hr_lite 0.58.0 → 0.61.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c02612fcf572f2b42eab074882c2c07b975e9e272b6b94eb58b3a40edb00cdc
-  data.tar.gz: a537c7010fc7e5c5bbfc5e85eaa62d4afb4bc5b04eae953500d64ed5f4d1530e
+  metadata.gz: d57f2981c5062477e62d5cf7518fb074dfedccd73de6338d3263ce57143dd824
+  data.tar.gz: eb27ceb943445189d60db425d2fd7250d89fbb6e118f48b456d0a33eb22dfc4b
 SHA512:
-  metadata.gz: 54ca6bb8b70ce33601c8d163caf80556bdec2c653b0360f4d3ff418b0180a14fe2487292ef83499d989c5b064b919857bb083197789fef628bf42f736544a6c5
-  data.tar.gz: cf2c5930379f973d7a08870b87e3b3c7c28117e4f09921f5465702117c931195203df20292d4532e4b40ce4708479be770627acf7fa5e0a524791c5c81e1db5a
+  metadata.gz: 128a548490e3eb5c3028c197eb352e14419d200bbff36c79c7237bb4f355b666dd525ad7a0e54a7d1c8f6814d3b8165e3311215ab8f17dd81ac20460ae47b926
+  data.tar.gz: 84179555ec4cf9ea6623071e0f72da671ff3f17f69f9d4771fbe6a833e6ba77ca6edcab85bbeebbf835d6aee2d2a23ee1f61d1cba42f7f26186e6d61d246ca14

data/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.0] - 2026-10-21
+
+Hiring panel. Six migrations: five new tables and one that grants `hiring.manage` to HR, Leadership and Super Admin and seeds the first outreach email.
+
+- **Campaigns.** One per opening. Position, programme, stipend, CTC, location and schedule live on the campaign and fill the email's @placeholders.
+- **Sheet import with a preview.** Headers are matched through an alias list after case-folding and dropping punctuation, so each university's spelling works. Unknown columns are kept as extra data and usable as @placeholders. Two columns claiming one field wait for HR to pick one. Every skipped row says why, a repeat upload updates instead of duplicating, and nothing is saved before confirm. Phone and date of birth are encrypted. `config.read_sheet` reads the file (default: .csv only).
+- **Bulk email from one mailbox.** A confirm page names everyone left out (already sent, or a placeholder empty or unknown). One spaced job per recipient goes through `config.hiring.send_email`, and a unique index plus a claimed row stop double sends. An answer that never came is marked for a person to check, never resent. Sends are limited to ten an hour per person.
+- **Pipeline and timeline.** The stages are imported, invited, interested, not interested, interview (round N), selected, rejected and on hold. Moves the pipeline does not allow are refused, a rejection needs a listed reason, and every change goes on the candidate's timeline with who made it.
+- **Interview invites.** Rounds go on the hiring mailbox's Google Calendar through `config.hiring`, with reschedule and cancel. Each round is its own row.
+
+## [0.60.0] - 2026-10-21
+
+Background failures reach a person. No migrations.
+
+- **"Failed in the background" card on the HR overview.** A failed event email, leadership email or bell, host notify hook, WFH or work-location notice, audit row, onboarding checklist or calendar read used to write only a log line. Each is now recorded once in the audit trail (`failure.<event>`, with the error class, a 200-character message and the affected user) through `HrLite.record_failure`, and the ten most recent show on the overview to anyone who can open the audit trail. Money-tier subjects stay superadmin-only, as on the audit trail.
+
+## [0.59.0] - 2026-10-21
+
+No silent failures where a person is waiting on the answer. No migrations. Audit: `docs/audits/silent_failures.md`.
+
+- **Decisions say why they failed.** 24 admin and employee actions answered every failed save with a stock line such as "Only pending requests can be decided." They now show the record's own reason, and keep the stock line for the genuine not-pending case.
+- **Offboarding no longer claims access was revoked when it was not.** A failing `offboard_user` hook (offboard, or accepting a resignation on its last day) or `on_designation_change` hook now shows an alert with the cause and what to do by hand.
+- **Search, live tax, lead search and @mentions say when they could not load.** They no longer look like "no results" or show a stale figure. An unreadable ID-card photo (HEIC on desktop) now says so.
+
 ## [0.58.0] - 2026-10-21
 
 Leave and birthdays for the whole team, Keka-style. No migrations. Hosts schedule `HrLite::TeamNoticesJob` daily at 10am.

data/README.md

@@ -376,6 +376,20 @@ permission reaches (`leave.view`, `payroll.view`, `expense.approve`,
 Leadership picks Employee of the Month, Quarter and Year at `/admin/awards`,
 and Home shows the current winners to everyone.
 
