Dynlink Plugin Loading and Version Compatibility for OCaml Zero‑Downtime Updates

Goal: update a small OCaml service without stopping traffic by loading a new version of a plugin via Dynlink while the host process continues running.

Constraint: Dynlink.loadfile can load a plugin, but once a module is loaded there is no documented way to unload or replace it; the host remains tied to the original plugin’s code and data.

Uncertainty: whether rebuilding the plugin’s .cmxs file and re‑loading it with the same Dynlink call (perhaps after setting allow_unsafe_modules) yields a safe update, or if any change to core modules forces a full process restart.

End with specific questions: Can a plugin be safely reloaded after its .cmxs is rebuilt without restarting the host? Does enabling allow_unsafe_modules permit replacement of an already‑loaded plugin? If core modules change, is a rolling restart behind a load balancer the only viable option for zero‑downtime migration?