diff --git a/src/Build/Grand.Plugin.props b/src/Build/Grand.Plugin.props
index 9e69bf410a..52740231eb 100644
--- a/src/Build/Grand.Plugin.props
+++ b/src/Build/Grand.Plugin.props
@@ -18,8 +18,8 @@
     <!--
         The host assemblies every plugin compiles against.
 
-        Private=false keeps them out of the plugin's output folder: the plugin is loaded
-        into the host's AssemblyLoadContext, which already has them, and a second copy of
+        Private=false keeps them out of the plugin's output folder: the plugin's own load
+        context takes them from the host's, which already has them, and a second copy of
         a host assembly beside a plugin is a hazard - if that copy is ever the one loaded,
         its types are not the host's types and DI resolution fails in ways that are hard
         to trace.
diff --git a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
index 49b4ba903f..3ff932601a 100644
--- a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
+++ b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
@@ -11,7 +11,8 @@ public class ExtensionsConfig
     public bool DisableUploadExtensions { get; set; }
 
     /// <summary>
-    ///     Gets or sets a value indicating whether copy dll plugin files to /Plugins/bin on application startup
+    ///     Gets or sets a value indicating whether each installed plugin's folder is copied to /Plugins/bin/{folder}
+    ///     on application startup and loaded from there
     /// </summary>
     public bool PluginShadowCopy { get; set; }
 
@@ -29,4 +30,12 @@ public class ExtensionsConfig
     ///     List of installed plugins (comma separated)
     /// </summary>
     public string InstalledPlugins { get; set; }
+
+    /// <summary>
+    ///     Stop the application when an installed plugin, or a module enabled under FeatureManagement, fails to
+    ///     load. Off: the plugin is logged, listed with its error and left inactive, the module is logged as
+    ///     critical, and the application starts without it. A module whose folder is not deployed with this
+    ///     application is not a load failure: it is logged as a warning either way.
+    /// </summary>
+    public bool FailOnPluginLoadError { get; set; }
 }
\ No newline at end of file
diff --git a/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj b/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
index f33293af12..545bdd1b0b 100644
--- a/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
+++ b/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
@@ -22,4 +22,9 @@
     <ProjectReference Include="..\Grand.Mapping\Grand.Mapping.csproj" />
     <ProjectReference Include="..\Grand.Mediator\Grand.Mediator.csproj" />
   </ItemGroup>
+  <ItemGroup>
+    <InternalsVisibleTo Include="Grand.Infrastructure.Tests" />
+    <InternalsVisibleTo Include="Grand.Web.Admin.Tests" />
+    <InternalsVisibleTo Include="Grand.Web.Common.Tests" />
+  </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs b/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
index 8d5e00730b..bfdcf1f5f2 100644
--- a/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
+++ b/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
@@ -1,4 +1,7 @@
-using Microsoft.AspNetCore.Hosting;
+using Grand.Infrastructure.Configuration;
+using Grand.Infrastructure.Plugins;
+using Grand.SharedKernel;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.ApplicationParts;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
@@ -9,12 +12,19 @@
 
 namespace Grand.Infrastructure.Modules;
 
+/// <summary>
+///     Loads the modules enabled under FeatureManagement, each into a load context of its own, as plugins are
+///     loaded: the module shares the host's assemblies and resolves its private libraries from its folder.
+/// </summary>
 public static class ModuleLoader
 {
     private const string MODULE_SECTION_PATH = "FeatureManagement";
     private const string MODULES_DIRECTORY = "Modules";
     private const string LOGGER_NAME = "ModuleManager";
 
+    //the contexts of modules that failed to load; their assemblies stay loaded, so scans must skip them
+    private static readonly ConditionalWeakTable<AssemblyLoadContext, object> FailedContexts = new();
+
     private static List<(string FeatureName, bool IsEnabled)> GetFeatureList(IConfiguration configuration)
     {
         var featureSection = configuration.GetSection(MODULE_SECTION_PATH);
@@ -30,16 +40,40 @@ public static class ModuleLoader
             ))
             .ToList();
     }
-    
+
+    /// <summary>
+    ///     Loads the enabled modules. A module that cannot be loaded is logged and left out, or, with
+    ///     Extensions:FailOnPluginLoadError, stops the application.
+    /// </summary>
+    /// <exception cref="GrandException">A module failed to load and Extensions:FailOnPluginLoadError is set</exception>
     [MethodImpl(MethodImplOptions.NoInlining)]
     public static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration, IWebHostEnvironment hostingEnvironment)
+    {
+        LoadModules(mvcCoreBuilder, configuration, hostingEnvironment,
+            (name, mainAssemblyPath, hostAssemblyNames) =>
+                new IsolatedLoadContext(name, mainAssemblyPath, hostAssemblyNames),
+            () => GetLoggerFactory(mvcCoreBuilder.Services));
+    }
+
+    /// <param name="createContext">
+    ///     Creates a module's own context from its name, main assembly path and the host assembly names; tests
+    ///     create collectible ones
+    /// </param>
+    /// <param name="getLoggerFactory">The logger factory, asked for only when there are modules to load</param>
+    internal static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration,
+        IWebHostEnvironment hostingEnvironment, Func<string, string, ISet<string>, AssemblyLoadContext> createContext,
+        Func<ILoggerFactory> getLoggerFactory)
     {
         var modules = GetFeatureList(configuration);
         if (modules.Count == 0)
         {
             return;
         }
-        var logger = CreateLogger(mvcCoreBuilder.Services);
+
+        var config = new ExtensionsConfig();
+        configuration.GetSection("Extensions").Bind(config);
+        var logger = getLoggerFactory().CreateLogger(LOGGER_NAME);
+        var hostAssemblyNames = PluginManager.HostAssemblyNames();
         foreach (var module in modules)
         {
             if (!module.IsEnabled)
@@ -47,12 +81,32 @@ public static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration co
                 logger.LogInformation("Module '{ModuleName}' is disabled.", module.FeatureName);
                 continue;
             }
-            LoadModule(module.FeatureName, hostingEnvironment, mvcCoreBuilder, logger);
+
+            var error = LoadModule(module.FeatureName, hostingEnvironment, mvcCoreBuilder, logger,
+                mainAssemblyPath => createContext(module.FeatureName, mainAssemblyPath, hostAssemblyNames));
+            if (error == null)
+                continue;
+
+            logger.LogCritical("Module '{ModuleName}' could not be loaded: {LoadError}", module.FeatureName, error);
+            if (config.FailOnPluginLoadError)
+                throw new GrandException($"The module '{module.FeatureName}' could not be loaded: {error}");
         }
     }
 
-    private static void LoadModule(string moduleName, IWebHostEnvironment hostingEnvironment,
-            IMvcCoreBuilder mvcCoreBuilder, ILogger logger)
+    /// <summary>
+    ///     Whether the assembly belongs to a module that failed to load; its types must not be scanned
+    /// </summary>
+    internal static bool IsFailedModule(Assembly assembly)
+    {
+        ArgumentNullException.ThrowIfNull(assembly);
+
+        var context = AssemblyLoadContext.GetLoadContext(assembly);
+        return context != null && FailedContexts.TryGetValue(context, out _);
+    }
+
+    /// <returns>The reason the module could not be loaded; null when it is loaded, or has no files to load</returns>
+    private static string LoadModule(string moduleName, IWebHostEnvironment hostingEnvironment,
+        IMvcCoreBuilder mvcCoreBuilder, ILogger logger, Func<string, AssemblyLoadContext> createContext)
     {
         var modulePath = GetModulePath(hostingEnvironment, moduleName);
         var moduleFile = Path.Combine(modulePath, $"{moduleName}.dll");
@@ -61,73 +115,81 @@ private static void LoadModule(string moduleName, IWebHostEnvironment hostingEnv
         {
             logger.LogWarning("Module '{ModuleName}' does not exist at path: {ModulePath}",
                 moduleName, moduleFile);
-            return;
+            return null;
         }
 
+        AssemblyLoadContext context = null;
         try
         {
-            var assemblyLoadContext = new ModuleLoadContext();
-            LoadModuleDependencies(modulePath, assemblyLoadContext, mvcCoreBuilder, logger);
+            context = createContext(moduleFile);
+            var assembly = context.LoadFromAssemblyPath(moduleFile);
+
+            //resolved now, so a dependency the context cannot provide fails the module here instead of a type scan
+            //or a request
+            _ = assembly.GetTypes();
+            var error = ResolveReferences(assembly, context);
+            if (error != null)
+            {
+                FailedContexts.AddOrUpdate(context, null);
+                return error;
+            }
+
+            AddApplicationPart(mvcCoreBuilder, assembly);
             logger.LogInformation("Module '{ModuleName}' has been successfully loaded.", moduleName);
+            return null;
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Failed to load module '{ModuleName}'. Error: {Error}",
-                moduleName, ex.Message);
+            if (context != null)
+                FailedContexts.AddOrUpdate(context, null);
+
+            return ex is ReflectionTypeLoadException typeLoad
+                ? typeLoad.LoaderExceptions.FirstOrDefault(x => x != null)?.Message ?? ex.Message
+                : ex.Message;
         }
     }
-    private static void LoadModuleDependencies(string modulePath, ModuleLoadContext assemblyLoadContext,
-            IMvcCoreBuilder mvcCoreBuilder, ILogger logger)
-    {
-        var loadedAssemblies = AppDomain.CurrentDomain.GetAssemblies()
-            .Select(a => a.Location)
-            .ToHashSet();
 
-        foreach (var dependencyDll in Directory.GetFiles(modulePath, "*.dll"))
+    /// <summary>
+    ///     Resolves every assembly the module references. The application's copy of an assembly wins over the
+    ///     module's, and the runtime binds it whatever its version, so one older than the module was built against
+    ///     is reported here: it would fail only once a request reached the member it lacks.
+    /// </summary>
+    /// <returns>The reason the module cannot use its references; null when it can</returns>
+    private static string ResolveReferences(Assembly assembly, AssemblyLoadContext context)
+    {
+        foreach (var reference in assembly.GetReferencedAssemblies())
         {
-            if (loadedAssemblies.Contains(dependencyDll))
-                continue;
-
-            try
-            {
-                var assembly = assemblyLoadContext.LoadFromAssemblyPath(dependencyDll);
-                AddApplicationPart(mvcCoreBuilder, assembly);
-                logger.LogDebug("Successfully loaded dependency: {Dependency}", dependencyDll);
-            }
-            catch (Exception ex)
-            {
-                logger.LogWarning(ex, "Failed to load dependency: {Dependency}", dependencyDll);
-            }
+            var resolved = context.LoadFromAssemblyName(reference).GetName();
+            if (reference.Version != null && resolved.Version != null && resolved.Version < reference.Version)
+                return $"it is built against {reference.Name} {reference.Version}, " +
+                       $"but the application provides {resolved.Version}";
         }
+
+        return null;
     }
 
+    /// <summary>
+    ///     The application's logging, with every provider configured so far (console, event log, OpenTelemetry)
+    /// </summary>
+    private static ILoggerFactory GetLoggerFactory(IServiceCollection services)
+        => services.BuildServiceProvider().GetService<ILoggerFactory>()
+           ?? throw new InvalidOperationException("Logger factory not found in services.");
+
     private static string GetModulePath(IWebHostEnvironment hostingEnvironment, string moduleName)
            => Path.Combine(hostingEnvironment.ContentRootPath, MODULES_DIRECTORY, moduleName);
 
-    private static ILogger CreateLogger(IServiceCollection services)
-        => services.BuildServiceProvider()
-            .GetService<ILoggerFactory>()
-            ?.CreateLogger(LOGGER_NAME)
-            ?? throw new InvalidOperationException("Logger factory not found in services.");
-
+    /// <summary>
+    ///     Adds the module's own assembly and its related assemblies; its dependencies are not application parts
+    /// </summary>
     private static void AddApplicationPart(IMvcCoreBuilder mvcCoreBuilder, Assembly assembly)
     {
-        mvcCoreBuilder.AddApplicationPart(assembly);
-
-        var relatedAssemblies = RelatedAssemblyAttribute.GetRelatedAssemblies(assembly, false);
-        foreach (var relatedAssembly in relatedAssemblies)
-        {
-            var applicationPartFactory = ApplicationPartFactory.GetApplicationPartFactory(relatedAssembly);
-            foreach (var part in applicationPartFactory.GetApplicationParts(relatedAssembly))
-                mvcCoreBuilder.PartManager.ApplicationParts.Add(part);
-        }
-    }
-
-    private class ModuleLoadContext : AssemblyLoadContext
-    {
-        public ModuleLoadContext() : base(isCollectible: true)
-        {
+        //related parts are read first, so a failure adds nothing
+        var relatedParts = RelatedAssemblyAttribute.GetRelatedAssemblies(assembly, false)
+            .SelectMany(x => ApplicationPartFactory.GetApplicationPartFactory(x).GetApplicationParts(x))
+            .ToList();
 
