notice: "Claim approved."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_expenses_path, alert: "Only a submitted claim can be approved."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_expenses_path, alert: reason_for(e, "Only a submitted claim can be approved.")
       end
 
       def reject
@@ -26,8 +26,8 @@ module HrLite
 
         expense.reject!(actor: hr_current_user, note: note)
         redirect_to admin_expenses_path, notice: "Claim rejected."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_expenses_path, alert: "Only a submitted claim can be rejected."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_expenses_path, alert: reason_for(e, "Only a submitted claim can be rejected.")
       end
 
       def reimburse
@@ -35,8 +35,8 @@ module HrLite
         month = parse_month_param(params[:period_month])
         expense.reimburse!(actor: hr_current_user, period_month: month)
         redirect_to admin_expenses_path, notice: "Will be paid with #{month.strftime('%B %Y')} payroll."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_expenses_path, alert: "Only an approved claim can go on payroll, and only on a month not yet paid."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_expenses_path, alert: reason_for(e, "Only an approved claim can go on payroll, and only on a month not yet paid.")
       end
 
       # The receipt the employee had to upload, for the person deciding; same rules as a document download.

data/app/controllers/hr_lite/admin/hr_requests_controller.rb

@@ -20,8 +20,8 @@ module HrLite
         assignee = HrLite.user_klass.find(params[:assignee_id])
         request.assign!(actor: hr_current_user, assignee: assignee)
         redirect_to admin_hr_request_path(request), notice: "Assigned to #{HrLite.display_name(assignee)}."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_hr_request_path(request), alert: "This request is already settled."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_hr_request_path(request), alert: reason_for(e, "This request is already settled.")
       end
 
       def resolve
@@ -30,8 +30,8 @@ module HrLite
         redirect_to admin_hr_requests_path, notice: "Answered."
       rescue ArgumentError
         redirect_to admin_hr_request_path(request), alert: "Write an answer before resolving."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_hr_request_path(request), alert: "This request is already settled."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_hr_request_path(request), alert: reason_for(e, "This request is already settled.")
       end
 
       private

data/app/controllers/hr_lite/admin/leave_requests_controller.rb

@@ -65,8 +65,8 @@ module HrLite
           redirect_to admin_leave_request_path(request),
                       alert: "Cannot approve — comp-off credit no longer covers this request."
         end
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_leave_request_path(request), alert: "Only pending requests can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_leave_request_path(request), alert: reason_for(e, "Only pending requests can be decided.")
       end
 
       # LeaveRequest#cancellable_by? has always allowed an admin to call off
@@ -96,8 +96,8 @@ module HrLite
 
         request.reject!(actor: hr_current_user, note: note)
         redirect_to admin_leave_requests_path, notice: "Leave rejected."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_leave_request_path(request), alert: "Only pending requests can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_leave_request_path(request), alert: reason_for(e, "Only pending requests can be decided.")
       end
 
       private

data/app/controllers/hr_lite/admin/overview_controller.rb

@@ -6,6 +6,11 @@ module HrLite
       def index
         @query = OverviewQuery.new(user_ids: hr_access.visible_user_ids("leave.view"))
         @kpis = @query.kpis
+        # Emails, bells and audit rows that failed in the background; the audit trail's own gate.
+        return unless hr_can?("profile.manage", scope: :all)
+
+        failures = AuditLog.recent.where("action LIKE ?", "failure.%").includes(:subject).limit(SECTION_CAP)
+        @failures = hr_superadmin? ? failures : failures.outside_money_tier
       end
     end
   end

data/app/controllers/hr_lite/admin/regularization_requests_controller.rb

@@ -18,8 +18,8 @@ module HrLite
       rescue RegularizationRequest::InvalidMerge => e
         redirect_to admin_regularization_request_path(request),
                     alert: "Cannot apply — #{e.message}. Fix the day manually or reject with a note."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_regularization_request_path(request), alert: "Only pending tickets can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_regularization_request_path(request), alert: reason_for(e, "Only pending tickets can be decided.")
       end
 
       def reject
@@ -31,8 +31,8 @@ module HrLite
 
         request.reject!(actor: hr_current_user, note: note)
         redirect_to admin_regularization_requests_path, notice: "Ticket rejected."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_regularization_request_path(request), alert: "Only pending tickets can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_regularization_request_path(request), alert: reason_for(e, "Only pending tickets can be decided.")
       end
 
       private

data/app/controllers/hr_lite/admin/resignations_controller.rb

@@ -17,6 +17,10 @@ module HrLite
             "#{hr_display_name(resignation.user)}, so no exit date was recorded — " \
             "create the profile to clip attendance and payroll."
         end
+        if resignation.access_error
+          return redirect_to admin_employees_path,
+                             alert: "#{notice} But access was NOT revoked (#{resignation.access_error}) — revoke the login by hand."
+        end
         redirect_to admin_employees_path, notice: notice
       rescue ActiveRecord::RecordInvalid => e
         # A rejected exit date used to be reported as "not pending", which was