+## Hiring
+
+Admin › Hiring (`hiring.manage`): campaigns, candidate sheet import, bulk email, interview rounds and decisions. The engine never talks to Google itself. Set `config.hiring` to an object with:
+
+```ruby
+sender                      # => { email:, name:, ready:, connect_url: }
+send_email(to:, subject:, body:)               # => { message_id:, thread_id: } (plain text)
+create_event(summary:, description:, attendee:, starts_at:, ends_at:) # => { event_id:, meet_link: }
+update_event(event_id:, starts_at:, ends_at:)
+cancel_event(event_id:)
+```
+
+Raise `HrLite::HiringDeliveryFailed` when nothing was sent and `HrLite::HiringDeliveryUnknown` when the provider may have acted (timeouts, 5xx). Never put the recipient in the error text: it is stored. `config.read_sheet = ->(path, filename) { rows }` reads uploads (default: .csv).
+
 ## Recurring jobs
 
 Schedule these on the host's job scheduler (cron, GoodJob, Sidekiq-cron,

data/app/assets/javascripts/hr_lite/crm_picker.js

@@ -12,12 +12,14 @@
       if (q.length < 2) return;
       timer = setTimeout(function () {
         fetch(box.dataset.hrlCrm + "?q=" + encodeURIComponent(q), { headers: { Accept: "application/json" }, credentials: "same-origin" })
-          .then(function (r) { return r.ok ? r.json() : []; })
+          .then(function (r) { if (!r.ok) throw r; return r.json(); })
           .then(function (leads) {
             select.length = 1;
+            select.options[0].text = "No lead";
             leads.forEach(function (lead) { select.add(new Option(lead.label, lead.id)); });
             if (leads.length) select.selectedIndex = 1;
-          });
+          })
+          .catch(function () { select.length = 1; select.options[0].text = "Lead search failed. Type again to retry."; });
       }, 250);
     });
   }

data/app/assets/javascripts/hr_lite/mention.js

@@ -59,9 +59,9 @@
 
     var lookup = debounce(function (query) {
       fetch(url + "?q=" + encodeURIComponent(query), { headers: { Accept: "application/json" } })
-        .then(function (r) { return r.ok ? r.json() : []; })
+        .then(function (r) { if (!r.ok) throw r; return r.json(); })
         .then(renderResults)
-        .catch(close);
+        .catch(function () { close(); menu.textContent = "Could not load names. Keep typing to retry."; menu.hidden = false; });
     }, 200);
 
     textarea.addEventListener("input", function () {

data/app/assets/javascripts/hr_lite/photo_crop.js

@@ -30,6 +30,10 @@
       zoom.closest("[data-hrl-photo-adjust]").hidden = false;
       place();
     };
+    img.onerror = function () {
+      input.value = "";
+      alert("Could not read that picture. Choose a JPG or PNG photo.");
+    };
     img.src = URL.createObjectURL(file);
   });
 

data/app/assets/javascripts/hr_lite/search.js

@@ -31,8 +31,9 @@
     clearTimeout(timer);
     timer = setTimeout(function () {
       fetch(form.action + "?frame=1&q=" + encodeURIComponent(input.value), { credentials: "same-origin", cache: "no-store" })
-        .then(function (response) { return response.ok ? response.text() : ""; })
-        .then(function (html) { out.innerHTML = html; });
+        .then(function (response) { if (!response.ok) throw response; return response.text(); })
+        .then(function (html) { out.innerHTML = html; })
+        .catch(function () { out.innerHTML = '<p class="hrl-errors" role="alert">Search failed. Check your connection and try again.</p>'; });
     }, 180);
   });
 