-        }
+        mvcCoreBuilder.AddApplicationPart(assembly);
+        foreach (var part in relatedParts)
+            mvcCoreBuilder.PartManager.ApplicationParts.Add(part);
     }
-}
\ No newline at end of file
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/IsolatedLoadContext.cs b/src/Core/Grand.Infrastructure/Plugins/IsolatedLoadContext.cs
new file mode 100644
index 0000000000..29465594cd
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/IsolatedLoadContext.cs
@@ -0,0 +1,69 @@
+using System.Reflection;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     The load context of one extension (a plugin or a module). It resolves the extension's own dependencies
+///     from its deps.json, or from its folder, and takes every assembly the application provides from the
+///     default context, so the extension shares the host's types while its private libraries, in whatever
+///     version it ships them, stay its own.
+/// </summary>
+/// <remarks>Not collectible: an extension stays loaded until the application stops.</remarks>
+public sealed class IsolatedLoadContext : AssemblyLoadContext
+{
+    private readonly AssemblyDependencyResolver _resolver;
+    private readonly string _folder;
+    private readonly ISet<string> _hostAssemblyNames;
+
+    /// <param name="name">The context's name, for diagnostics</param>
+    /// <param name="mainAssemblyPath">The extension's main assembly; its deps.json, if any, sits beside it</param>
+    /// <param name="hostAssemblyNames">Simple names of the assemblies the application provides</param>
+    /// <exception cref="InvalidOperationException">The extension's deps.json cannot be resolved</exception>
+    public IsolatedLoadContext(string name, string mainAssemblyPath, ISet<string> hostAssemblyNames)
+        : this(name, mainAssemblyPath, hostAssemblyNames, false)
+    {
+    }
+
+    /// <param name="isCollectible">Tests only: lets a test unload what it loaded</param>
+    internal IsolatedLoadContext(string name, string mainAssemblyPath, ISet<string> hostAssemblyNames,
+        bool isCollectible) : base(name, isCollectible)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(mainAssemblyPath);
+        ArgumentNullException.ThrowIfNull(hostAssemblyNames);
+
+        _resolver = new AssemblyDependencyResolver(mainAssemblyPath);
+        _folder = Path.GetDirectoryName(Path.GetFullPath(mainAssemblyPath));
+        _hostAssemblyNames = hostAssemblyNames;
+    }
+
+    /// <summary>
+    ///     Null hands the name to the default context: an assembly the application provides, or one it has
+    ///     already loaded, is never loaded a second time.
+    /// </summary>
+    protected override Assembly Load(AssemblyName assemblyName)
+    {
+        var name = assemblyName.Name;
+        if (string.IsNullOrEmpty(name) || _hostAssemblyNames.Contains(name) || IsLoadedInDefault(name))
+            return null;
+
+        var path = _resolver.ResolveAssemblyToPath(assemblyName);
+        if (path != null)
+            return LoadFromAssemblyPath(path);
+
+        //a dll that sits in the folder without being listed in deps.json (or there is no deps.json)
+        var local = Path.Combine(_folder, name + ".dll");
+        return File.Exists(local) ? LoadFromAssemblyPath(local) : null;
+    }
+
+    protected override IntPtr LoadUnmanagedDll(string unmanagedDllName)
+    {
+        var path = _resolver.ResolveUnmanagedDllToPath(unmanagedDllName);
+        return path != null ? LoadUnmanagedDllFromPath(path) : IntPtr.Zero;
+    }
+
+    private static bool IsLoadedInDefault(string name)
+    {
+        return Default.Assemblies.Any(x => string.Equals(x.GetName().Name, name, StringComparison.OrdinalIgnoreCase));
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
new file mode 100644
index 0000000000..bf99a86f66
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
@@ -0,0 +1,397 @@
+using System.IO.Compression;
+using Grand.SharedKernel;
+using Grand.SharedKernel.Extensions;
+using Microsoft.Extensions.Logging;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     Installs an uploaded plugin archive. The plugin is identified by the manifest in its own folder, never by
+///     loading its assemblies, and the target folder is swapped in one step so a failure leaves the previous
+///     version in place.
+/// </summary>
+public sealed class PluginArchiveInstaller(string pluginsPath, ILogger logger)
+{
+    public const int MaxEntries = 5000;
+    public const long MaxUncompressedBytes = 200L * 1024 * 1024;
+
+    /// <summary>Limit applied to the real bytes written while extracting; lowered by tests only.</summary>
+    internal long UncompressedBytesLimit { get; init; } = MaxUncompressedBytes;
+
+    /// <summary>Directory move; replaced by tests to simulate failures.</summary>
+    internal Action<string, string> MoveDirectory { get; init; } = Directory.Move;
+
+    internal const string PathOutsideMessage = "The archive contains a path outside of the plugin folder.";
+
+    private const string PluginsFolderName = "Plugins";
+    private const string BinFolderName = "bin";
+    private const string ExtractedFolderName = "x";
+    private const string PreviousFolderName = "previous";
+
+    /// <summary>
+    ///     Validates the archive and installs the plugin it contains into the plugins folder.
+    /// </summary>
+    /// <param name="archivePath">Path of the zip file</param>
+    /// <exception cref="GrandException">The archive is not an installable plugin; the message is meant for the admin</exception>
+    public PluginArchiveResult Install(string archivePath)
+    {
+        var tempRoot = Path.Combine(pluginsPath, CommonPath.TmpUploadPath, Guid.NewGuid().ToString());
+        var keepPrevious = false;
+        try
+        {
+            CheckArchiveSize(archivePath);
+
+            var extracted = Path.Combine(tempRoot, ExtractedFolderName);
+            Extract(archivePath, extracted);
+
+            var (folderName, sourceFolder) = FindPluginFolder(extracted);
+            var manifest = ReadSingleManifest(sourceFolder);
+
+            if (!string.Equals(manifest.SupportedVersion, GrandVersion.SupportedPluginVersion, StringComparison.Ordinal))
+                throw new GrandException(
+                    $"This plugin doesn't support the current version - {GrandVersion.SupportedPluginVersion}");
+
+            //an existing folder is replaced under its own name, also when the archive spells it in another case
+            var targetName = ExistingFolderName(folderName) ?? folderName;
+            CheckTargetHoldsSamePlugin(targetName, manifest.SystemName);
+
+            if (IsSystemNameUsedByAnotherFolder(manifest.SystemName, targetName))
+                throw new GrandException(
+                    $"A plugin with the system name '{manifest.SystemName}' is already installed in another folder.");
+
+            Replace(sourceFolder, Path.Combine(pluginsPath, targetName), Path.Combine(tempRoot, PreviousFolderName));
+            return new PluginArchiveResult(targetName, manifest);
+        }
+        catch (RollbackFailedException)
+        {
+            keepPrevious = true;
+            throw;
+        }
+        finally
+        {
+            //after a failed rollback the previous version is only in the temp folder: leave it there
+            DeleteTempRoot(keepPrevious ? Path.Combine(tempRoot, ExtractedFolderName) : tempRoot);
+        }
+    }
+
+    /// <summary>
+    ///     Deletes the uploaded archive file only. Per-install temporary folders belong to <see cref="Install" />,
+    ///     which keeps the previous plugin version in one of them when a rollback fails.
+    ///     A failure is logged, not thrown.
+    /// </summary>
+    public static void DeleteArchive(string archivePath, ILogger logger)
+    {
+        if (string.IsNullOrEmpty(archivePath))
+            return;
+        try
+        {
+            File.Delete(archivePath);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            logger.LogWarning(ex, "The uploaded plugin archive {ArchivePath} could not be deleted", archivePath);
+        }
+    }
+
+    private void CheckArchiveSize(string archivePath)
+    {
+        try
+        {
+            using var archive = ZipFile.OpenRead(archivePath);
+            if (archive.Entries.Count > MaxEntries)
+                throw new GrandException($"The archive contains too many files (the limit is {MaxEntries}).");
+
+            long total = 0;
+            foreach (var entry in archive.Entries)
+            {
+                total += entry.Length;
+                if (total > UncompressedBytesLimit)
+                    throw new GrandException(
+                        $"The archive is too large when unpacked (the limit is {UncompressedBytesLimit / 1024 / 1024} MB).");
+            }
+        }
+        catch (InvalidDataException)
+        {
+            throw new GrandException("The file is not a valid zip archive.");
+        }
+    }
+
+    /// <summary>
+    ///     Extracts entry by entry so the real number of bytes written is bounded, whatever the headers claim,
+    ///     and so every destination is checked against the extraction root. Backslashes in entry names are
+    ///     path separators on every platform.
+    /// </summary>
+    private void Extract(string archivePath, string destination)
+    {
+        Directory.CreateDirectory(destination);
+        var root = Path.GetFullPath(destination) + Path.DirectorySeparatorChar;
+        long written = 0;
+        try
+        {
+            using var archive = ZipFile.OpenRead(archivePath);
+            foreach (var entry in archive.Entries)
+            {
+                var name = entry.FullName.Replace('\\', '/');
+                var full = Path.GetFullPath(Path.Combine(destination, name));
+                if (!full.StartsWith(root, StringComparison.Ordinal))
+                    throw new GrandException(PathOutsideMessage);
+
+                if (name.EndsWith('/'))
+                {
+                    Directory.CreateDirectory(full);
+                    continue;
+                }
+
+                Directory.CreateDirectory(Path.GetDirectoryName(full)!);
+                using var input = entry.Open();
+                using var output = new FileStream(full, FileMode.Create, FileAccess.Write, FileShare.None);
+                var buffer = new byte[81920];
+                int read;
+                while ((read = input.Read(buffer, 0, buffer.Length)) > 0)
+                {
+                    written += read;
+                    if (written > UncompressedBytesLimit)
+                        throw new GrandException(
+                            $"The archive is too large when unpacked (the limit is {UncompressedBytesLimit / 1024 / 1024} MB).");
+                    output.Write(buffer, 0, read);
+                }
+            }
+        }
+        catch (Exception ex) when (ex is IOException or InvalidDataException or UnauthorizedAccessException)
+        {
+            throw new GrandException("The archive could not be unpacked. Check that it is a valid plugin archive.");
+        }
+    }
+
+    /// <summary>
+    ///     The plugin folder is the one top-level folder holding the files; an archive that wraps it in a
+    ///     <c>Plugins</c> folder is unwrapped first. The folder is derived from the files, not from directory entries.
+    /// </summary>
+    private static (string Name, string Path) FindPluginFolder(string extracted)
+    {
+        var root = extracted;
+        var folders = TopLevelFolders(root);
+
+        if (folders.Count == 1 && string.Equals(folders[0], PluginsFolderName, StringComparison.OrdinalIgnoreCase))
+        {
+            root = Path.Combine(root, folders[0]);
+            folders = TopLevelFolders(root);
+        }
+
+        if (folders.Count != 1)
+            throw new GrandException(
+                "The archive should contain only one root plugin folder. For example, Payments.StripeCheckout.");
+
+        var name = folders[0];
+        if (!IsValidFolderName(name))
+            throw new GrandException($"'{name}' cannot be used as a plugin folder name.");
+
+        return (name, Path.Combine(root, name));
+    }
+
+    /// <summary>
+    ///     Names of the first path segments of all files. A file at the top level has no plugin folder to
+    ///     own it and invalidates the archive.
+    /// </summary>
+    private static List<string> TopLevelFolders(string root)
+    {
+        var names = new List<string>();
+        foreach (var file in Directory.EnumerateFiles(root, "*", SearchOption.AllDirectories))
+        {
+            var relative = Path.GetRelativePath(root, file);
+            var separator = relative.IndexOf(Path.DirectorySeparatorChar);
+            if (separator < 0)
+                throw new GrandException("The archive should not contain files outside of the plugin folder.");
+
+            var name = relative[..separator];
+            if (!names.Contains(name, StringComparer.OrdinalIgnoreCase))
+                names.Add(name);
+        }
+
+        return names;
+    }
+
+    private static bool IsValidFolderName(string name)
+    {
+        if (string.IsNullOrWhiteSpace(name) || name is "." or "..")
+            return false;
+        if (name.IndexOfAny(Path.GetInvalidFileNameChars()) >= 0)
+            return false;
+        return !IsReservedFolder(name);
+    }
+
+    private static bool IsReservedFolder(string name) =>
+        string.Equals(name, BinFolderName, StringComparison.OrdinalIgnoreCase) ||
+        string.Equals(name, CommonPath.TmpUploadPath, StringComparison.OrdinalIgnoreCase);
+
+    private static PluginManifest ReadSingleManifest(string folder)
+    {
+        var manifests = new List<PluginManifest>();
+        foreach (var dll in Directory.GetFiles(folder, "*.dll", SearchOption.TopDirectoryOnly))
+        {
+            PluginManifest manifest;
+            try
+            {
+                manifest = PluginManifestReader.Read(dll);
+            }
+            catch (Exception ex) when (ex is IOException or BadImageFormatException or UnauthorizedAccessException)
+            {
+                throw new GrandException($"The file '{Path.GetFileName(dll)}' could not be read as an assembly.");
+            }
+
+            if (manifest != null)
+                manifests.Add(manifest);
+        }
+
+        return manifests.Count switch {
+            0 => throw new GrandException(
+                "No plugin info is found. The plugin assembly must be in the root of the plugin folder."),
+            1 => manifests[0] is { SystemName: { Length: > 0 } }
+                ? manifests[0]
+                : throw new GrandException("The plugin info does not define a system name."),
+            _ => throw new GrandException("The plugin folder contains more than one plugin assembly.")
+        };
+    }
+
+    /// <summary>
+    ///     The exact name of the plugin folder that <paramref name="folderName" /> names, compared case-insensitively
+    ///     on every platform; the folder with exactly that name wins when several match. Null when there is none.
+    /// </summary>
+    private string ExistingFolderName(string folderName)
+    {
+        if (!Directory.Exists(pluginsPath))
+            return null;
+
+        var matches = Directory.GetDirectories(pluginsPath).Select(Path.GetFileName)
+            .Where(x => !IsReservedFolder(x) && string.Equals(x, folderName, StringComparison.OrdinalIgnoreCase))
+            .Order(StringComparer.Ordinal)
+            .ToList();
+
+        return matches.FirstOrDefault(x => string.Equals(x, folderName, StringComparison.Ordinal))
+               ?? matches.FirstOrDefault();
+    }
+
+    /// <summary>
+    ///     An existing folder may only be replaced by the plugin it holds; a folder without a readable plugin
+    ///     (an earlier broken upload) may be replaced by any.
+    /// </summary>
+    private void CheckTargetHoldsSamePlugin(string targetName, string systemName)
+    {
+        var target = Path.Combine(pluginsPath, targetName);
+        if (!Directory.Exists(target))
+            return;
+
+        var existing = ReadSystemNames(target);
+        if (existing.Count > 0 && !existing.Contains(systemName, StringComparer.OrdinalIgnoreCase))
+            throw new GrandException(
+                $"The folder '{targetName}' holds the plugin '{string.Join(", ", existing)}' and cannot be replaced by the plugin '{systemName}'. Rename the plugin folder in the archive.");
+    }
+
+    private bool IsSystemNameUsedByAnotherFolder(string systemName, string folderName)
+    {
+        if (!Directory.Exists(pluginsPath))
+            return false;
+
+        foreach (var directory in Directory.GetDirectories(pluginsPath))
+        {
+            var name = Path.GetFileName(directory);
+            if (IsReservedFolder(name) || string.Equals(name, folderName, StringComparison.OrdinalIgnoreCase))
+                continue;
+
+            if (ReadSystemNames(directory).Contains(systemName, StringComparer.OrdinalIgnoreCase))
+                return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    ///     The system names declared by the manifests at the top of an installed plugin folder
+    /// </summary>
+    private static List<string> ReadSystemNames(string folder)
+    {
+        var names = new List<string>();
+        foreach (var dll in Directory.GetFiles(folder, "*.dll", SearchOption.TopDirectoryOnly))
+        {
+            try
+            {
+                var manifest = PluginManifestReader.Read(dll);
+                if (!string.IsNullOrWhiteSpace(manifest?.SystemName))
+                    names.Add(manifest.SystemName);
+            }
+            catch (Exception ex) when (ex is IOException or BadImageFormatException or UnauthorizedAccessException)
+            {
+                //an unreadable file in an installed folder is not the uploaded plugin's concern
+            }
+        }
+
+        return names;
+    }
+
+    /// <summary>
+    ///     Moves the existing folder aside, moves the new one in, and moves the old one back if that fails.
+    ///     A locked file makes the first move fail, before anything has changed.
+    /// </summary>
+    private void Replace(string source, string target, string previous)
+    {
+        var hadPrevious = Directory.Exists(target);
+        if (hadPrevious)
+        {
+            try
+            {
+                MoveDirectory(target, previous);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                throw new GrandException(
+                    "The installed version of the plugin is in use and cannot be replaced. Stop the application and try again.");
+            }
+        }
+
+        try
+        {
+            MoveDirectory(source, target);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            if (hadPrevious)
+            {
+                try
+                {
+                    if (Directory.Exists(target))
+                        Directory.Delete(target, true);
+                    MoveDirectory(previous, target);
+                }
+                catch (Exception rollback)
+                {
+                    logger.LogError(rollback,
+                        "The plugin could not be installed and the previous version could not be restored; it is kept in {PreviousPath}",
+                        previous);
+                    throw new RollbackFailedException(
+                        $"The plugin could not be installed and the previous version could not be restored. The previous version is preserved at '{previous}'.");
+                }
+            }
+
+            throw new GrandException("The plugin could not be installed.");
+        }
+    }
+
+    private sealed class RollbackFailedException(string message) : GrandException(message);
+
+    private void DeleteTempRoot(string tempRoot)
+    {
+        try
+        {
+            if (Directory.Exists(tempRoot))
+                Directory.Delete(tempRoot, true);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            //the previous plugin version moved here can hold an assembly this process has loaded;
+            //it is not loaded from here on the next start, and it stays here until an operator removes it
+            logger.LogWarning(ex, "The temporary upload folder {TempDirectory} could not be deleted", tempRoot);
+        }
+    }
+}
+
+public sealed record PluginArchiveResult(string FolderName, PluginManifest Manifest);
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs b/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
index e06d9c8c14..c984e14044 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
@@ -1,3 +1,4 @@
+using Grand.SharedKernel;
 using System.Reflection;
 using System.Text.Json;
 