data/app/controllers/hr_lite/admin/tax_declarations_controller.rb

@@ -62,8 +62,8 @@ module HrLite
           declaration.verify!(actor: hr_current_user, note: "Proof accepted")
         end
         redirect_to admin_tax_declarations_path, notice: "Accepted and verified — payroll uses these amounts now."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_tax_declaration_path(declaration), alert: "Only a submitted declaration can be accepted."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_tax_declaration_path(declaration), alert: reason_for(e, "Only a submitted declaration can be accepted.")
       end
 
       def update

data/app/controllers/hr_lite/admin/wfh_requests_controller.rb

@@ -49,8 +49,8 @@ module HrLite
         request = decidable.find(params[:id])
         request.approve!(actor: hr_current_user, note: params[:decision_note].to_s.strip.presence)
         redirect_to admin_wfh_requests_path, notice: "WFH approved for #{hr_display_name(request.user)}."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_wfh_request_path(request), alert: "Only pending requests can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_wfh_request_path(request), alert: reason_for(e, "Only pending requests can be decided.")
       end
 
       def reject
@@ -60,8 +60,8 @@ module HrLite
 
         request.reject!(actor: hr_current_user, note: note)
         redirect_to admin_wfh_requests_path, notice: "WFH rejected."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_wfh_request_path(request), alert: "Only pending requests can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_wfh_request_path(request), alert: reason_for(e, "Only pending requests can be decided.")
       end
 
       # HR changes an approved or rejected request: dates (past allowed) and/or decision, with a reason.

data/app/controllers/hr_lite/admin/work_locations_controller.rb

@@ -38,11 +38,11 @@ module HrLite
                                                           body: note, path: "/work_locations",
                                                           bell_to: [ location.user ], email_to: [ location.user ])
         rescue => e
-          Rails.logger.error("[hr_lite] work location notification failed: #{e.class}: #{e.message}")
+          HrLite.record_failure("work_location.#{status}", e, subject: location.user)
         end
         redirect_to admin_work_locations_path, notice: "Location #{status}."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_work_locations_path, alert: "Only pending locations can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_work_locations_path, alert: reason_for(e, "Only pending locations can be decided.")
       end
     end
   end

data/app/controllers/hr_lite/application_controller.rb

@@ -100,6 +100,11 @@ module HrLite
       end
     end
 
+    # The record's own reason when it has one; `fallback` names the usual cause.
+    def reason_for(error, fallback)
+      error.record.errors.full_messages.to_sentence.presence || fallback
+    end
+
     # Strict param parsing: anything that isn't the exact expected format
     # falls back to today (never 500s on a mangled URL).
     def parse_month_param(value)

data/app/controllers/hr_lite/comp_off_requests_controller.rb

@@ -27,8 +27,8 @@ module HrLite
       request = CompOffRequest.where(user_id: hr_current_user.id).find(params[:id])
       request.cancel!(actor: hr_current_user)
       redirect_to comp_off_requests_path, notice: "Request cancelled."
-    rescue ActiveRecord::RecordInvalid
-      redirect_to comp_off_requests_path, alert: "Only pending requests can be cancelled."
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to comp_off_requests_path, alert: reason_for(e, "Only pending requests can be cancelled.")
     end
 
     private

data/app/controllers/hr_lite/hr_requests_controller.rb

@@ -30,8 +30,8 @@ module HrLite
       request = own.find(params[:id])
       request.cancel!(actor: hr_current_user)
       redirect_to hr_requests_path, notice: "Request withdrawn."
-    rescue ActiveRecord::RecordInvalid
-      redirect_to hr_requests_path, alert: "That request has already been answered."
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to hr_requests_path, alert: reason_for(e, "That request has already been answered.")
     end
 
     private

data/app/controllers/hr_lite/regularization_requests_controller.rb

@@ -23,8 +23,8 @@ module HrLite
       request = RegularizationRequest.where(user_id: hr_current_user.id).find(params[:id])
       request.cancel!(actor: hr_current_user)
       redirect_to regularization_requests_path, notice: "Day fix cancelled."
-    rescue ActiveRecord::RecordInvalid
-      redirect_to regularization_requests_path, alert: "Only pending day fixes can be cancelled."
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to regularization_requests_path, alert: reason_for(e, "Only pending day fixes can be cancelled.")
     end
 