data/app/assets/javascripts/hr_lite/tax_preview.js

@@ -13,8 +13,9 @@
     Array.from(data.keys()).forEach(function (key) { if (/\[proofs\]/.test(key)) data.delete(key); });
     data.delete("_method");
     fetch(form.dataset.hrlTaxPreview, { method: "POST", body: data, credentials: "same-origin", headers: { "Accept": "text/html" } })
-      .then(function (response) { return response.ok ? response.text() : null; })
-      .then(function (html) { if (html) panel.innerHTML = html; });
+      .then(function (response) { if (!response.ok) throw response; return response.text(); })
+      .then(function (html) { panel.innerHTML = html; })
+      .catch(function () { panel.innerHTML = '<p class="hrl-errors" role="alert">Could not work out the tax just now. Check your connection; Save still works.</p>'; });
   }
   var rupees = new Intl.NumberFormat("en-IN", { style: "currency", currency: "INR", maximumFractionDigits: 0 });
   // The limit bar and "₹X of the ₹Y limit counts" follow the amount as typed.

data/app/assets/stylesheets/hr_lite/hr_lite.css

@@ -653,3 +653,23 @@ a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--
 .hrl-search__close { display: flex; justify-content: flex-end; margin: 0 0 var(--hrl-s-2); }
 .hrl-search::backdrop { background: rgb(15 23 42 / .4); }
 .hrl-search__list { list-style: none; margin: var(--hrl-s-1) 0 0; padding: 0; display: grid; gap: var(--hrl-s-2); }
+/* Hiring email preview: plain text, so its line breaks are the email's. */
+.hrl-hiring-preview { white-space: pre-line; overflow-wrap: anywhere; padding: var(--hrl-s-4); border: 1px solid var(--hrl-line); border-radius: var(--hrl-radius-sm); background: var(--hrl-bg); }
+/* Hiring candidate: actions first on a phone, a right-hand column on desktop. */
+@media (min-width: 1024px) {
+  .hrl-grid--side { grid-template-columns: 2fr 1fr; align-items: start; }
+  .hrl-grid--side > .hrl-grid__aside { grid-column: 2; grid-row: 1 / span 9; }
+}
+.hrl-card--next { background: var(--hrl-info-bg); border-color: transparent; }
+.hrl-hiring-decide > .button_to { flex: 1 1 8rem; }
+.hrl-hiring-decide > .button_to .hrl-btn { width: 100%; }
+.hrl-hiring-person { display: flex; align-items: center; gap: var(--hrl-s-3); width: 100%; }
+.hrl-hiring-avatar { flex: none; width: 52px; height: 52px; border-radius: var(--hrl-radius-pill); background: var(--hrl-info-bg); color: var(--hrl-accent); display: grid; place-items: center; font: 700 var(--hrl-t-lead) var(--hrl-font-head); }
+/* Pipeline stepper: a number until reached, a tick once passed. */
+.hrl-steps { list-style: none; margin: 0; padding: 0; display: grid; grid-template-columns: repeat(5, minmax(0, 1fr)); gap: var(--hrl-s-1); text-align: center; }
+.hrl-steps li { display: grid; justify-items: center; gap: var(--hrl-s-1); font-size: var(--hrl-t-micro); color: var(--hrl-ink-2); }
+.hrl-steps__dot { width: 28px; height: 28px; border-radius: var(--hrl-radius-pill); display: grid; place-items: center; font-weight: 700; border: 1px solid var(--hrl-line); background: var(--hrl-card); color: var(--hrl-muted); }
+.hrl-steps .is-done .hrl-steps__dot { background: var(--hrl-ok); border-color: var(--hrl-ok); color: var(--hrl-accent-ink); }
+.hrl-steps .is-now .hrl-steps__dot { background: var(--hrl-accent); border-color: var(--hrl-accent); color: var(--hrl-accent-ink); }
+.hrl-steps .is-now { font-weight: 700; color: var(--hrl-accent); }
+.hrl-mail__head { display: grid; gap: var(--hrl-s-2); padding-bottom: var(--hrl-s-3); margin-bottom: var(--hrl-s-3); border-bottom: 1px solid var(--hrl-line); overflow-wrap: anywhere; }