@@ -40,79 +41,113 @@ public static bool OnlyInstalledPlugins(Type type)
     }
 
     /// <summary>
-    ///     Whether the assembly may contribute types: true unless it belongs to a plugin that is not installed
+    ///     Whether the assembly may contribute types: true unless it belongs only to plugins that are not
+    ///     active (not installed, or failed to load). Any assembly of a plugin counts, not only the one
+    ///     carrying <see cref="PluginInfoAttribute" />. An assembly in a plugin's own load context belongs to that
+    ///     plugin alone; one outside every plugin's context, matched by name, counts while any plugin shipping
+    ///     that name is active.
     /// </summary>
     public static bool OnlyInstalledPlugins(Assembly assembly)
     {
-        var plugin = PluginManager.FindPlugin(assembly);
-        return plugin == null || plugin.Installed;
+        ArgumentNullException.ThrowIfNull(assembly);
+
+        var plugins = PluginManager.ReferencedPlugins?.ToList();
+        var owner = PluginManager.OwnerOf(assembly, plugins);
+        if (owner != null)
+            return owner.IsActive;
+
+        var name = assembly.GetName().Name;
+        var owners = plugins?
+            .Where(x => x.AssemblyNames.Contains(name, StringComparer.OrdinalIgnoreCase))
+            .ToList();
+
+        return owners is not { Count: > 0 } || owners.Any(x => x.IsActive);
     }
 
+    private static readonly SemaphoreSlim InstalledPluginsFileLock = new(1, 1);
+
+    /// <summary>
+    ///     Reads the list of installed plugin system names. A file that is not valid throws instead of
+    ///     yielding an empty list, because an empty list would silently deactivate every plugin.
+    /// </summary>
     public static IList<string> ParseInstalledPluginsFile(string filePath)
     {
         if (!File.Exists(filePath))
             return new List<string>();
 
         var text = File.ReadAllText(filePath);
-        return string.IsNullOrEmpty(text) ? new List<string>() : JsonSerializer.Deserialize<List<string>>(text);
+        if (string.IsNullOrWhiteSpace(text))
+            return new List<string>();
+
+        try
+        {
+            return JsonSerializer.Deserialize<List<string>>(text) ?? new List<string>();
+        }
+        catch (JsonException e)
+        {
+            throw new GrandException($"{filePath} is not a valid installed-plugins file: {e.Message}", e);
+        }
     }
+
     private static async Task SaveInstalledPluginsFile(IList<string> pluginSystemNames, string filePath)
     {
-        //serialize
         var result = JsonSerializer.Serialize(pluginSystemNames, new JsonSerializerOptions { WriteIndented = true });
-        //save
-        await File.WriteAllTextAsync(filePath, result);
-        await Task.CompletedTask;
+
+        var directory = Path.GetDirectoryName(filePath);
+        if (!string.IsNullOrEmpty(directory))
+            Directory.CreateDirectory(directory);
+
+        //write beside the target and move over it, so a crash never leaves a half-written list
+        var tempPath = filePath + ".tmp";
+        await File.WriteAllTextAsync(tempPath, result);
+        File.Move(tempPath, filePath, true);
+    }
+
+    private static async Task UpdateInstalledPluginsFile(Action<IList<string>> update)
+    {
+        var filePath = PluginPaths.Instance.InstalledPluginsFile;
+
+        await InstalledPluginsFileLock.WaitAsync();
+        try
+        {
+            var installedPluginSystemNames = ParseInstalledPluginsFile(filePath);
+            update(installedPluginSystemNames);
+            await SaveInstalledPluginsFile(installedPluginSystemNames, filePath);
+        }
+        finally
+        {
+            InstalledPluginsFileLock.Release();
+        }
     }
 
     /// <summary>
     ///     Mark plugin as installed
     /// </summary>
     /// <param name="systemName">Plugin system name</param>
-    public static async Task MarkPluginAsInstalled(string systemName)
+    public static Task MarkPluginAsInstalled(string systemName)
     {
         ArgumentNullException.ThrowIfNullOrEmpty(systemName);
 
-        var filePath = PluginPaths.Instance.InstalledPluginsFile;
-        if (!File.Exists(filePath))
-            await using (File.Create(filePath))
-            {
-                //we use 'using' to close the file after it's created
-            }
-
-        var installedPluginSystemNames = ParseInstalledPluginsFile(filePath);
-
-        var alreadyMarkedAsInstalled =
-            installedPluginSystemNames.FirstOrDefault(x => x.Equals(systemName, StringComparison.OrdinalIgnoreCase)) !=
-            null;
-        if (!alreadyMarkedAsInstalled)
-            installedPluginSystemNames.Add(systemName);
-
-        await SaveInstalledPluginsFile(installedPluginSystemNames, filePath);
+        return UpdateInstalledPluginsFile(names =>
+        {
+            if (!names.Any(x => x.Equals(systemName, StringComparison.OrdinalIgnoreCase)))
+                names.Add(systemName);
+        });
     }
 
     /// <summary>
     ///     Mark plugin as uninstalled
     /// </summary>
     /// <param name="systemName">Plugin system name</param>
-    public static async Task MarkPluginAsUninstalled(string systemName)
+    public static Task MarkPluginAsUninstalled(string systemName)
     {
         ArgumentNullException.ThrowIfNullOrEmpty(systemName);
 
-        var filePath = PluginPaths.Instance.InstalledPluginsFile;
-        if (!File.Exists(filePath))
-            await using (File.Create(filePath))
-            {
-                //we use 'using' to close the file after it's created
-            }
-
-        var installedPluginSystemNames = ParseInstalledPluginsFile(filePath);
-        var alreadyMarkedAsInstalled =
-            installedPluginSystemNames.FirstOrDefault(x => x.Equals(systemName, StringComparison.OrdinalIgnoreCase)) !=
-            null;
-        if (alreadyMarkedAsInstalled)
-            installedPluginSystemNames.Remove(systemName);
-
-        await SaveInstalledPluginsFile(installedPluginSystemNames, filePath);
+        return UpdateInstalledPluginsFile(names =>
+        {
+            for (var i = names.Count - 1; i >= 0; i--)
+                if (names[i].Equals(systemName, StringComparison.OrdinalIgnoreCase))
+                    names.RemoveAt(i);
+        });
     }
-}
\ No newline at end of file
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
new file mode 100644
index 0000000000..8d82d9cfc8
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
@@ -0,0 +1,211 @@
+using System.Reflection;
+using System.Text.RegularExpressions;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     A plugin folder that can be loaded.
+/// </summary>
+/// <param name="MainAssemblyPath">The assembly carrying <see cref="PluginInfoAttribute" /></param>
+/// <param name="AssemblyPaths">
+///     Every managed, non-host dll at the top of the folder; the plugin loads them, in its own context, whatever
+///     other plugins ship
+/// </param>
+/// <param name="AssemblyNames">Simple names of the assemblies in <paramref name="AssemblyPaths" /></param>
+public sealed record PluginCandidate(
+    DirectoryInfo Folder,
+    string MainAssemblyPath,
+    PluginManifest Manifest,
+    IReadOnlyList<string> AssemblyPaths,
+    IReadOnlyCollection<string> AssemblyNames);
+
+/// <summary>
+///     A plugin folder that cannot be loaded.
+/// </summary>
+/// <param name="SystemNames">
+///     The system names the folder declares, when they could be read; empty when the folder's plugin
+///     cannot be identified (an unreadable or undecodable file, a manifest without a system name)
+/// </param>
+public sealed record PluginLoadProblem(string Folder, string Message, IReadOnlyList<string> SystemNames)
+{
+    public PluginLoadProblem(string folder, string message) : this(folder, message, [])
+    {
+    }
+}
+
+public sealed record PluginScanResult(
+    IReadOnlyList<PluginCandidate> Plugins,
+    IReadOnlyList<PluginLoadProblem> Problems,
+    IReadOnlyList<string> Warnings);
+
+/// <summary>
+///     Plans which plugins and which of their assemblies to load. Everything is decided from file
+///     metadata; no plugin assembly is loaded.
+/// </summary>
+public static class PluginFolderScanner
+{
+    private static readonly string[] IgnoredFolders = ["bin", "TempUploads"];
+
+    private sealed record ScannedFile(string Path, string Name, PluginManifest Manifest);
+
+    /// <summary>
+    ///     Never throws because of one folder or file: what cannot be read becomes a problem of its folder.
+    /// </summary>
+    public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPattern, ISet<string> hostAssemblyNames)
+    {
+        var problems = new List<PluginLoadProblem>();
+        var warnings = new List<string>();
+        var plugins = new List<PluginCandidate>();
+        var systemNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        if (!pluginsFolder.Exists)
+            return new PluginScanResult([], problems, warnings);
+
+        DirectoryInfo[] folders;
+        try
+        {
+            folders = pluginsFolder.GetDirectories()
+                .Where(x => !IsIgnoredFolder(x.Name))
+                .OrderBy(x => x.Name, StringComparer.Ordinal)
+                .ToArray();
+        }
+        catch (Exception ex) when (IsReadFailure(ex))
+        {
+            problems.Add(new PluginLoadProblem(pluginsFolder.Name, $"The folder could not be read: {ex.Message}"));
+            return new PluginScanResult([], problems, warnings);
+        }
+
+        foreach (var folder in folders)
+        {
+            var files = ScanFolder(folder, skipPattern, hostAssemblyNames, warnings, problems);
+            if (files == null)
+                continue;
+
+            var manifests = files.Where(x => x.Manifest != null).ToList();
+
+            if (manifests.Count == 0)
+                continue;
+
+            if (manifests.Count > 1)
+            {
+                problems.Add(new PluginLoadProblem(folder.Name,
+                    $"The folder contains {manifests.Count} plugin assemblies ({string.Join(", ", manifests.Select(x => x.Name))}); only one is allowed.",
+                    manifests.Select(x => x.Manifest.SystemName).Where(x => !string.IsNullOrWhiteSpace(x)).ToList()));
+                continue;
+            }
+
+            var main = manifests[0];
+            var manifest = main.Manifest;
+            if (string.IsNullOrWhiteSpace(manifest.SystemName))
+            {
+                problems.Add(new PluginLoadProblem(folder.Name, "has no SystemName"));
+                continue;
+            }
+
+            if (!systemNames.Add(manifest.SystemName))
+            {
+                problems.Add(new PluginLoadProblem(folder.Name,
+                    $"The plugin system name '{manifest.SystemName}' is already used by another plugin folder.",
+                    [manifest.SystemName]));
+                continue;
+            }
+
+            plugins.Add(new PluginCandidate(folder, main.Path, manifest,
+                files.Select(x => x.Path).ToList(),
+                new HashSet<string>(files.Select(x => x.Name), StringComparer.OrdinalIgnoreCase)));
+        }
+
+        return new PluginScanResult(plugins, problems, warnings);
+    }
+
+    /// <summary>
+    ///     Returns the folder's assemblies, or null when the folder or one of its files cannot be read; the
+    ///     folder is then a problem, since the unread file may be the plugin itself or one it needs.
+    /// </summary>
+    private static List<ScannedFile> ScanFolder(DirectoryInfo folder, string skipPattern,
+        ISet<string> hostAssemblyNames, List<string> warnings, List<PluginLoadProblem> problems)
+    {
+        FileInfo[] dlls;
+        try
+        {
+            dlls = folder.GetFiles("*.dll", SearchOption.TopDirectoryOnly);
+        }
+        catch (Exception ex) when (IsReadFailure(ex))
+        {
+            problems.Add(new PluginLoadProblem(folder.Name, $"The folder could not be read: {ex.Message}"));
+            return null;
+        }
+
+        var result = new List<ScannedFile>();
+        foreach (var file in dlls.OrderBy(x => x.Name, StringComparer.Ordinal))
+        {
+            try
+            {
+                if (IsSkipped(file.Name, skipPattern))
+                    continue;
+
+                var scanned = ScanFile(folder, file, hostAssemblyNames, warnings);
+                if (scanned != null)
+                    result.Add(scanned);
+            }
+            catch (RegexMatchTimeoutException)
+            {
+                //whether the file is skipped is unknown, so the folder is not loaded, as for a file it cannot read
+                problems.Add(new PluginLoadProblem(folder.Name,
+                    $"'{file.Name}' could not be matched against Extensions:PluginSkipLoadingPattern in time; check the pattern."));
+                return null;
+            }
+            catch (Exception ex) when (IsReadFailure(ex))
+            {
+                problems.Add(new PluginLoadProblem(folder.Name, $"'{file.Name}' could not be read: {ex.Message}"));
+                return null;
+            }
+        }
+
+        return result;
+    }
+
+    private static ScannedFile ScanFile(DirectoryInfo folder, FileInfo file, ISet<string> hostAssemblyNames,
+        List<string> warnings)
+    {
+        if (!PluginManifestReader.IsManagedAssembly(file.FullName))
+            return null;
+
+        AssemblyName assemblyName;
+        try
+        {
+            assemblyName = AssemblyName.GetAssemblyName(file.FullName);
+        }
+        catch (BadImageFormatException)
+        {
+            //metadata without an assembly manifest, such as a module: nothing to load
+            return null;
+        }
+
+        if (hostAssemblyNames.Contains(assemblyName.Name!))
+        {
+            warnings.Add(
+                $"Plugin folder '{folder.Name}' ships '{file.Name}', which the application already provides; the copy is ignored.");
+            return null;
+        }
+
+        return new ScannedFile(file.FullName, assemblyName.Name!, PluginManifestReader.Read(file.FullName));
+    }
+
+    /// <summary>
+    ///     The shadow copy and upload folders inside Plugins, which are never plugin folders
+    /// </summary>
+    internal static bool IsIgnoredFolder(string name) =>
+        IgnoredFolders.Contains(name, StringComparer.OrdinalIgnoreCase);
+
+    internal static bool IsReadFailure(Exception ex) =>
+        ex is IOException or UnauthorizedAccessException or BadImageFormatException;
+
+    internal static bool IsSkipped(string fileName, string skipPattern) =>
+        !string.IsNullOrEmpty(skipPattern) && Matches(fileName, skipPattern);
+
+    private static bool Matches(string fileName, string pattern)
+    {
+        return Regex.IsMatch(fileName, pattern, RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
index 472e196565..0540cebc69 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
@@ -1,11 +1,14 @@
 using Grand.SharedKernel;
 using Microsoft.Extensions.DependencyInjection;
 using System.Reflection;
+using System.Runtime.Loader;
 