     private

data/app/controllers/hr_lite/tax_declarations_controller.rb

@@ -54,8 +54,8 @@ module HrLite
 
       @declaration.submit!(actor: hr_current_user)
       redirect_to tax_declaration_path, notice: "Submitted — HR will check the proof."
-    rescue ActiveRecord::RecordInvalid
-      redirect_to tax_declaration_path, alert: "Only a draft can be submitted."
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to tax_declaration_path, alert: reason_for(e, "Only a draft can be submitted.")
     end
 
     private

data/app/controllers/hr_lite/wfh_requests_controller.rb

@@ -26,8 +26,8 @@ module HrLite
     def cancel
       WfhRequest.where(user_id: hr_current_user.id).find(params[:id]).cancel!(actor: hr_current_user)
       redirect_to wfh_requests_path, notice: "WFH request cancelled."
-    rescue ActiveRecord::RecordInvalid
-      redirect_to wfh_requests_path, alert: "Only pending requests can be cancelled."
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to wfh_requests_path, alert: reason_for(e, "Only pending requests can be cancelled.")
     end
 
     private

data/app/controllers/hr_lite/work_locations_controller.rb

@@ -50,7 +50,7 @@ module HrLite
     def notify(event, title, path, to)
       Notifications.publish(event, title: title, path: path, bell_to: to)
     rescue => e
-      Rails.logger.error("[hr_lite] work location notification failed: #{e.class}: #{e.message}")
+      HrLite.record_failure(event, e, subject: hr_current_user)
     end
   end
 end

data/app/jobs/hr_lite/calendar_meeting_sync_job.rb

@@ -33,7 +33,7 @@ module HrLite
                                       .select { |m| m[:id].present? && m[:starts_at] && m[:ends_at] }
                                       .each { |m| m[:id] = m[:id].to_s }
     rescue => e
-      Rails.logger.warn("[hr_lite] calendar read failed for user #{user.id}: #{e.class}: #{e.message}")
+      HrLite.record_failure("calendar_read", e, subject: user)
       nil
     end
 

data/app/models/concerns/hr_lite/audited.rb

@@ -37,8 +37,8 @@ module HrLite
       hr_lite_publish_policy_change(log)
     rescue => e
       # The trail is best-effort by design: an audit hiccup must never roll
-      # back the domain write it describes. Logged loudly instead.
-      Rails.logger.error("[hr_lite] audit failed: #{e.class}: #{e.message}")
+      # back the domain write it describes. Shown to HR admins instead.
+      HrLite.record_failure("audit.#{action}", e, subject: self)
     end
 
     def hr_lite_audited_changes(action)

data/app/models/hr_lite/designation_change.rb

@@ -17,6 +17,9 @@ module HrLite
     after_create :apply_to_profile
     after_create :notify
 
+    # Why the host's on_designation_change hook failed, for the screen to say so.
+    attr_reader :hook_error
+
     def readonly?
       persisted? && !destroyed?
     end
@@ -45,6 +48,7 @@ module HrLite
         HrLite.config.on_designation_change.call(user, to_designation)
       rescue => e
         Rails.logger.error("[hr_lite] on_designation_change failed: #{e.class}: #{e.message}")
+        @hook_error = e.message.truncate(120)
       end
     end
 

data/app/models/hr_lite/employee_profile.rb

@@ -234,7 +234,7 @@ module HrLite
       ChecklistItem.open_for!(user, kind: "onboarding", anchor_date: date_of_joining)
     rescue => e
       # A checklist must never be the reason an employee cannot be created.
-      Rails.logger.error("[hr_lite] onboarding checklist failed: #{e.class}: #{e.message}")
+      HrLite.record_failure("onboarding_checklist", e, subject: user)
     end
   end
 end

data/app/models/hr_lite/resignation.rb

@@ -68,6 +68,9 @@ module HrLite
     end
 
     # False when the person had no employee profile to stamp — see accept!.
+    # Why the host could not revoke access, for the screen to say so.
+    attr_reader :access_error
+
     def exit_date_recorded?
       @exit_date_recorded
     end
@@ -82,6 +85,7 @@ module HrLite
       HrLite.config.offboard_user.call(user)
     rescue => e
       Rails.logger.error("[hr_lite] offboard_user failed: #{e.class}: #{e.message}")
+      @access_error = e.message.truncate(120)
     end
 
     def notify_submitted

data/app/models/hr_lite/wfh_request.rb

@@ -96,7 +96,7 @@ module HrLite
       Notifications.publish(event, title: title, body: body.presence, path: path, bell_to: to,
                                    email_to: event == "wfh.requested" ? [] : to)
     rescue => e
-      Rails.logger.error("[hr_lite] wfh notification failed: #{e.class}: #{e.message}")
+      HrLite.record_failure(event, e, subject: user)
     end
 
     def dates_in_window

data/app/views/hr_lite/admin/overview/index.html.erb

@@ -12,6 +12,23 @@
   <div class="hrl-kpi"><div class="hrl-kpi__value"><%= @kpis[:missing_checkout] %></div><div class="hrl-kpi__label">Missing checkouts</div></div>
 </div>
 