data/app/controllers/hr_lite/admin/assets_controller.rb

@@ -28,8 +28,8 @@ module HrLite
         user = HrLite.user_klass.find(params[:user_id])
         asset.assign_to!(user, actor: hr_current_user)
         redirect_to admin_assets_path, notice: "#{asset.name} given to #{HrLite.display_name(user)}."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_assets_path, alert: "#{asset.name} is already with somebody."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_assets_path, alert: reason_for(e, "#{asset.name} is already with somebody.")
       end
 
       def take_back
@@ -37,8 +37,8 @@ module HrLite
         asset.return!(actor: hr_current_user, condition: params[:condition_note],
                       status: params[:status].presence_in(Asset::STATUSES) || "available")
         redirect_to admin_assets_path, notice: "#{asset.name} taken back."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_assets_path, alert: "#{asset.name} is not with anybody."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_assets_path, alert: reason_for(e, "#{asset.name} is not with anybody.")
       end
 
       private

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -87,7 +87,7 @@ module HrLite
                                notice: "Nothing to remove for that day."
           end
 
-          record.destroy
+          record.destroy!
           # Its late penalties go too, so checking in again is not charged twice.
           AttendancePenalty.active.where(attendance_record_id: record.id)
                            .find_each { |p| p.update!(removed_at: Time.current, removed_by_id: hr_current_user.id, removal_reason: note) }

data/app/controllers/hr_lite/admin/ca_reviews_controller.rb

@@ -51,8 +51,8 @@ module HrLite
       def resolve
         CaReview.find(params[:id]).resolve!(actor: hr_current_user, note: params[:note])
         redirect_back_to_list notice: "Marked resolved."
-      rescue ActiveRecord::RecordInvalid
-        redirect_back_to_list alert: "Only a flagged item can be resolved."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_back_to_list alert: reason_for(e, "Only a flagged item can be resolved.")
       end
 
       private

data/app/controllers/hr_lite/admin/comp_off_requests_controller.rb

@@ -18,8 +18,8 @@ module HrLite
                     notice: "Approved — #{request.credit_days.to_f} day credited."
       rescue CompOffRequest::MissingCompOffType, CompOffRequest::StaleOffDay => e
         redirect_to admin_comp_off_request_path(request), alert: e.message
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_comp_off_request_path(request), alert: "Only pending requests can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_comp_off_request_path(request), alert: reason_for(e, "Only pending requests can be decided.")
       end
 
       def reject
@@ -31,8 +31,8 @@ module HrLite
 
         request.reject!(actor: hr_current_user, note: note)
         redirect_to admin_comp_off_requests_path, notice: "Request rejected."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_comp_off_request_path(request), alert: "Only pending requests can be decided."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_comp_off_request_path(request), alert: reason_for(e, "Only pending requests can be decided.")
       end
 
       private

data/app/controllers/hr_lite/admin/designation_changes_controller.rb

@@ -12,7 +12,10 @@ module HrLite
         @change = DesignationChange.new(change_params.merge(
           user_id: @profile.user_id, created_by_id: hr_current_user.id
         ))
-        if @change.save
+        if @change.save && @change.hook_error
+          redirect_to admin_employee_path(@profile),
+                      alert: "Role change recorded, but it could not be applied to their login (#{@change.hook_error}) — update their access by hand."
+        elsif @change.persisted?
           redirect_to admin_employee_path(@profile), notice: "Role change recorded."
         else
           render :new, status: :unprocessable_entity

data/app/controllers/hr_lite/admin/employees_controller.rb

@@ -101,13 +101,15 @@ module HrLite
         # since an unreturned laptop and un-revoked access both outlive the
         # employment.
         ChecklistItem.open_for!(@profile.user, kind: "offboarding", anchor_date: exit_date)
+        done = "Offboarded — last day #{exit_date.strftime('%d %b %Y')}"
         begin
           HrLite.config.offboard_user.call(@profile.user)
         rescue => e
           Rails.logger.error("[hr_lite] offboard_user failed: #{e.class}: #{e.message}")
+          return redirect_to admin_employee_path(@profile),
+                             alert: "#{done}, but access was NOT revoked (#{e.message.truncate(120)}) — revoke the login by hand."
         end
-        redirect_to admin_employee_path(@profile),
-                    notice: "Offboarded — last day #{exit_date.strftime('%d %b %Y')}, access revoked."
+        redirect_to admin_employee_path(@profile), notice: "#{done}, access revoked."
       rescue ActiveRecord::RecordInvalid => e
         redirect_to admin_employee_path(@profile), alert: e.record.errors.full_messages.to_sentence
       end

