If a plugin upgrade fails halfway through activation, the host should still have the old plugin to serve requests. That is the problem Moult’s replacement design addresses: prepare a candidate generation privately, verify it, and only then make its capabilities visible. As Luke Green puts the question in his September 20, 2026 article, “What if an upgrade fails halfway through activating?”
Why replacing a registry value can take down a working plugin
A simple plugin registry often makes replacement look like an assignment: remove the old provider, initialize the new one, then store it. But initialization can fail. If the old value has already been removed when candidate setup throws, the host has lost a working capability even though the upgrade never completed.
For a long-running CLI daemon, editor, developer tool, or agent extension host, the important question is not just whether the new code can load. It is what remains available while it is being prepared, and what the host can safely publish if preparation fails.
Moult’s repository describes its approach this way: “A replacement is prepared in isolation, committed only after successful preparation, and followed by disposal of the previous generation.” The focus is lifecycle and capability visibility, rather than a direct overwrite of the live provider.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
How Moult’s replacement transaction works
The protocol described by Green and the project documentation has four stages. The old generation remains the serving generation until the candidate passes preparation and verification.
1. Setup the candidate in a private scope
The host constructs the candidate generation in its own resource scope. The current generation continues serving while setup runs. Resources acquired by the candidate belong to that scope, so they can be cleaned up if setup does not complete.
2. Verify before exposing capabilities
Before publication, the runtime checks the candidate’s provided capabilities and conflicts. Capabilities staged during preparation are not visible to observers before commit. This keeps an incomplete candidate from appearing to be the active provider.
Rank #2
3. Commit at the publication boundary
If preparation and verification succeed, the runtime publishes or swaps to the candidate in one atomic step for the staged capabilities. If setup or verification fails before that boundary, the prior generation should remain active and usable under the project’s stated design.
Atomic publication is not a promise of rollback after commit. Once the new generation has been committed, the old generation’s disposal may fail; the project describes such a failure as inspectable, while leaving the replacement in place.
4. Dispose the previous generation
After a successful commit, the previous generation is disposed and its owned resources are released. Within a scope, cleanup occurs in reverse acquisition order—last in, first out—so resources acquired later are released before earlier ones.
What the transaction protects—and what it does not
- Before commit: a candidate setup or validation failure should not displace the current generation.
- At commit: staged capabilities are published together at the runtime’s commit boundary, rather than being exposed piecemeal during preparation.
- After commit: a disposal problem with the previous generation does not roll back the committed replacement.
- Outside the scope: the design does not establish that arbitrary external side effects can be undone. It is not a general-purpose rollback mechanism.
Each generation gets a fresh scope. The new generation therefore does not automatically inherit the old generation’s in-memory handles or UI state. Green specifically notes that React component state is not promised to survive replacement; durable state should instead live behind a host-provided capability.
Dependency handling is deliberately limited
Moult’s README says v1 rejects replacing a provider when active dependents would need rebinding. It does not silently redirect those dependents to the new provider. That is a meaningful limit: hosts that need dependent plugins to move together require a separately defined strategy, such as coordinated replacement, rather than assuming the runtime will rebind them.
Free tools Windows power users keep installed
One-click scans. No signup required.
This makes the transaction a bounded lifecycle mechanism, not a complete answer to every dependency-graph upgrade. The host needs to account for provider relationships and treat a rejected replacement as a failed upgrade while the old generation remains in place.
Rank #4
Moult is not a sandbox, loader, or HMR system
The project README describes plugins as trusted code. Moult manages lifecycle and capability visibility; it does not restrict what trusted plugin code is permitted to do. It is also not a module loader or bundler, and the project says it does not rely on a global registry.
That distinction matters when comparing it with tools such as Vite HMR or Module Federation. Code delivery, module sharing, sandboxing, and safe lifecycle replacement solve different problems. Green frames Moult as addressing the failure case where candidate activation should not destroy the currently usable generation; that framing should not be read as a claim about every competing implementation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Green reports about tests and performance
Green’s September 2026 article reports nine replacement-transaction tests covering failed setup, failed validation, disposal ordering, and resource cleanup. It also reports 145 tests run in both Node and a DOM environment, for 290 total runs, and 15 documented invariants. These are figures reported by the article, not independently verified test results.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteBest Value
The article’s benchmark scenario averages about 16 ms for Moult and about 0.14 ms for a naive registry. The scenario includes installation, one failed replacement, and 100 successful replacements; the 16 ms figure is the whole scenario average, not the latency of one replacement. Green estimates about 0.16 ms per successful replacement in that environment and calls the result environment-specific, not a performance promise.
Green also reports a harness with a naive registry, Cordis 4.0.0-rc.9, and @moult/runtime 0.1.1. In that specific failed-upgrade scenario, the article says Moult survived without leaked resources while the other harness rows did not. This is an article-reported harness result, not a general product comparison or independent benchmark.
Project status and documentation
The availability information is inconsistent across the cited material: Green’s article refers to @moult/runtime 0.1.1 and invites installation, while both the Moult repository README and the runtime package README say the runtime is implemented or packaged but not yet released. Registry availability is not established by those documents, so check the package registry directly before relying on an install command.
For the design and its stated boundaries, see the project repository and Green’s September 20, 2026 article.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
