fix(packages): survive a failed install instead of aborting startupHEADmain

A fresh install pulls around 190 packages over the network. One transient download error left the config two thirds loaded, with hooks registered for packages that never installed.

use-package already warns and continues when an install fails, but it guards with condition-case-unless-debug, which does nothing while debug-on-error is set. early-init sets that for all of startup so my own errors stay loud, and it's what disarms the guard. I inhibited the debugger for the install alone, so the rest of init keeps it. Failures are recorded and reported when startup finishes, and cj/retry-failed-package-installs picks them up.

Editing hooks are silenced during an install. Generating autoloads visits .el files, which is how one missing package breaks the install of unrelated ones. A session-wide retry budget bounds the retrying. Installs stop after five failures in a row, since a run that long means the network is gone rather than one package being unlucky.

:vc packages get the same treatment through advice. use-package drops :ensure whenever :vc is present, and its clone path carries no error handling. A machine without credentials for the git host aborted init the same way.

make bootstrap installs everything headlessly, so a fresh machine never meets the debugger. It refuses to run against byte-compiled modules, where use-package consumes :ensure at compile time and a pass would report success having installed nothing.

1 files changed, 12 insertions, 0 deletions

diff --git a/early-init.el b/early-init.el
index d59f0a8b..8d4eb268 100644
--- a/early-init.el
+++ b/early-init.el
@@ -253,6 +253,18 @@ early-init.el.")
 ;;(require 'use-package-ensure)  ; Needed for :ensure to work
 (setq use-package-always-ensure t)  ; Auto-install packages
 
+;; A dead download must not abort startup. `use-package-ensure-elpa' already
+;; warns and carries on when an install fails, but it guards with
+;; `condition-case-unless-debug', which does nothing while `debug-on-error' is
+;; set -- and it is set above, deliberately, so init errors are loud. The two
+;; collide: one file-error from an ELPA host stopped a fresh install in place
+;; with a third of the config loaded. This module takes over
+;; `use-package-ensure-function' so the debugger is inhibited for the install
+;; alone, retries a transient failure, and reports what is missing once startup
+;; finishes. The load-path form matches init.el's so add-to-list dedups it.
+(add-to-list 'load-path (concat user-emacs-directory "modules/"))
+(require 'package-resilience)
+
 ;; Keep the GNU ELPA signing keys current so signature verification doesn't
 ;; start failing when the archive key expires (the usual reason verification
 ;; gets turned off). Failure is non-fatal so a clean-machine bootstrap or an