data/app/controllers/hr_lite/admin/expenses_controller.rb

@@ -15,8 +15,8 @@ module HrLite
         expense = decidable.find(params[:id])
         expense.approve!(actor: hr_current_user, note: params[:decision_note].presence)
         redirect_to admin_expenses_path, notice: "Claim approved."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_expenses_path, alert: "Only a submitted claim can be approved."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_expenses_path, alert: reason_for(e, "Only a submitted claim can be approved.")
       end
 
       def reject
@@ -26,8 +26,8 @@ module HrLite
 
         expense.reject!(actor: hr_current_user, note: note)
         redirect_to admin_expenses_path, notice: "Claim rejected."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_expenses_path, alert: "Only a submitted claim can be rejected."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_expenses_path, alert: reason_for(e, "Only a submitted claim can be rejected.")
       end
 
       def reimburse
@@ -35,8 +35,8 @@ module HrLite
         month = parse_month_param(params[:period_month])
         expense.reimburse!(actor: hr_current_user, period_month: month)
         redirect_to admin_expenses_path, notice: "Will be paid with #{month.strftime('%B %Y')} payroll."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_expenses_path, alert: "Only an approved claim can go on payroll, and only on a month not yet paid."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_expenses_path, alert: reason_for(e, "Only an approved claim can go on payroll, and only on a month not yet paid.")
       end
 
       # The receipt the employee had to upload, for the person deciding; same rules as a document download.

data/app/controllers/hr_lite/admin/hiring_campaigns_controller.rb

@@ -0,0 +1,88 @@
+module HrLite
+  module Admin
+    # Hiring drives: the list, one campaign's pipeline, and its sheet import.
+    class HiringCampaignsController < ApplicationController
+      FIELDS = %i[title position programme stipend ctc location schedule status].freeze
+
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      before_action :set_campaign, except: %i[index new create]
+
+      def index
+        @campaigns = paginate(HiringCampaign.newest_first)
+        @counts = HiringCandidate.where(campaign_id: @campaigns.map(&:id)).group(:campaign_id, :stage).count
+      end
+
+      def show
+        @stage = params[:stage].presence_in(HiringCandidate::STAGES)
+        @campus = params[:campus].presence
+        @stage_counts = @campaign.candidates.group(:stage).count
+        @campuses = @campaign.candidates.where.not(campus: [ nil, "" ]).distinct.order(:campus).pluck(:campus)
+        @candidates = paginate(@campaign.pipeline(stage: @stage, campus: @campus))
+        @templates = HiringTemplate.alphabetical
+        @attention = HiringMessage.joins(:candidate).where(hr_lite_hiring_candidates: { campaign_id: @campaign.id })
+                                  .where(status: %w[failed unknown sending]).includes(:candidate, :template).limit(50)