 namespace Grand.Infrastructure.Plugins;
 
 public sealed class PluginInfo
 {
+    private Assembly _referencedAssembly;
+
     public PluginInfo(
         FileInfo originalAssemblyFile,
         Assembly referencedAssembly,
@@ -14,7 +17,11 @@ public PluginInfo(
     {
         ReferencedAssembly = referencedAssembly;
         OriginalAssemblyFile = originalAssemblyFile;
+        FolderName = originalAssemblyFile?.Directory?.Name;
         PluginType = pluginType;
+        if (referencedAssembly != null)
+            AssemblyNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+                { referencedAssembly.GetName().Name! };
     }
 
     public PluginInfo()
@@ -32,15 +39,41 @@ public PluginInfo()
     public Type PluginType { get; set; }
 
     /// <summary>
-    ///     The assembly that has been shadow copied that is active in the application
+    ///     The plugin's main assembly once it is loaded: at startup for an installed plugin, on demand
+    ///     (<see cref="PluginManager.LoadForInstall" />) for one being installed; null until then
     /// </summary>
-    public Assembly ReferencedAssembly { get; internal set; }
+    /// <remarks>
+    ///     Set last when a plugin loads on demand, so a request that sees it also sees <see cref="PluginType" />
+    /// </remarks>
+    public Assembly ReferencedAssembly
+    {
+        get => Volatile.Read(ref _referencedAssembly);
+        internal set => Volatile.Write(ref _referencedAssembly, value);
+    }
+
+    /// <summary>
+    ///     The scanned folder <see cref="PluginManager.LoadForInstall" /> loads; null when there is nothing to load
+    ///     on demand (the plugin loaded at startup, is built for another version, or was not found by a scan)
+    /// </summary>
+    internal PluginCandidate Candidate { get; set; }
+
+    /// <summary>
+    ///     The plugin's own load context, once loading it began; it holds the plugin's assemblies, also those of
+    ///     a plugin that failed to load. Null for a plugin that was not loaded.
+    /// </summary>
+    internal AssemblyLoadContext LoadContext { get; set; }
 
     /// <summary>
     ///     The original assembly file that a shadow copy was made from it
     /// </summary>
     public FileInfo OriginalAssemblyFile { get; internal set; }
 
+    /// <summary>
+    ///     The plugin's folder in Plugins; together with <see cref="SystemName" /> it tells apart two folders
+    ///     declaring the same system name, and it is known also for a folder whose plugin could not be identified
+    /// </summary>
+    public string FolderName { get; internal set; }
+
     /// <summary>
     ///     Gets or sets the plugin group
     /// </summary>
@@ -81,17 +114,52 @@ public PluginInfo()
     /// </summary>
     public bool Installed { get; set; }
 
+    /// <summary>
+    ///     Why the plugin could not be loaded; null when it loaded
+    /// </summary>
+    public string LoadError { get; internal set; }
+
+    /// <summary>
+    ///     Simple names of the plugin's assemblies, compared case-insensitively. Taken from the plugin
+    ///     folder, so they are known whether or not the plugin was loaded.
+    /// </summary>
+    public IReadOnlyCollection<string> AssemblyNames { get; internal set; } =
+        new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>
+    ///     Installed and loaded: only an active plugin contributes types to the application
+    /// </summary>
+    public bool IsActive => Installed && LoadError == null;
+
+    /// <summary>
+    ///     Creates the plugin, loading it first when it was listed without being loaded (an uninstalled plugin).
+    ///     An installed plugin is resolved from DI; one loaded on demand is not registered there until the restart,
+    ///     so it is created with its constructor dependencies taken from <paramref name="serviceProvider" />.
+    /// </summary>
+    /// <exception cref="GrandException">The plugin cannot be loaded or created</exception>
     public T Instance<T>(IServiceProvider serviceProvider) where T : class, IPlugin
     {
+        if (ReferencedAssembly == null && LoadError == null)
+            PluginManager.LoadForInstall(this);
+
+        if (PluginType == null)
+            throw new GrandException(LoadError != null
+                ? $"Plugin {SystemName} could not be loaded: {LoadError}"
+                : SupportedVersion != GrandVersion.SupportedPluginVersion
+                    //listed from its manifest and never loaded
+                    ? $"Plugin {SystemName} was built for GrandNode version {SupportedVersion ?? "(unknown)"} and is not compatible with the current version {GrandVersion.SupportedPluginVersion}"
+                    : $"Plugin {SystemName} has no IPlugin class");
+
         object instance;
         try
         {
-            instance = serviceProvider.GetRequiredService(PluginType);
+            instance = serviceProvider.GetService(PluginType)
+                       ?? ActivatorUtilities.CreateInstance(serviceProvider, PluginType);
         }
-        catch
+        catch (Exception e)
         {
             throw new GrandException(
-                $"Plugin has not been registered getRequiredService - dependency - {PluginType.FullName}");
+                $"Plugin {SystemName} ({PluginType.FullName}) could not be created: {e.Message}", e);
         }
 
