You wrap the particular extension such that if it crashes, there's a sensible fallback option, such as restarting it, etc. that doesn't take out the entire syst

You wrap the particular extension such that if it crashes, there's a sensible fallback option, such as restarting it, etc. that doesn't take out the entire system. Many of the ideas of Tanenbaum would seem applicable towards preventing such a thing.