+      end
+
+      # A new campaign starts from the last one's offer: HR edits what changed.
+      def new
+        @campaign = HiringCampaign.new(HiringCampaign.newest_first.first&.slice(*FIELDS.excluding(:title, :status)))
+      end
+
+      def create
+        @campaign = HiringCampaign.new(campaign_params)
+        return render(:new, status: :unprocessable_entity) unless @campaign.save
+
+        redirect_to hr_lite.admin_hiring_campaign_path(@campaign), notice: "Campaign created. Upload the candidate sheet next."
+      end
+
+      def edit; end
+
+      def update
+        return render(:edit, status: :unprocessable_entity) unless @campaign.update(campaign_params)
+
+        redirect_to hr_lite.admin_hiring_campaign_path(@campaign), notice: "Saved."
+      end
+
+      # GET: the upload form. POST with a file: the preview. POST with the
+      # sealed rows and confirm: the import. Nothing is saved before confirm.
+      def import
+        return if request.get?
+
+        rows = params[:sheet].present? ? read_sheet(params[:sheet]) : sealer.decrypt_and_verify(params[:rows].to_s)
+        @import = HiringImport.new(@campaign, rows, picks: params.fetch(:picks, {}).permit!.to_h)
+        if params[:confirm].present? && @import.import!
+          counts = @import.counts
+          return redirect_to hr_lite.admin_hiring_campaign_path(@campaign),
+                             notice: "#{counts['create']} added, #{counts['update']} updated, #{counts['skip']} skipped."
+        end
+        @sealed = sealer.encrypt_and_sign(rows, expires_in: 1.hour)
+        render :preview
+      rescue ArgumentError => e
+        redirect_to hr_lite.import_admin_hiring_campaign_path(@campaign), alert: e.message
+      rescue ActiveSupport::MessageEncryptor::InvalidMessage
+        redirect_to hr_lite.import_admin_hiring_campaign_path(@campaign), alert: "That preview expired. Upload the sheet again."
+      rescue ActiveRecord::RecordNotUnique
+        redirect_to hr_lite.import_admin_hiring_campaign_path(@campaign), alert: "Another import ran at the same time. Upload the sheet again."
+      end
+
+      private
+
+      def set_campaign = @campaign = HiringCampaign.find(params[:id])
+      def campaign_params = params.require(:hiring_campaign).permit(*FIELDS)
+
+      def read_sheet(file)
+        rows = HrLite.config.read_sheet.call(file.tempfile.path, file.original_filename)
+        Array(rows).map { |row| Array(row).map { |cell| HiringImport.text(cell) } }
+      rescue ArgumentError
+        raise
+      rescue StandardError
+        raise ArgumentError, "That file could not be read. Save it as .xlsx or .csv with the headers in the first row."
+      end
+
+      # The previewed rows ride in the form, encrypted, so nothing touches disk.
+      def sealer
+        ActiveSupport::MessageEncryptor.new(Rails.application.key_generator.generate_key("hr_lite.hiring_import", 32))
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hiring_candidates_controller.rb