         var typedInstance = instance as T;
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs
new file mode 100644
index 0000000000..0ef9b20a12
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs
@@ -0,0 +1,202 @@
+using Grand.SharedKernel;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     The plugin state this process loaded, kept to tell which changes on disk wait for a restart. Comparing
+///     runs on every admin page view, so it reads the attributes of each folder's top-level dlls, the
+///     installed-plugins file once, and the manifests of folders that had no plugin at load time and changed
+///     since - never an assembly into the process.
+/// </summary>
+internal sealed class PluginLoadSnapshot
+{
+    /// <summary>
+    ///     A plugin folder as it was loaded; its assemblies as a whole are compared, so a replaced dependency
+    ///     counts as an update as much as a replaced main assembly
+    /// </summary>
+    private sealed record LoadedFolder(string SystemName, FileStamp Stamp);
+
+    private sealed record FileStamp(long Length, DateTime LastWriteTimeUtc, int Count);
+
+    private readonly string _pluginsFolder;
+    private readonly string _installedPluginsFile;
+    private readonly string _skipPattern;
+    private readonly HashSet<string> _installed;
+    private readonly Dictionary<string, FileStamp> _otherFolders;
+    private readonly Dictionary<string, LoadedFolder> _plugins;
+
+    private PluginLoadSnapshot(string pluginsFolder, string installedPluginsFile, string skipPattern,
+        HashSet<string> installed, Dictionary<string, FileStamp> otherFolders, Dictionary<string, LoadedFolder> plugins)
+    {
+        _pluginsFolder = pluginsFolder;
+        _installedPluginsFile = installedPluginsFile;
+        _skipPattern = skipPattern;
+        _installed = installed;
+        _otherFolders = otherFolders;
+        _plugins = plugins;
+    }
+
+    /// <summary>
+    ///     Records what a load saw
+    /// </summary>
+    /// <param name="installedPluginsFile">
+    ///     The file the installed list was read from; null when it came from configuration, which a running
+    ///     process cannot change
+    /// </param>
+    internal static PluginLoadSnapshot Capture(DirectoryInfo pluginsFolder, PluginScanResult scan,
+        IEnumerable<string> installedSystemNames, string installedPluginsFile, string skipPattern)
+    {
+        var plugins = new Dictionary<string, LoadedFolder>(StringComparer.OrdinalIgnoreCase);
+        foreach (var candidate in scan.Plugins)
+            plugins[candidate.Folder.Name] = new LoadedFolder(candidate.Manifest.SystemName,
+                StampOfAssemblies(candidate.Folder.FullName));
+
+        var knownFolders = (Folders(pluginsFolder.FullName) ?? []).ToHashSet(StringComparer.OrdinalIgnoreCase);
+        //a problem names its folder, or the Plugins folder itself when that could not be listed
+        foreach (var problem in scan.Problems.Where(x =>
+                     knownFolders.Contains(x.Folder) && !plugins.ContainsKey(x.Folder)))
+            plugins[problem.Folder] = new LoadedFolder(problem.SystemNames.FirstOrDefault() ?? problem.Folder,
+                StampOfAssemblies(Path.Combine(pluginsFolder.FullName, problem.Folder)));
+
+        //a folder without a plugin (empty, or only a plugin's leftovers) is read again once its assemblies change
+        var otherFolders = knownFolders.Where(x => !plugins.ContainsKey(x)).ToDictionary(x => x,
+            x => StampOfAssemblies(Path.Combine(pluginsFolder.FullName, x)), StringComparer.OrdinalIgnoreCase);
+
+        return new PluginLoadSnapshot(pluginsFolder.FullName, installedPluginsFile, skipPattern,
+            installedSystemNames.ToHashSet(StringComparer.OrdinalIgnoreCase), otherFolders, plugins);
+    }
+
+    /// <summary>
+    ///     What differs now from the load. Never throws because of one unreadable file or folder: what
+    ///     cannot be read is not reported.
+    /// </summary>
+    internal IReadOnlyList<PluginPendingChange> Compare()
+    {
+        var changes = new List<PluginPendingChange>();
+        CompareInstalled(changes);
+        CompareFolders(changes);
+        return changes;
+    }
+
+    private void CompareInstalled(List<PluginPendingChange> changes)
+    {
+        if (_installedPluginsFile == null)
+            return;
+
+        HashSet<string> installed;
+        try
+        {
+            installed = PluginExtensions.ParseInstalledPluginsFile(_installedPluginsFile)
+                .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        }
+        catch (Exception ex) when (ex is GrandException || PluginFolderScanner.IsReadFailure(ex))
+        {
+            return;
+        }
+
+        changes.AddRange(installed.Where(x => !_installed.Contains(x)).Order(StringComparer.OrdinalIgnoreCase)
+            .Select(x => new PluginPendingChange(x, FolderOf(x), PluginPendingChangeKind.Installed)));
+        changes.AddRange(_installed.Where(x => !installed.Contains(x)).Order(StringComparer.OrdinalIgnoreCase)
+            .Select(x => new PluginPendingChange(x, FolderOf(x), PluginPendingChangeKind.Uninstalled)));
+    }
+
+    private void CompareFolders(List<PluginPendingChange> changes)
+    {
+        //a Plugins folder that cannot be listed now is not reported as every plugin removed
+        var folders = Folders(_pluginsFolder)?.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        if (folders == null)
+            return;
+
+        foreach (var (folder, loaded) in _plugins.OrderBy(x => x.Key, StringComparer.Ordinal))
+        {
+            if (!folders.Contains(folder))
+                changes.Add(new PluginPendingChange(loaded.SystemName, folder, PluginPendingChangeKind.Removed));
+            else if (loaded.Stamp != StampOfAssemblies(Path.Combine(_pluginsFolder, folder)))
+                changes.Add(new PluginPendingChange(loaded.SystemName, folder, PluginPendingChangeKind.Updated));
+        }
+
+        foreach (var folder in folders.Where(x => !_plugins.ContainsKey(x)).Order(StringComparer.Ordinal))
+        {
+            if (_otherFolders.TryGetValue(folder, out var stamp) &&
+                stamp == StampOfAssemblies(Path.Combine(_pluginsFolder, folder)))
+                continue;
+
+            var manifest = ReadManifest(Path.Combine(_pluginsFolder, folder));
+            if (manifest != null)
+                changes.Add(new PluginPendingChange(
+                    string.IsNullOrWhiteSpace(manifest.SystemName) ? folder : manifest.SystemName, folder,
+                    PluginPendingChangeKind.Added));
+        }
+    }
+
+    private string FolderOf(string systemName)
+    {
+        return _plugins.FirstOrDefault(x => string.Equals(x.Value.SystemName, systemName,
+            StringComparison.OrdinalIgnoreCase)).Key;
+    }
+
+    /// <summary>
+    ///     The first plugin manifest among the folder's top-level assemblies, read from metadata
+    /// </summary>
+    private PluginManifest ReadManifest(string folder)
+    {
+        foreach (var file in Files(folder))
+        {
+            try
+            {
+                if (PluginFolderScanner.IsSkipped(file.Name, _skipPattern))
+                    continue;
+
+                var manifest = PluginManifestReader.Read(file.FullName);
+                if (manifest != null)
+                    return manifest;
+            }
+            catch (Exception)
+            {
+                //any file dropped into Plugins can land here, and an admin page must still render; a file
+                //still being written is read again on the next page view, a broken one fails at the restart
+            }
+        }
+
+        return null;
+    }
+
+    private static FileStamp StampOfAssemblies(string folder)
+    {
+        var files = Files(folder);
+        return new FileStamp(files.Sum(x => x.Length),
+            files.Count == 0 ? DateTime.MinValue : files.Max(x => x.LastWriteTimeUtc), files.Count);
+    }
+
+    private static List<FileInfo> Files(string folder)
+    {
+        try
+        {
+            return new DirectoryInfo(folder).GetFiles("*.dll", SearchOption.TopDirectoryOnly)
+                .OrderBy(x => x.Name, StringComparer.Ordinal)
+                .ToList();
+        }
+        catch (Exception ex) when (PluginFolderScanner.IsReadFailure(ex))
+        {
+            return [];
+        }
+    }
+
+    /// <summary>
+    ///     The plugin folder names; null when the Plugins folder cannot be listed
+    /// </summary>
+    private static List<string> Folders(string pluginsFolder)
+    {
+        try
+        {
+            return new DirectoryInfo(pluginsFolder).GetDirectories()
+                .Select(x => x.Name)
+                .Where(x => !PluginFolderScanner.IsIgnoredFolder(x))
+                .ToList();
+        }
+        catch (Exception ex) when (PluginFolderScanner.IsReadFailure(ex))
+        {
+            return null;
+        }
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
new file mode 100644
index 0000000000..0b98c34a0f
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
@@ -0,0 +1,185 @@
+using Grand.SharedKernel;
+using System.Reflection;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     Loads one planned plugin. A fault of the plugin never escapes: it becomes
+///     <see cref="PluginInfo.LoadError" />, so one plugin folder cannot stop the application.
+/// </summary>
+public static class PluginLoader
+{
+    public const string NoPluginClassError = "has no IPlugin class";
+
+    /// <summary>
+    ///     Loads the candidate's assemblies into a load context of its own and finds its plugin class.
+    /// </summary>
+    /// <param name="createContext">
+    ///     Creates the plugin's context for the main assembly at the given path (in the prepared folder)
+    /// </param>
+    /// <param name="prepareFolder">The shadow-copy step; the folder to load the plugin from in place of its own</param>
+    /// <returns>
+    ///     The plugin. When <see cref="PluginInfo.LoadError" /> is set, <see cref="PluginInfo.PluginType" /> and
+    ///     <see cref="PluginInfo.ReferencedAssembly" /> are null.
+    /// </returns>
+    public static PluginInfo Load(PluginCandidate candidate, bool installed,
+        Func<string, AssemblyLoadContext> createContext, Func<PluginCandidate, DirectoryInfo> prepareFolder)
+    {
+        ArgumentNullException.ThrowIfNull(candidate);
+        ArgumentNullException.ThrowIfNull(createContext);
+        ArgumentNullException.ThrowIfNull(prepareFolder);
+
+        var plugin = Describe(candidate, installed);
+        try
+        {
+            var folder = prepareFolder(candidate);
+            string Prepared(string path) =>
+                Path.Combine(folder.FullName, Path.GetRelativePath(candidate.Folder.FullName, path));
+
+            var mainPath = Prepared(candidate.MainAssemblyPath);
+            var context = createContext(mainPath);
+            plugin.LoadContext = context;
+
+            var main = context.LoadFromAssemblyPath(mainPath);
+            plugin.PluginFileName = Path.GetFileName(mainPath);
+
+            //the others by name, so the context resolves each as it would for a reference (deps.json first)
+            var assemblies = new List<Assembly> { main };
+            foreach (var path in candidate.AssemblyPaths.Where(x =>
+                         !string.Equals(x, candidate.MainAssemblyPath, StringComparison.OrdinalIgnoreCase)))
+                assemblies.Add(context.LoadFromAssemblyName(AssemblyName.GetAssemblyName(Prepared(path))));
+
+            //only the plugin's own code is checked: a third-party library may hold types built on optional
+            //assemblies it never ships, and it would fail here although it works at runtime.
+            //Every assembly is loaded before any type is resolved, so the order of the files does not matter
+            var pluginCode = assemblies.Where(x => x == main || IsPluginCode(x)).ToList();
+            Type pluginType = null;
+            foreach (var assembly in pluginCode)
+            {
+                var types = assembly.GetTypes();
+                if (assembly == main)
+                    pluginType = types.FirstOrDefault(IsPluginClass);
+            }
+
+            if (pluginType == null)
+                return Failed(plugin, NoPluginClassError);
+
+            //a reference used only inside a method body is not needed by GetTypes; resolved here, one the context
+            //cannot provide (such as another plugin's assembly) fails the load instead of a later request
+            foreach (var assembly in pluginCode)
+            foreach (var reference in assembly.GetReferencedAssemblies())
+                context.LoadFromAssemblyName(reference);
+
+            plugin.ReferencedAssembly = main;
+            plugin.PluginType = pluginType;
+            return plugin;
+        }
+        catch (ReflectionTypeLoadException ex)
+        {
+            return Failed(plugin, ex.LoaderExceptions.FirstOrDefault(x => x != null)?.Message ?? ex.Message);
+        }
+        catch (Exception ex)
+        {
+            //FileLoadException, FileNotFoundException, BadImageFormatException, an unresolvable deps.json and
+            //whatever else a plugin's files can cause; the plugin is reported, the application goes on
+            return Failed(plugin, ex.Message);
+        }
+    }
+
+    /// <summary>
+    ///     The plugin as its manifest describes it, without loading anything.
+    /// </summary>
+    internal static PluginInfo Describe(PluginCandidate candidate, bool installed)
+    {
+        var manifest = candidate.Manifest;
+        return new PluginInfo {
+            FriendlyName = manifest.FriendlyName,
+            Group = manifest.Group,
+            SystemName = manifest.SystemName,
+            Version = manifest.Version,
+            SupportedVersion = manifest.SupportedVersion,
+            Author = manifest.Author,
+            PluginFileName = Path.GetFileName(candidate.MainAssemblyPath),
+            OriginalAssemblyFile = new FileInfo(candidate.MainAssemblyPath),
+            FolderName = candidate.Folder.Name,
+            AssemblyNames = new HashSet<string>(candidate.AssemblyNames, StringComparer.OrdinalIgnoreCase),
+            Installed = installed
+        };
+    }
+
+    /// <summary>
+    ///     The list entries for a folder the scan could not plan: one per system name it declares, installed
+    ///     when that name is installed, or one named after the folder when its plugin cannot be identified.
+    /// </summary>
+    public static IEnumerable<PluginInfo> DescribeProblem(PluginLoadProblem problem,
+        IEnumerable<string> installedSystemNames)
+    {
+        ArgumentNullException.ThrowIfNull(problem);
+        ArgumentNullException.ThrowIfNull(installedSystemNames);
+
+        if (problem.SystemNames.Count == 0)
+            return [
+                new PluginInfo {
+                    SystemName = problem.Folder,
+                    FriendlyName = problem.Folder,
+                    FolderName = problem.Folder,
+                    LoadError = problem.Message
+                }
+            ];
+
+        var installed = installedSystemNames.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        return problem.SystemNames.Select(name => new PluginInfo {
+            SystemName = name,
+            FriendlyName = name,
+            FolderName = problem.Folder,
+            LoadError = problem.Message,
+            Installed = installed.Contains(name)
+        }).ToList();
+    }
+
+    /// <summary>
+    ///     With <paramref name="failOnPluginLoadError" />, throws when an installed plugin failed to load, or
+    ///     when a folder failed before its plugin could be identified - it may be an installed one.
+    /// </summary>
+    /// <exception cref="GrandException">The plugin or folder that failed, and why</exception>
+    public static void ThrowOnLoadError(IEnumerable<PluginInfo> plugins, IEnumerable<PluginLoadProblem> problems,
+        bool failOnPluginLoadError)
+    {
+        if (!failOnPluginLoadError)
+            return;
+
+        var failed = plugins.FirstOrDefault(x => x.Installed && x.LoadError != null);
+        if (failed != null)
+            throw new GrandException(
+                $"The installed plugin '{failed.SystemName}' could not be loaded: {failed.LoadError}");
+
+        var unidentified = problems.FirstOrDefault(x => x.SystemNames.Count == 0);
+        if (unidentified != null)
+            throw new GrandException(
+                $"The plugin folder '{unidentified.Folder}' could not be loaded: {unidentified.Message}");
+    }
+
+    /// <summary>
+    ///     The plugin's own code, built against GrandNode; a third-party library may reference optional
+    ///     assemblies it never loads, so its references are left to the runtime
+    /// </summary>
+    private static bool IsPluginCode(Assembly assembly)
+    {
+        var core = typeof(IPlugin).Assembly.GetName().Name;
+        return assembly.GetReferencedAssemblies().Any(x => string.Equals(x.Name, core, StringComparison.OrdinalIgnoreCase));
+    }
+
+    private static bool IsPluginClass(Type type)
+    {
+        return typeof(IPlugin).IsAssignableFrom(type) && type.IsClass && !type.IsAbstract;
+    }
+
+    private static PluginInfo Failed(PluginInfo plugin, string error)
+    {
+        plugin.LoadError = error;
+        plugin.PluginType = null;
+        plugin.ReferencedAssembly = null;
+        return plugin;
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index 5d592b4a7d..30dae1c4df 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -1,4 +1,7 @@
-using Grand.Infrastructure.Configuration;
+using Grand.Data.LiteDb;
+using Grand.Domain;
+using Grand.Infrastructure.Configuration;
+using Grand.Infrastructure.TypeSearch;
 using Grand.SharedKernel.Extensions;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.ApplicationParts;
@@ -8,7 +11,6 @@
 using System.Reflection;
 using System.Runtime.CompilerServices;
 using System.Runtime.Loader;
-using System.Text.RegularExpressions;
 
 namespace Grand.Infrastructure.Plugins;
 
@@ -32,6 +34,12 @@ public static class PluginManager
     private static ExtensionsConfig _config;
     private static ILogger _logger;
 
+    //what LoadForInstall needs to load a plugin as Load would have
+    private static Func<string, string, ISet<string>, AssemblyLoadContext> _createContext;
+    private static ISet<string> _hostAssemblyNames;
+    private static Func<PluginCandidate, DirectoryInfo> _prepareFolder;
+    private static bool _useLiteDb;
+
     #endregion
 
     #region Methods
@@ -41,15 +49,42 @@ public static class PluginManager
     /// </summary>
     public static IEnumerable<PluginInfo> ReferencedPlugins { get; set; }
 
+    /// <summary>
+    ///     What <see cref="Load" /> saw on disk; null until plugins are loaded
+    /// </summary>
+    internal static PluginLoadSnapshot LoadSnapshot { get; set; }
+
+    /// <summary>
+    ///     Plugin changes made on disk since this process loaded its plugins; they take effect after a restart.
+    ///     Reads the installed-plugins file and the plugin folders' metadata, never loads an assembly.
+    /// </summary>
+    public static IReadOnlyList<PluginPendingChange> GetPendingChanges()
+    {
+        return LoadSnapshot?.Compare() ?? [];
+    }
 
     /// <summary>
     ///     Load plugins
     /// </summary>
     [MethodImpl(MethodImplOptions.NoInlining)]
     public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration, IWebHostEnvironment hostEnvironment)
+    {
+        Load(mvcCoreBuilder, configuration, hostEnvironment,
+            (name, mainAssemblyPath, hostAssemblyNames) =>
+                new IsolatedLoadContext(name, mainAssemblyPath, hostAssemblyNames));
+    }
+
+    /// <param name="createContext">
+    ///     Creates a plugin's own context from its name, main assembly path and the host assembly names; tests
+    ///     create collectible ones
+    /// </param>
+    internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration,
+        IWebHostEnvironment hostEnvironment, Func<string, string, ISet<string>, AssemblyLoadContext> createContext)
     {
         _config = new ExtensionsConfig();
         configuration.GetSection("Extensions").Bind(_config);
+        var dbConfig = new DatabaseConfig();
+        configuration.GetSection("Database").Bind(dbConfig);
 
         lock (_synLock)
         {
@@ -60,127 +95,181 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
 
             _pluginFolder = new DirectoryInfo(Path.Combine(hostEnvironment.ContentRootPath, CommonPath.Plugins));
             _copyFolder = new DirectoryInfo(Path.Combine(hostEnvironment.ContentRootPath, CommonPath.Plugins, "bin"));
-                
-            var referencedPlugins = new List<PluginInfo>();
-            try
-            {
-                var installedPluginSystemNames =
-                    !string.IsNullOrEmpty(_config.InstalledPlugins)
-                        ? _config.InstalledPlugins.Split(",").Select(x => x.Trim())
-                        : PluginExtensions.ParseInstalledPluginsFile(PluginPaths.Instance.InstalledPluginsFile);
-
-                _logger.LogInformation("Creating shadow copy folder and querying for dlls");
-                Directory.CreateDirectory(_pluginFolder.FullName);
-                Directory.CreateDirectory(_copyFolder.FullName);
-                var binFiles = _copyFolder.GetFiles("*", SearchOption.AllDirectories);
-                if (_config.PluginShadowCopy)
-                    //clear out shadow plugins
-                    foreach (var f in binFiles)
-                    {
-                        _logger.LogInformation("Deleting {FName}", f.Name);
-                        try
-                        {
-                            var fileName = Path.GetFileName(f.FullName);
-                            if (fileName.Equals("index.htm", StringComparison.OrdinalIgnoreCase))
-                                continue;
-
-                            File.Delete(f.FullName);
-                        }
-                        catch (Exception exc)
-                        {
-                            _logger.LogError(exc, "PluginManager");
-                        }
-                    }
 