+<% if @failures.present? %>
+  <section class="hrl-card">
+    <h2 class="hrl-card__title">Failed in the background</h2>
+    <% @failures.each do |log| %>
+      <div class="hrl-feed__item">
+        <div class="hrl-feed__body">
+          <strong><%= log.action.delete_prefix("failure.").tr("._", "  ").humanize %></strong>
+          — <%= log.subject.is_a?(HrLite.user_klass) ? hr_display_name(log.subject) : "#{log.subject_type.demodulize.underscore.humanize} ##{log.subject_id}" %>,
+          <%= log.created_at.strftime("%d %b, %H:%M") %>
+          <div class="hrl-small hrl-muted"><%= log.audited_changes["error"] %>: <%= log.audited_changes["message"] %></div>
+        </div>
+      </div>
+    <% end %>
+    <a class="hrl-card__link" href="<%= hr_lite.admin_audit_logs_path %>">Audit trail</a>
+  </section>
+<% end %>
+
 <% if pending.zero? && @kpis.except(:pending).values.all?(&:zero?) %>
   <p class="hrl-card hrl-card--empty">All present and accounted for.</p>
 <% else %>

data/lib/hr_lite/notifications.rb

@@ -110,7 +110,7 @@ module HrLite
         lead_path = leadership[:path] || path
 
         deliver_bells(event, row, bell_to, title, body, path)
-        deliver_emails(row, email_to, title, body, path, lines, link_url)
+        deliver_emails(event, row, email_to, title, body, path, lines, link_url)
         return if skip_leadership
 
         deliver_leadership_email(event, row, lead_title, lead_body, lead_path, lines, diff)
@@ -128,7 +128,7 @@ module HrLite
         end
       end
 
-      def deliver_emails(row, email_to, title, body, path, lines, link_url = nil)
+      def deliver_emails(event, row, email_to, title, body, path, lines, link_url = nil)
         return unless row[:email]
 
         # Rescued PER RECIPIENT. Wrapping the whole loop meant one bad address
@@ -147,7 +147,7 @@ module HrLite
             held = held_until[user.id]
             held ? mail.deliver_later(wait_until: held) : mail.deliver_later
           rescue => e
-            Rails.logger.error("[hr_lite] event email failed: #{e.class}: #{e.message}")
+            HrLite.record_failure("#{event}.email", e, subject: user)
           end
         end
       end
@@ -162,7 +162,7 @@ module HrLite
                                body: body, lines: lines, diff: diff, path: path, event: event.to_s)
                    .deliver_later
       rescue => e
-        Rails.logger.error("[hr_lite] leadership email failed: #{e.class}: #{e.message}")
+        HrLite.record_failure("#{event}.leadership_email", e)
       end
 
       def deliver_leadership_bells(event, row, bell_to, title, body, path)
@@ -175,7 +175,7 @@ module HrLite
           HrLite.notify(user: leader, kind: event.to_s, title: title, body: body, path: path)
         end
       rescue => e
-        Rails.logger.error("[hr_lite] leadership bell failed: #{e.class}: #{e.message}")
+        HrLite.record_failure("#{event}.leadership_bell", e)
       end
     end
   end

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.58.0"
+  VERSION = "0.60.0"
 end

data/lib/hr_lite.rb

@@ -173,8 +173,18 @@ module HrLite
     def notify(user:, kind:, title:, body: nil, path: nil)
       config.notify.call(user: user, kind: kind, title: title, body: body, path: path)
     rescue => e
-      Rails.logger.error("[hr_lite] notify failed: #{e.class}: #{e.message}")
+      record_failure("notify", e, subject: user)
       nil
     end
+
+    # A background side effect failed: log it and keep a row that HR admins
+    # see on the overview, so nothing fails where nobody looks. Never raises.
+    def record_failure(event, error, subject: nil)
+      Rails.logger.error("[hr_lite] #{event} failed: #{error.class}: #{error.message}")
+      AuditLog.create!(actor: Current.actor, action: "failure.#{event}", subject_type: subject ? subject.class.name : config.user_class,
+                       subject_id: subject&.id || 0, audited_changes: { "error" => error.class.name, "message" => error.message.to_s.truncate(200) })
+    rescue => e
+      Rails.logger.error("[hr_lite] recording a failure failed: #{e.class}: #{e.message}")
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.58.0
+  version: 0.60.0
 platform: ruby
 authors:
 - kshitiz sinha