@@ -0,0 +1,27 @@
+module HrLite
+  module Admin
+    # One candidate: what we know, every email and interview, the timeline,
+    # and the decisions HR makes by hand.
+    class HiringCandidatesController < ApplicationController
+      # Invited and interview come from sending and scheduling, never a button.
+      MANUAL = %w[interested not_interested selected rejected on_hold].freeze
+
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      before_action { @candidate = HiringCandidate.includes(:campaign).find(params[:id]) }
+
+      def show
+        @messages = @candidate.messages.includes(:template).order(:created_at)
+        @interviews = @candidate.interviews.order(:round, :created_at)
+        @timeline = @candidate.timeline.limit(100)
+      end
+
+      def stage
+        to = params[:to].presence_in(MANUAL) or raise ArgumentError, "That is not a decision HR makes here."
+        @candidate.move_to!(to, reason: params[:reason], note: params[:note])
+        redirect_to hr_lite.admin_hiring_candidate_path(@candidate), notice: "Moved to #{@candidate.stage_label}."
+      rescue ArgumentError => e
+        redirect_to hr_lite.admin_hiring_candidate_path(@candidate), alert: e.message
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hiring_interviews_controller.rb

@@ -0,0 +1,77 @@
+module HrLite
+  module Admin
+    # Interview rounds on the hiring mailbox's Google Calendar. The row is
+    # written before Google is called, so an answer that never arrives still
+    # leaves a record ("unknown") for HR to check.
+    class HiringInterviewsController < ApplicationController
+      LENGTHS = [ 30, 45, 60 ].freeze
+
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      before_action { @candidate = HiringCandidate.includes(:campaign).find(params[:hiring_candidate_id]) }
+      before_action(except: :create) { @interview = @candidate.interviews.find(params[:id]) }
+      before_action :require_calendar!
+
+      def create
+        return back(alert: "#{@candidate.stage_label} cannot be interviewed.") unless HiringCandidate::MOVES.fetch(@candidate.stage).include?("interview")
+        return back(alert: "Pick a date and time in the future.") unless (starts, ends = slot)
+
+        round = @candidate.interviews.where(status: %w[scheduled unknown]).maximum(:round).to_i + 1
+        @interview = @candidate.interviews.create!(round: round, starts_at: starts, ends_at: ends)
+        ids = adapter.create_event(summary: "Interview: #{@candidate.campaign.position} (round #{round})",
+                                   description: "#{@candidate.campaign.title}. Join with the Google Meet link in this invite.",
+                                   attendee: @candidate.email, starts_at: starts, ends_at: ends)
+        @interview.update!(status: "scheduled", event_id: ids[:event_id], meet_link: ids[:meet_link])
+        @candidate.move_to!("interview", round: round)
+        @candidate.log!("interview_scheduled", round: round, starts_at: starts.iso8601)
+        back(notice: "Invite sent for round #{round}.")
+      rescue HrLite::HiringDeliveryUnknown, HrLite::HiringDeliveryFailed => e
+        google_trouble(e, "interview_scheduled")
+      end
+
+      def update
+        return back(alert: "Pick a date and time in the future.") unless (starts, ends = slot)
+        adapter.update_event(event_id: @interview.event_id, starts_at: starts, ends_at: ends)
+        @interview.update!(starts_at: starts, ends_at: ends)
+        @candidate.log!("interview_rescheduled", round: @interview.round, starts_at: starts.iso8601)
+        back(notice: "Round #{@interview.round} moved. Google told the candidate.")
+      rescue HrLite::HiringDeliveryUnknown, HrLite::HiringDeliveryFailed => e
+        google_trouble(e, "interview_rescheduled")
+      end
+
+      def destroy
+        adapter.cancel_event(event_id: @interview.event_id) if @interview.event_id
+        @interview.update!(status: "cancelled")
+        @candidate.log!("interview_cancelled", round: @interview.round)
+        back(notice: "Round #{@interview.round} cancelled. Google told the candidate.")
+      rescue HrLite::HiringDeliveryUnknown, HrLite::HiringDeliveryFailed => e
+        google_trouble(e, "interview_cancelled")
+      end
+
+      private
+
+      def adapter = HrLite.config.hiring
+      def back(**flash) = redirect_to(hr_lite.admin_hiring_candidate_path(@candidate), **flash)
+
+      def require_calendar!
+        back(alert: "Connect the hiring mailbox before scheduling.") unless adapter&.sender&.dig(:ready)
+      end
+
+      def slot
+        starts = Time.zone.parse("#{params[:date]} #{params[:time]}")
+        return unless starts&.future?
+
+        minutes = LENGTHS.include?(params[:minutes].to_i) ? params[:minutes].to_i : LENGTHS.first
+        [ starts, starts + minutes.minutes ]
+      rescue ArgumentError
+        nil
+      end
+
+      def google_trouble(error, action)
+        unknown = error.is_a?(HrLite::HiringDeliveryUnknown)
+        @interview.update!(status: unknown ? "unknown" : "failed", error: error.message.to_s.truncate(200)) if action == "interview_scheduled"
+        @candidate.log!("#{action}_#{unknown ? 'unknown' : 'failed'}", round: @interview.round)
+        back(alert: unknown ? "Google did not confirm. Check the hiring calendar before trying again." : "Google refused: #{error.message}")
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hiring_sends_controller.rb