-                //load description files
-                foreach (var plugin in GetPluginInfo())
+            var installedPluginSystemNames =
+                (!string.IsNullOrEmpty(_config.InstalledPlugins)
+                    ? _config.InstalledPlugins.Split(",").Select(x => x.Trim())
+                    : PluginExtensions.ParseInstalledPluginsFile(PluginPaths.Instance.InstalledPluginsFile))
+                .ToList();
+
+            _logger.LogInformation("Creating shadow copy folder and querying for dlls");
+            Directory.CreateDirectory(_pluginFolder.FullName);
+            Directory.CreateDirectory(_copyFolder.FullName);
+            if (_config.PluginShadowCopy)
+            {
+                //the copies of plugin folders that are gone (removed or renamed); every other plugin's copy is
+                //kept, so its unchanged files are not copied again
+                foreach (var copy in _copyFolder.GetDirectories())
                 {
-                    if (plugin.SupportedVersion != GrandVersion.SupportedPluginVersion)
-                    {
-                        _logger.LogInformation("Incompatible plugin {PluginSystemName}", plugin.SystemName);
-                        //set as not installed
-                        referencedPlugins.Add(plugin);
+                    if (Directory.Exists(Path.Combine(_pluginFolder.FullName, copy.Name)))
                         continue;
-                    }
-
-                    //some validation
-                    if (string.IsNullOrWhiteSpace(plugin.SystemName))
-                        throw new Exception($"The plugin '{plugin.SystemName}' has no system name.");
-                    if (referencedPlugins.Contains(plugin))
-                        throw new Exception($"The plugin with '{plugin.SystemName}' system name is already defined");
-
-                    //set 'Installed' property
-                    plugin.Installed = installedPluginSystemNames
-                        .FirstOrDefault(x => x.Equals(plugin.SystemName, StringComparison.OrdinalIgnoreCase)) != null;
 
+                    _logger.LogInformation("Deleting the shadow copy of the removed plugin folder {FolderName}", copy.Name);
                     try
                     {
-                        if (!_config.PluginShadowCopy)
-                        {
-                            //remove deps.json files 
-                            var depsFiles =
-                                plugin.OriginalAssemblyFile.Directory!.GetFiles("*.deps.json",
-                                    SearchOption.TopDirectoryOnly);
-                            foreach (var f in depsFiles)
-                                try
-                                {
-                                    File.Delete(f.FullName);
-                                }
-                                catch (Exception exc)
-                                {
-                                    _logger.LogError(exc, "PluginManager");
-                                }
-                        }
-
-                        //controllers and views only for an installed plugin - an uninstalled one must not be routable
-                        if (plugin.Installed)
-                            AddApplicationPart(mvcCoreBuilder, plugin.ReferencedAssembly, plugin.SystemName,
-                                plugin.PluginFileName);
-
-                        //register interface for IPlugin - also when not installed, Install resolves it from DI
-                        RegisterPluginInterface(mvcCoreBuilder, plugin.ReferencedAssembly);
-
-                        //init plugin type
-                        foreach (var t in plugin.ReferencedAssembly.GetTypes())
-                            if (typeof(IPlugin).IsAssignableFrom(t))
-                                if (!t.GetTypeInfo().IsInterface)
-                                    if (t.GetTypeInfo().IsClass && !t.GetTypeInfo().IsAbstract)
-                                    {
-                                        plugin.PluginType = t;
-                                        break;
-                                    }
-
-                        referencedPlugins.Add(plugin);
+                        copy.Delete(true);
                     }
-                    catch (ReflectionTypeLoadException ex)
+                    catch (Exception exc) when (exc is IOException or UnauthorizedAccessException)
                     {
-                        var msg = $"Plugin '{plugin.FriendlyName}'. ";
-                        msg = ex.LoaderExceptions.Aggregate(msg,
-                            (current, e) => current + e!.Message + Environment.NewLine);
-
-                        var fail = new Exception(msg, ex);
-                        throw fail;
+                        _logger.LogWarning(exc, "Shadow copy {FullName} could not be deleted", copy.FullName);
                     }
-                    catch (Exception ex)
+                }
+
+                //clear out the files of the flat layout older versions shadow copied to
+                foreach (var f in _copyFolder.GetFiles("*", SearchOption.TopDirectoryOnly))
+                {
+                    _logger.LogInformation("Deleting {FName}", f.Name);
+                    try
                     {
-                        var msg = $"Plugin '{plugin.FriendlyName}'. {ex.Message}";
+                        var fileName = Path.GetFileName(f.FullName);
+                        if (fileName.Equals("index.htm", StringComparison.OrdinalIgnoreCase))
+                            continue;
 
-                        var fail = new Exception(msg, ex);
-                        throw fail;
+                        File.Delete(f.FullName);
+                    }
+                    catch (Exception exc)
+                    {
+                        _logger.LogError(exc, "PluginManager");
                     }
                 }
             }
-            catch (Exception ex)
+
+            //plan from metadata first: nothing is loaded for a folder that cannot be loaded
+            var hostAssemblyNames = HostAssemblyNames();
+            var scan = PluginFolderScanner.Scan(_pluginFolder, _config.PluginSkipLoadingPattern, hostAssemblyNames);
+            foreach (var warning in scan.Warnings)
+                _logger.LogWarning("{PluginWarning}", warning);
+
+            //before anything is loaded or shadow copied: the plugin folders as found
+            LoadSnapshot = PluginLoadSnapshot.Capture(_pluginFolder, scan, installedPluginSystemNames,
+                string.IsNullOrEmpty(_config.InstalledPlugins) ? PluginPaths.Instance.InstalledPluginsFile : null,
+                _config.PluginSkipLoadingPattern);
+
+            var referencedPlugins = new List<PluginInfo>();
+
+            _createContext = createContext;
+            _hostAssemblyNames = hostAssemblyNames;
+            _prepareFolder = _config.PluginShadowCopy ? ShadowCopyFolder : candidate => candidate.Folder;
+            _useLiteDb = dbConfig.UseLiteDb;
+
+            foreach (var candidate in scan.Plugins)
             {
-                var msg = string.Empty;
-                for (var e = ex; e != null; e = e.InnerException)
-                    msg += e.Message + Environment.NewLine;
+                if (candidate.Manifest.SupportedVersion != GrandVersion.SupportedPluginVersion)
+                {
+                    _logger.LogInformation("Incompatible plugin {PluginSystemName}", candidate.Manifest.SystemName);
+                    //listed as not installed, and not loaded
+                    referencedPlugins.Add(PluginLoader.Describe(candidate, false));
+                    continue;
+                }
+
+                var installed = installedPluginSystemNames.Contains(candidate.Manifest.SystemName,
+                    StringComparer.OrdinalIgnoreCase);
+                if (!installed)
+                {
+                    //listed from its manifest; nothing of it is loaded until it is installed (LoadForInstall)
+                    var listed = PluginLoader.Describe(candidate, false);
+                    listed.Candidate = candidate;
+                    referencedPlugins.Add(listed);
+                    continue;
+                }
+
+                var plugin = PluginLoader.Load(candidate, true, ContextFactory(candidate), _prepareFolder);
+                referencedPlugins.Add(plugin);
+
+                //controllers and views only for an installed plugin - an uninstalled one must not be routable
+                if (plugin.LoadError == null)
+                {
+                    var error = AddApplicationPart(mvcCoreBuilder, plugin);
+                    if (error != null)
+                    {
+                        plugin.LoadError = error;
+                        plugin.PluginType = null;
+                        plugin.ReferencedAssembly = null;
+                    }
+                }
+
+                if (plugin.LoadError != null)
+                {
+                    _logger.LogError("Plugin folder {PluginFolder} could not be loaded: {LoadError}",
+                        candidate.Folder.Name, plugin.LoadError);
+                    continue;
+                }
+
+                //register the plugin class; one loaded later to be installed is created without DI
+                mvcCoreBuilder.Services.AddScoped(plugin.PluginType);
+            }
 
-                var fail = new Exception(msg, ex);
-                throw fail;
+            //after the loaded plugins: a lookup by a system name a second folder duplicates finds the working one.
+            //The installed plugin of such a name is that folder's, so the second folder is not listed installed
+            var listedSystemNames = referencedPlugins.Select(x => x.SystemName).ToHashSet(StringComparer.OrdinalIgnoreCase);
+            var installedNotListed = installedPluginSystemNames.Where(x => !listedSystemNames.Contains(x)).ToList();
+            foreach (var problem in scan.Problems)
+            {
+                _logger.LogError("Plugin folder {PluginFolder} could not be loaded: {LoadError}",
+                    problem.Folder, problem.Message);
+                referencedPlugins.AddRange(PluginLoader.DescribeProblem(problem, installedNotListed));
             }
 
             ReferencedPlugins = referencedPlugins;
+
+            PluginLoader.ThrowOnLoadError(referencedPlugins, scan.Problems, _config.FailOnPluginLoadError);
+        }
+    }
+
+    /// <summary>
+    ///     Loads a plugin that was listed without being loaded (an uninstalled one), so it can be installed by the
+    ///     running process: into a context of its own, as <see cref="Load" /> would, with its LiteDB mappers built.
+    ///     Its startup classes, handlers and controllers are registered by the restart that follows the install, and
+    ///     until then it stays not installed, so it contributes no types to any scan.
+    ///     Does nothing for a plugin already loaded, failed or with nothing to load; safe from concurrent requests.
+    ///     Never throws because of the plugin: its fault becomes <see cref="PluginInfo.LoadError" />.
+    /// </summary>
+    public static PluginInfo LoadForInstall(PluginInfo plugin)
+    {
+        ArgumentNullException.ThrowIfNull(plugin);
+
+        lock (_synLock)
+        {
+            var candidate = plugin.Candidate;
+            if (plugin.ReferencedAssembly != null || plugin.LoadError != null || candidate == null ||
+                _createContext == null)
+                return plugin;
+
+            _logger?.LogInformation("Loading plugin {PluginSystemName} to install it", plugin.SystemName);
+            var loaded = PluginLoader.Load(candidate, plugin.Installed, ContextFactory(candidate), _prepareFolder);
+            //warming here races with concurrent LiteDB reads: every entity mapper lives in one shared
+            //BsonMapper.Global dictionary, read without a lock, so a request reading any type while these few
+            //inserts run can fail. Accepted: the window is a few inserts during an admin-initiated install, and
+            //the alternative is a restart before Install. On MongoDB none of this applies.
+            if (loaded.LoadError == null && _useLiteDb)
+                loaded.LoadError = WarmLiteDbMappers(loaded);
+
+            plugin.PluginFileName = loaded.PluginFileName;
+            plugin.AssemblyNames = loaded.AssemblyNames;
+            plugin.LoadContext = loaded.LoadContext;
+            plugin.LoadError = loaded.LoadError;
+            plugin.Candidate = null;
+            if (loaded.LoadError != null)
+            {
+                _logger?.LogError("Plugin {PluginSystemName} could not be loaded: {LoadError}", plugin.SystemName,
+                    loaded.LoadError);
+                return plugin;
+            }
+
+            plugin.PluginType = loaded.PluginType;
+            //last: a request that sees the assembly skips the lock and reads the type
+            plugin.ReferencedAssembly = loaded.ReferencedAssembly;
+            return plugin;
         }
     }
 
@@ -197,7 +286,8 @@ public static PluginInfo FindPlugin(Type typeAssembly)
     }
 
     /// <summary>
-    ///     Find the plugin an assembly belongs to
+    ///     Find the plugin an assembly belongs to: the plugin whose load context holds it, or, for an assembly
+    ///     outside every plugin's context, the plugin with that main assembly or shipping an assembly of that name
     /// </summary>
     /// <param name="assembly">Assembly</param>
     /// <returns>Plugin descriptor if exists; otherwise null</returns>
@@ -205,10 +295,30 @@ public static PluginInfo FindPlugin(Assembly assembly)
     {
         ArgumentNullException.ThrowIfNull(assembly);
 
-        return ReferencedPlugins?.FirstOrDefault(plugin => plugin.ReferencedAssembly != null
-                                                           && plugin.ReferencedAssembly.FullName!.Equals(
-                                                               assembly.FullName,
-                                                               StringComparison.OrdinalIgnoreCase));
+        var plugins = ReferencedPlugins?.ToList();
+        if (plugins == null)
+            return null;
+
+        var name = assembly.GetName().Name;
+        return OwnerOf(assembly, plugins)
+               ?? plugins.FirstOrDefault(plugin => plugin.ReferencedAssembly != null
+                                                   && plugin.ReferencedAssembly.FullName!.Equals(assembly.FullName,
+                                                       StringComparison.OrdinalIgnoreCase))
+               ?? plugins.FirstOrDefault(plugin =>
+                   plugin.AssemblyNames.Contains(name, StringComparer.OrdinalIgnoreCase));
+    }
+
+    /// <summary>
+    ///     The plugin whose own load context holds the assembly; null for an assembly of the default context or
+    ///     of a context no plugin owns
+    /// </summary>
+    internal static PluginInfo OwnerOf(Assembly assembly, IEnumerable<PluginInfo> plugins)
+    {
+        var context = AssemblyLoadContext.GetLoadContext(assembly);
+        if (context == null || context == AssemblyLoadContext.Default || plugins == null)
+            return null;
+
+        return plugins.FirstOrDefault(plugin => ReferenceEquals(plugin.LoadContext, context));
     }
 
 
@@ -226,176 +336,135 @@ public static void ClearPlugins()
 
     #region Utilities
 
-    private static IList<PluginInfo> GetPluginInfo()
+    /// <summary>
+    ///     Simple names of the assemblies the application itself provides (its trusted platform assemblies and
+    ///     whatever the default context has loaded); a plugin's copy of one is never loaded
+    /// </summary>
+    internal static HashSet<string> HostAssemblyNames()
     {
-        ArgumentNullException.ThrowIfNull(_pluginFolder);
-
-        var result = new List<PluginInfo>();
-        foreach (var pluginFile in _pluginFolder.GetFiles("*.dll", SearchOption.AllDirectories))
-        {
-            if (!IsPackagePluginFolder(pluginFile.Directory))
-                continue;
-
-            if (!string.IsNullOrEmpty(_config.PluginSkipLoadingPattern)
-                && Matches(pluginFile.Name, _config.PluginSkipLoadingPattern))
-                continue;
-
-            //prepare plugin info
-            var plugins = PreparePluginInfo(pluginFile);
-            if (plugins == null)
-                continue;
-
-            result.Add(plugins);
-        }
+        var trusted = AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES") as string ?? string.Empty;
+        var names = trusted.Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries)
+            .Select(Path.GetFileNameWithoutExtension)
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        names.UnionWith(AssemblyLoadContext.Default.Assemblies
+            .Select(x => x.GetName().Name)
+            .Where(x => !string.IsNullOrEmpty(x)));
+        return names;
+    }
 
-        return result;
+    /// <summary>
+    ///     Creates the candidate's own context once its folder is prepared and its main assembly path is known
+    /// </summary>
+    private static Func<string, AssemblyLoadContext> ContextFactory(PluginCandidate candidate)
+    {
+        var createContext = _createContext;
+        var hostAssemblyNames = _hostAssemblyNames;
+        return mainAssemblyPath => createContext(candidate.Manifest.SystemName, mainAssemblyPath, hostAssemblyNames);
     }
 
-    private static PluginInfo PreparePluginInfo(FileInfo pluginFile)
+    /// <summary>
+    ///     Builds the mappers of the plugin's entities before its install uses them. LiteDB mappers are not safe to
+    ///     build while requests read them (see <see cref="LiteDBMapperWarmup" />), and requests are running here:
+    ///     see the accepted race at the call site. Returns the error, if any.
+    /// </summary>
+    private static string WarmLiteDbMappers(PluginInfo plugin)
     {
-        var plug = _config.PluginShadowCopy
-            ? ShadowCopyFile(pluginFile, Directory.CreateDirectory(_copyFolder.FullName))
-            : pluginFile;
-
-        var assembly = AssemblyLoadContext.Default.LoadFromAssemblyPath(plug.FullName);
-
-        var pluginInfo = assembly.GetCustomAttribute<PluginInfoAttribute>();
-        if (pluginInfo == null) return null;
-
-        var plugin = new PluginInfo {
-            FriendlyName = pluginInfo.FriendlyName,
-            Group = pluginInfo.Group,
-            SystemName = pluginInfo.SystemName,
-            Version = pluginInfo.Version,
-            SupportedVersion = PluginVersionResolver.ResolveSupportedVersion(assembly, pluginInfo.SupportedVersion),
-            Author = pluginInfo.Author,
-            PluginFileName = plug.Name,
-            OriginalAssemblyFile = pluginFile,
-            ReferencedAssembly = assembly
-        };
-
-        return plugin;
+        try
+        {
+            var assemblies = plugin.LoadContext.Assemblies
+                .Where(x => plugin.AssemblyNames.Contains(x.GetName().Name, StringComparer.OrdinalIgnoreCase))
+                .ToList();
+            LiteDBMapperWarmup.Warm(new TypeSearcher().ClassesOfType(typeof(BaseEntity), assemblies));
+            return null;
+        }
+        catch (Exception ex)
+        {
+            return ex.Message;
+        }
     }
 
     /// <summary>
-    ///     Used to initialize plugins when running in Medium Trust
+    ///     Copies the plugin's folder, as a whole, to its own folder under Plugins/bin, so the plugin is loaded from
+    ///     the copy and its own folder can be replaced while the application runs. A file is copied only when its
+    ///     size or last write time differs from the copy's. Only this plugin's copy is touched.
     /// </summary>
-    /// <param name="plug"></param>
-    /// <param name="shadowCopyPlugFolder"></param>
-    /// <returns></returns>
-    private static FileInfo ShadowCopyFile(FileInfo plug, DirectoryInfo shadowCopyPlugFolder)
+    /// <returns>The folder to load the plugin from</returns>
+    private static DirectoryInfo ShadowCopyFolder(PluginCandidate candidate)
     {
-        var shouldCopy = true;
-        var shadowCopiedPlug = new FileInfo(Path.Combine(shadowCopyPlugFolder.FullName, plug.Name));
+        var source = candidate.Folder;
+        var target = new DirectoryInfo(Path.Combine(_copyFolder.FullName, source.Name));
 
-        //check if a shadow copied file already exists and if it does, check if it's updated, if not don't copy
-        if (shadowCopiedPlug.Exists)
+        var copies = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var file in source.GetFiles("*", SearchOption.AllDirectories))
         {
-            //it's better to use LastWriteTimeUTC, but not all file systems have this property
-            //maybe it is better to compare file hash?
-            var areFilesIdentical = shadowCopiedPlug.CreationTimeUtc.Ticks >= plug.CreationTimeUtc.Ticks;
-            if (areFilesIdentical)
-            {
-                _logger.LogInformation("Not copying; files appear identical: {Name}", shadowCopiedPlug.Name);
-                return shadowCopiedPlug;
-            }
+            var copy = new FileInfo(Path.Combine(target.FullName, Path.GetRelativePath(source.FullName, file.FullName)));
+            copies.Add(copy.FullName);
+            if (copy.Exists && copy.Length == file.Length && copy.LastWriteTimeUtc == file.LastWriteTimeUtc)
+                continue;
 
-            //delete an existing file
-            _logger.LogInformation("New plugin found; Deleting the old file: {Name}", shadowCopiedPlug.Name);
-            try
-            {
-                File.Delete(shadowCopiedPlug.FullName);
-            }
-            catch (Exception ex)
-            {
-                shouldCopy = false;
-                _logger.LogError(ex, "PluginManager");
-            }
+            Directory.CreateDirectory(copy.DirectoryName!);
+            CopyFile(file, copy);
         }
 
-        if (!shouldCopy) return shadowCopiedPlug;
-        try
-        {
-            File.Copy(plug.FullName, shadowCopiedPlug.FullName, true);
-        }
-        catch (IOException)
-        {
-            _logger.LogInformation("{FullName} is locked, attempting to rename", shadowCopiedPlug.FullName);
-            //this occurs when the files are locked,
-            //for some reason devenv locks plugin files some times and for another crazy reason you are allowed to rename them
-            //which releases the lock, so that it what we are doing here, once it's renamed, we can re-shadow copy
+        //what the plugin no longer ships, so its context cannot resolve it
+        foreach (var stale in target.GetFiles("*", SearchOption.AllDirectories).Where(x => !copies.Contains(x.FullName)))
             try
             {
-                var oldFile = shadowCopiedPlug.FullName + Guid.NewGuid().ToString("N") + ".old";
-                File.Move(shadowCopiedPlug.FullName, oldFile);
+                stale.Delete();
             }
-            catch (IOException exc)
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
             {
-                throw new IOException(shadowCopiedPlug.FullName + " rename failed, cannot initialize plugin", exc);
+                _logger.LogWarning(ex, "Stale shadow copy {FullName} could not be deleted", stale.FullName);
             }
 
-            //ok, we've made it this far, now retry the shadow copy
-            File.Copy(plug.FullName, shadowCopiedPlug.FullName, true);
-        }
-
-        return shadowCopiedPlug;
+        return target;
     }
 
-    private static bool Matches(string fullName, string pattern)
-    {
-        return Regex.IsMatch(fullName, pattern, RegexOptions.IgnoreCase | RegexOptions.Compiled, TimeSpan.FromSeconds(1));
-    }
-
-    private static void AddApplicationPart(IMvcCoreBuilder mvcCoreBuilder,
-        Assembly assembly, string systemName, string filename)
+    private static void CopyFile(FileInfo source, FileInfo copy)
     {
         try
         {
-            //we can now register the plugin definition
-            _logger.LogInformation("Adding to ApplicationParts: '{0}'", systemName);
-            mvcCoreBuilder.AddApplicationPart(assembly);
-
-            var relatedAssemblies = RelatedAssemblyAttribute.GetRelatedAssemblies(assembly, false);
-            foreach (var relatedAssembly in relatedAssemblies)
-            {
-                var applicationPartFactory = ApplicationPartFactory.GetApplicationPartFactory(relatedAssembly);
-                foreach (var part in applicationPartFactory.GetApplicationParts(relatedAssembly))
-                    mvcCoreBuilder.PartManager.ApplicationParts.Add(part);
-            }
+            File.Copy(source.FullName, copy.FullName, true);
         }
-        catch (Exception ex)
+        catch (IOException) when (copy.Exists)
         {
-            _logger.LogError(ex, "PluginManager");
-            throw new InvalidOperationException(
-                $"The plugin directory for the {systemName} file exists in a folder outside of the allowed grandnode folder hierarchy - exception because of {filename} - exception: {ex.Message}");
+            //a copy in use (another process still running from it, or a debugger) cannot be overwritten, but it
+            //can be renamed, which frees its name; the renamed file is removed as stale by a later start
+            _logger.LogInformation("{FullName} is locked, attempting to rename", copy.FullName);
+            File.Move(copy.FullName, copy.FullName + "." + Guid.NewGuid().ToString("N") + ".old");
+            File.Copy(source.FullName, copy.FullName, true);
         }
+
+        //compared on the next start; not every file system keeps it on copy
+        File.SetLastWriteTimeUtc(copy.FullName, source.LastWriteTimeUtc);
     }
 
-    private static void RegisterPluginInterface(IMvcCoreBuilder mvcCoreBuilder, Assembly assembly)
+    /// <summary>
+    ///     Adds the plugin's controllers and views; returns the error when its parts cannot be read
+    /// </summary>
+    private static string AddApplicationPart(IMvcCoreBuilder mvcCoreBuilder, PluginInfo plugin)
     {
         try
         {
-            foreach (var t in assembly.GetTypes())
-                if (typeof(IPlugin).IsAssignableFrom(t))
-                    mvcCoreBuilder.Services.AddScoped(t);
+            //we can now register the plugin definition
+            _logger.LogInformation("Adding to ApplicationParts: '{0}'", plugin.SystemName);
+
+            //related parts are read first, so a failure adds nothing
+            var relatedParts = RelatedAssemblyAttribute.GetRelatedAssemblies(plugin.ReferencedAssembly, false)
+                .SelectMany(x => ApplicationPartFactory.GetApplicationPartFactory(x).GetApplicationParts(x))
+                .ToList();
+
+            mvcCoreBuilder.AddApplicationPart(plugin.ReferencedAssembly);
+            foreach (var part in relatedParts)
+                mvcCoreBuilder.PartManager.ApplicationParts.Add(part);
+
+            return null;
         }
         catch (Exception ex)
         {
-            _logger.LogError(ex, "RegisterPluginInterface");
+            return ex.Message;
         }
     }
 