@@ -0,0 +1,62 @@
+module HrLite
+  module Admin
+    # Bulk email: a confirm page that says exactly who gets it and who is
+    # left out (and why), then one queued job per recipient, spaced out.
+    class HiringSendsController < ApplicationController
+      SPACING = 3.seconds
+
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      rate_limit to: 10, within: 1.hour, only: :create, name: "hiring_send", by: -> { hr_current_user.id },
+                 with: -> { redirect_to hr_lite.admin_hiring_campaigns_path, alert: "Ten sends in an hour is the limit. Try again later." }
+
+      def new
+        load_recipients
+      end
+
+      def create
+        load_recipients
+        unless @sender&.dig(:ready)
+          return redirect_to hr_lite.admin_hiring_campaign_path(@campaign), alert: "Connect the hiring mailbox before sending."
+        end
+
+        batch = SecureRandom.uuid
+        queued = @recipients.filter_map do |candidate|
+          HiringMessage.create!(candidate: candidate, template: @template, batch: batch, sent_by: hr_current_user)
+        rescue ActiveRecord::RecordNotUnique
+          nil # already queued by another click
+        end
+        queued.each_with_index { |message, i| HiringSendJob.set(wait: SPACING * i).perform_later(message.id) }
+        AuditLog.record!(action: "hiring.batch", subject: @campaign,
+                         changes: { "template" => @template.name, "recipients" => queued.size, "batch" => batch })
+        redirect_to hr_lite.admin_hiring_campaign_path(@campaign), notice: "#{queued.size} emails queued from #{@sender[:email]}."
+      end
+
+      # Only a definite failure is sent again; "unknown" may already be in Gmail.
+      def retry
+        message = HiringMessage.find(params[:id])
+        if message.status == "failed"
+          message.update!(status: "queued", error: nil, sent_by: hr_current_user)
+          HiringSendJob.perform_later(message.id)
+        end
+        redirect_to hr_lite.admin_hiring_campaign_path(message.candidate.campaign_id), notice: "Queued again."
+      end
+
+      private
+
+      # Recomputed on every request from the ids: the confirm page is never trusted.
+      def load_recipients
+        @campaign = HiringCampaign.find(params[:hiring_campaign_id])
+        @template = HiringTemplate.find(params[:template_id])
+        @sender = HrLite.config.hiring&.sender
+        scope = params[:all].present? ? @campaign.pipeline(stage: params[:stage], campus: params[:campus]) : @campaign.pipeline.where(id: Array(params[:candidate_ids]))
+        already = HiringMessage.where(template: @template, candidate_id: scope.select(:id)).pluck(:candidate_id).to_set
+        @recipients, @left_out = [], []
+        scope.includes(:campaign, :interviews).each do |candidate|
+          missing = HiringMerge.new(candidate, sender_name: @sender&.dig(:name)).render(@template).missing
+          reason = already.include?(candidate.id) ? "already sent this template" : (missing.join(", ") if missing.any?)
+          reason ? @left_out << [ candidate, reason ] : @recipients << candidate
+        end
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hiring_templates_controller.rb

@@ -0,0 +1,45 @@
+module HrLite
+  module Admin
+    # Hiring emails HR writes once and sends to many, with a preview filled
+    # for a real candidate.
+    class HiringTemplatesController < ApplicationController
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      before_action(only: %i[edit update]) { @template = HiringTemplate.find(params[:id]) }
+
+      def index = @templates = HiringTemplate.alphabetical
+      def new = @template = HiringTemplate.new
+
+      def create
+        @template = HiringTemplate.new(template_params)
+        return render(:new, status: :unprocessable_entity) unless @template.save
+
+        redirect_to hr_lite.edit_admin_hiring_template_path(@template), notice: "Saved."
+      end
+
+      def edit = load_preview
+
+      def update
+        return load_preview && render(:edit, status: :unprocessable_entity) unless @template.update(template_params)
+
+        redirect_to hr_lite.edit_admin_hiring_template_path(@template), notice: "Saved."
+      end
+
+      private
+
+      def load_preview
+        @sample = HiringCandidate.includes(:campaign, :interviews).order(updated_at: :desc).limit(200).to_a
+        @preview_for = @sample.find { |c| c.id == params[:candidate_id].to_i } || @sample.first
+        return true unless @preview_for
+
+        sender_name = HrLite.config.hiring&.sender&.dig(:name)
+        @preview = HiringMerge.new(@preview_for, sender_name:).render(@template)
+        # Readiness across the previewed candidate's campaign: who a send would reach.
+        @campaign_size = @preview_for.campaign.candidates.count
+        @ready = @preview_for.campaign.candidates.includes(:campaign, :interviews).count { |c| HiringMerge.new(c, sender_name:).render(@template).missing.empty? }
+        true
+      end
+
+      def template_params = params.require(:hiring_template).permit(:name, :subject, :body)
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hr_requests_controller.rb

@@ -20,8 +20,8 @@ module HrLite
         assignee = HrLite.user_klass.find(params[:assignee_id])
         request.assign!(actor: hr_current_user, assignee: assignee)
         redirect_to admin_hr_request_path(request), notice: "Assigned to #{HrLite.display_name(assignee)}."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_hr_request_path(request), alert: "This request is already settled."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_hr_request_path(request), alert: reason_for(e, "This request is already settled.")
       end
 
       def resolve
@@ -30,8 +30,8 @@ module HrLite
         redirect_to admin_hr_requests_path, notice: "Answered."
       rescue ArgumentError
         redirect_to admin_hr_request_path(request), alert: "Write an answer before resolving."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_hr_request_path(request), alert: "This request is already settled."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_hr_request_path(request), alert: reason_for(e, "This request is already settled.")
       end
 
       private