-    /// <summary>
-    ///     Determines if the folder is a bin plugin folder for a package
-    /// </summary>
-    /// <param name="folder"></param>
-    /// <returns></returns>
-    private static bool IsPackagePluginFolder(DirectoryInfo folder)
-    {
-        if (folder == null) return false;
-        if (folder.Name.Equals("bin", StringComparison.InvariantCultureIgnoreCase)) return false;
-        return folder.Parent != null && folder.Parent.Name.Equals("Plugins", StringComparison.OrdinalIgnoreCase);
-    }
-
     #endregion
 }
\ No newline at end of file
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManifest.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManifest.cs
new file mode 100644
index 0000000000..432c41fa80
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManifest.cs
@@ -0,0 +1,15 @@
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     The <see cref="PluginInfoAttribute" /> values of a plugin assembly, read without loading it.
+/// </summary>
+/// <param name="SupportedVersion">
+///     Already resolved by <see cref="PluginVersionResolver" />; null when it cannot be determined.
+/// </param>
+public sealed record PluginManifest(
+    string SystemName,
+    string FriendlyName,
+    string Group,
+    string Author,
+    string Version,
+    string SupportedVersion);
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs
new file mode 100644
index 0000000000..dfa9ecd1bd
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs
@@ -0,0 +1,147 @@
+using System.Reflection.Metadata;
+using System.Reflection.PortableExecutable;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     Reads <see cref="PluginInfoAttribute" /> from assembly metadata. The assembly is never loaded,
+///     so a broken plugin cannot affect the process while it is still being inspected.
+/// </summary>
+public static class PluginManifestReader
+{
+    private const string CoreAssemblyName = "Grand.Infrastructure";
+    private const string AttributeNamespace = "Grand.Infrastructure.Plugins";
+    private const string AttributeName = nameof(PluginInfoAttribute);
+
+    /// <summary>
+    ///     True when the file is a managed assembly (it carries CLI metadata). A file that is not a
+    ///     PE image is not managed; a file that cannot be read throws.
+    /// </summary>
+    /// <exception cref="IOException">The file cannot be opened or read</exception>
+    /// <exception cref="UnauthorizedAccessException">The file cannot be opened</exception>
+    public static bool IsManagedAssembly(string path)
+    {
+        using var stream = File.OpenRead(path);
+        using var peReader = new PEReader(stream);
+        return HasMetadata(peReader);
+    }
+
+    /// <summary>
+    ///     Returns the manifest of a plugin assembly, or null for a non-managed file or an assembly
+    ///     without <see cref="PluginInfoAttribute" />.
+    /// </summary>
+    /// <exception cref="IOException">The file cannot be opened or read</exception>
+    /// <exception cref="UnauthorizedAccessException">The file cannot be opened</exception>
+    /// <exception cref="BadImageFormatException">The attribute cannot be decoded</exception>
+    public static PluginManifest Read(string assemblyPath)
+    {
+        using var stream = File.OpenRead(assemblyPath);
+        using var peReader = new PEReader(stream);
+        if (!HasMetadata(peReader))
+            return null;
+
+        var reader = peReader.GetMetadataReader();
+        var provider = new StringTypeProvider();
+        foreach (var handle in reader.GetAssemblyDefinition().GetCustomAttributes())
+        {
+            var attribute = reader.GetCustomAttribute(handle);
+            if (!IsPluginInfoAttribute(reader, attribute.Constructor))
+                continue;
+
+            var named = new Dictionary<string, string>(StringComparer.Ordinal);
+            foreach (var argument in attribute.DecodeValue(provider).NamedArguments)
+                if (!named.TryAdd(argument.Name!, argument.Value as string))
+                    throw new BadImageFormatException(
+                        $"The PluginInfo attribute of '{Path.GetFileName(assemblyPath)}' sets {argument.Name} more than once.");
+
+            return new PluginManifest(
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.SystemName)),
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.FriendlyName)),
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.Group)),
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.Author)),
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.Version)),
+                PluginVersionResolver.ResolveSupportedVersion(GetCoreReference(reader),
+                    named.GetValueOrDefault(nameof(PluginInfoAttribute.SupportedVersion))));
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    ///     A file whose headers are not a PE image (a native dll stub, random bytes) has no metadata.
+    /// </summary>
+    private static bool HasMetadata(PEReader peReader)
+    {
+        try
+        {
+            return peReader.HasMetadata;
+        }
+        catch (BadImageFormatException)
+        {
+            return false;
+        }
+    }
+
+    private static Version GetCoreReference(MetadataReader reader)
+    {
+        foreach (var handle in reader.AssemblyReferences)
+        {
+            var reference = reader.GetAssemblyReference(handle);
+            if (string.Equals(reader.GetString(reference.Name), CoreAssemblyName, StringComparison.OrdinalIgnoreCase))
+                return reference.Version;
+        }
+
+        return null;
+    }
+
+    private static bool IsPluginInfoAttribute(MetadataReader reader, EntityHandle constructor)
+    {
+        StringHandle ns, name;
+        switch (constructor.Kind)
+        {
+            case HandleKind.MemberReference:
+                var member = reader.GetMemberReference((MemberReferenceHandle)constructor);
+                if (member.Parent.Kind != HandleKind.TypeReference)
+                    return false;
+                var typeRef = reader.GetTypeReference((TypeReferenceHandle)member.Parent);
+                ns = typeRef.Namespace;
+                name = typeRef.Name;
+                break;
+            case HandleKind.MethodDefinition:
+                var method = reader.GetMethodDefinition((MethodDefinitionHandle)constructor);
+                var typeDef = reader.GetTypeDefinition(method.GetDeclaringType());
+                ns = typeDef.Namespace;
+                name = typeDef.Name;
+                break;
+            default:
+                return false;
+        }
+
+        return reader.StringComparer.Equals(ns, AttributeNamespace) &&
+               reader.StringComparer.Equals(name, AttributeName);
+    }
+
+    /// <summary>
+    ///     Only string-valued named arguments are needed, so every type maps to its name.
+    /// </summary>
+    private sealed class StringTypeProvider : ICustomAttributeTypeProvider<string>
+    {
+        public string GetPrimitiveType(PrimitiveTypeCode typeCode) => typeCode.ToString();
+
+        public string GetSystemType() => "System.Type";
+
+        public string GetSZArrayType(string elementType) => elementType + "[]";
+
+        public string GetTypeFromDefinition(MetadataReader reader, TypeDefinitionHandle handle, byte rawTypeKind) =>
+            reader.GetString(reader.GetTypeDefinition(handle).Name);
+
+        public string GetTypeFromReference(MetadataReader reader, TypeReferenceHandle handle, byte rawTypeKind) =>
+            reader.GetString(reader.GetTypeReference(handle).Name);
+
+        public string GetTypeFromSerializedName(string name) => name;
+
+        public PrimitiveTypeCode GetUnderlyingEnumType(string type) => PrimitiveTypeCode.Int32;
+
+        public bool IsSystemType(string type) => type == "System.Type";
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginPendingChange.cs b/src/Core/Grand.Infrastructure/Plugins/PluginPendingChange.cs
new file mode 100644
index 0000000000..64807d64e5
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginPendingChange.cs
@@ -0,0 +1,20 @@
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     What changed on disk since this process loaded its plugins
+/// </summary>
+public enum PluginPendingChangeKind
+{
+    Installed,
+    Uninstalled,
+    Added,
+    Removed,
+    Updated
+}
+
+/// <summary>
+///     A plugin change that takes effect after the application restarts
+/// </summary>
+/// <param name="SystemName">The plugin's system name; the folder name when the system name is not known</param>
+/// <param name="FolderName">The plugin folder; null when the plugin has no folder this process knows</param>
+public sealed record PluginPendingChange(string SystemName, string FolderName, PluginPendingChangeKind Kind);
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginVersionResolver.cs b/src/Core/Grand.Infrastructure/Plugins/PluginVersionResolver.cs
index c525b02858..60b56e5996 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginVersionResolver.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginVersionResolver.cs
@@ -22,14 +22,24 @@ public static class PluginVersionResolver
     /// </returns>
     public static string ResolveSupportedVersion(Assembly pluginAssembly, string declaredVersion)
     {
-        if (!string.IsNullOrWhiteSpace(declaredVersion))
-            return declaredVersion.Trim();
-
         var coreReference = pluginAssembly?.GetReferencedAssemblies()
             .FirstOrDefault(x => string.Equals(x.Name, CoreAssemblyName, StringComparison.OrdinalIgnoreCase));
 
-        return coreReference?.Version == null
+        return ResolveSupportedVersion(coreReference?.Version, declaredVersion);
+    }
+
+    /// <summary>
+    ///     Same rule as the <see cref="Assembly" /> overload, for callers that read the reference from metadata.
+    /// </summary>
+    /// <param name="coreReference">The version of the plugin's Grand.Infrastructure reference, if it has one</param>
+    /// <param name="declaredVersion">The version declared on <see cref="PluginInfoAttribute" />, if any</param>
+    public static string ResolveSupportedVersion(Version coreReference, string declaredVersion)
+    {
+        if (!string.IsNullOrWhiteSpace(declaredVersion))
+            return declaredVersion.Trim();
+
+        return coreReference == null
             ? null
-            : $"{coreReference.Version.Major}.{coreReference.Version.Minor}";
+            : $"{coreReference.Major}.{coreReference.Minor}";
     }
 }
diff --git a/src/Core/Grand.Infrastructure/Startup/StartupApplication.cs b/src/Core/Grand.Infrastructure/Startup/StartupApplication.cs
index 277f1e0cc8..2a7d2351aa 100644
--- a/src/Core/Grand.Infrastructure/Startup/StartupApplication.cs
+++ b/src/Core/Grand.Infrastructure/Startup/StartupApplication.cs
@@ -5,7 +5,6 @@
 using Grand.Domain;
 using Grand.Infrastructure.Audit;
 using Grand.Infrastructure.Configuration;
-using Grand.Infrastructure.Plugins;
 using Grand.Infrastructure.TypeSearch;
 using LiteDB;
 using Microsoft.AspNetCore.Builder;
@@ -87,13 +86,9 @@ private void RegisterDataLayer(IServiceCollection serviceCollection, IConfigurat
         }
         else
         {
-            //the mappers are not safe to build concurrently - startup is still single-threaded here
-            var typeSearcher = new TypeSearcher();
-            //an uninstalled plugin counts too: installing it uses its entities on the running site
-            var plugins = PluginManager.ReferencedPlugins?.Where(x => x.PluginType != null)
-                .Select(x => x.ReferencedAssembly) ?? [];
-            LiteDBMapperWarmup.Warm(
-                typeSearcher.ClassesOfType(typeof(BaseEntity), typeSearcher.GetAssemblies().Union(plugins)));
+            //the mappers are not safe to build concurrently - startup is still single-threaded here; a plugin
+            //loaded later to be installed builds its own (PluginManager.LoadForInstall)
+            LiteDBMapperWarmup.Warm(new TypeSearcher().ClassesOfType(typeof(BaseEntity)));
             //database context
             serviceCollection.AddScoped<IDatabaseContext, LiteDBContext>();
             //store files context - grid fs
diff --git a/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs b/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
index cc0924e30e..ec0ba85443 100644
--- a/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
+++ b/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
@@ -1,7 +1,11 @@
-using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Modules;
+using Grand.Infrastructure.Plugins;
 using Grand.Infrastructure.Roslyn;
+using System.Collections.Concurrent;
+using System.Collections.ObjectModel;
 using System.Diagnostics;
 using System.Reflection;
+using System.Runtime.Loader;
 
 namespace Grand.Infrastructure.TypeSearch;
 
@@ -13,9 +17,41 @@ public class TypeSearcher : ITypeSearcher
 {
     #region Utilities
 
+    //Shared by every instance, because TypeSearcher is created in many places during startup.
+    //Loaded assemblies are never unloaded, so their types are read once.
+    private static readonly ConcurrentDictionary<Assembly, Type[]> TypesByAssembly = new();
+
+    private sealed record AssemblySnapshot(
+        int AppDomainAssemblyCount,
+        IEnumerable<PluginInfo> ReferencedPlugins,
+        IEnumerable<ResultCompiler> ReferencedScripts,
+        IList<Assembly> Assemblies);
+
+    //Replaced as a whole, never mutated. A race only costs one redundant recomputation.
+    private static volatile AssemblySnapshot _snapshot;
+
+    private static IList<Assembly> CachedAssemblies()
+    {
+        var count = AppDomain.CurrentDomain.GetAssemblies().Length;
+        var plugins = PluginManager.ReferencedPlugins;
+        var scripts = RoslynCompiler.ReferencedScripts;
+
+        var snapshot = _snapshot;
+        if (snapshot != null && snapshot.AppDomainAssemblyCount == count &&
+            ReferenceEquals(snapshot.ReferencedPlugins, plugins) &&
+            ReferenceEquals(snapshot.ReferencedScripts, scripts))
+            return snapshot.Assemblies;
+
+        var assemblies = new ReadOnlyCollection<Assembly>(AssembliesInAppDomain());
+        _snapshot = new AssemblySnapshot(count, plugins, scripts, assemblies);
+        return assemblies;
+    }
+
     private static IList<Assembly> AssembliesInAppDomain()
     {
-        var addedAssemblyNames = new List<string>();
+        //one assembly per load context: plugins shipping the same library each load their own copy, and each
+        //plugin's code uses the types of its own
+        var addedAssemblies = new HashSet<(AssemblyLoadContext, string)>();
         var assemblies = new List<Assembly>();
         var currentAssem = Assembly.GetExecutingAssembly();
         foreach (var assembly in AppDomain.CurrentDomain.GetAssemblies())
@@ -24,11 +60,14 @@ private static IList<Assembly> AssembliesInAppDomain()
             var referencedAssemblies = assembly.GetReferencedAssemblies().ToList();
             if (referencedAssemblies.All(x => x.FullName != currentAssem.FullName) &&
                 product?.Product != "grandnode") continue;
-            if (addedAssemblyNames.Contains(assembly.FullName)) continue;
+            var key = (AssemblyLoadContext.GetLoadContext(assembly), assembly.FullName);
+            if (addedAssemblies.Contains(key)) continue;
             //an uninstalled plugin contributes no types to any scan
             if (!PluginExtensions.OnlyInstalledPlugins(assembly)) continue;
+            //nor does a module that failed to load; its types may not even resolve
+            if (ModuleLoader.IsFailedModule(assembly)) continue;
             assemblies.Add(assembly);
-            addedAssemblyNames.Add(assembly.FullName);
+            addedAssemblies.Add(key);
         }
 
         //add scripts
@@ -36,9 +75,10 @@ private static IList<Assembly> AssembliesInAppDomain()
         foreach (var scripts in RoslynCompiler.ReferencedScripts)
         {
             if (string.IsNullOrEmpty(scripts.ReferencedAssembly.FullName)) continue;
-            if (addedAssemblyNames.Contains(scripts.ReferencedAssembly.FullName)) continue;
+            var key = (AssemblyLoadContext.GetLoadContext(scripts.ReferencedAssembly), scripts.ReferencedAssembly.FullName);
+            if (addedAssemblies.Contains(key)) continue;
             assemblies.Add(scripts.ReferencedAssembly);
-            addedAssemblyNames.Add(scripts.ReferencedAssembly.FullName);
+            addedAssemblies.Add(key);
         }
 
         return assemblies;
@@ -65,7 +105,7 @@ public IEnumerable<Type> ClassesOfType(Type assignTypeFrom, IEnumerable<Assembly
         {
             foreach (var assembly in assemblies)
             {
-                var types = assembly.GetTypes()
+                var types = TypesByAssembly.GetOrAdd(assembly, static a => a.GetTypes())
                     .Where(type =>
                         (assignTypeFrom.IsAssignableFrom(type) ||
                          (assignTypeFrom.IsGenericTypeDefinition && DoesTypeImplementOpenGeneric(type, assignTypeFrom))) &&
@@ -115,7 +155,7 @@ select genericTypeDefinition.IsAssignableFrom(implementedInterface.GetGenericTyp
     /// <returns>A list of assemblies that should be loaded by the Grand factory.</returns>
     public virtual IList<Assembly> GetAssemblies()
     {
-        return AssembliesInAppDomain();
+        return CachedAssemblies();
     }
 
     #endregion
diff --git a/src/Modules/Grand.Module.Scim/Grand.Module.Scim.csproj b/src/Modules/Grand.Module.Scim/Grand.Module.Scim.csproj
index bef073f488..e980a0455a 100644
--- a/src/Modules/Grand.Module.Scim/Grand.Module.Scim.csproj
+++ b/src/Modules/Grand.Module.Scim/Grand.Module.Scim.csproj
@@ -12,6 +12,14 @@
             <Private>False</Private>
 			<ExcludeAssets>runtime</ExcludeAssets>
         </ProjectReference>
+		<ProjectReference Include="..\..\Core\Grand.Mapping\Grand.Mapping.csproj">
+			<Private>False</Private>
+			<ExcludeAssets>runtime</ExcludeAssets>
+		</ProjectReference>
+		<ProjectReference Include="..\..\Core\Grand.Mediator\Grand.Mediator.csproj">
+			<Private>False</Private>
+			<ExcludeAssets>runtime</ExcludeAssets>
+		</ProjectReference>
 		<ProjectReference Include="..\..\Core\Grand.Infrastructure\Grand.Infrastructure.csproj">
             <Private>False</Private>
 			<ExcludeAssets>runtime</ExcludeAssets>
diff --git a/src/Plugins/Shipping.ByWeight/ByWeightShippingProvider.cs b/src/Plugins/Shipping.ByWeight/ByWeightShippingProvider.cs
index 77b2ca2237..4ed11e11cf 100644
--- a/src/Plugins/Shipping.ByWeight/ByWeightShippingProvider.cs
+++ b/src/Plugins/Shipping.ByWeight/ByWeightShippingProvider.cs
@@ -168,7 +168,8 @@ private async Task<double> GetTotalWeight(GetShippingOptionRequest request, bool
             var checkoutAttributes =
                 customer.GetUserFieldFromEntity<List<CustomAttribute>>(SystemCustomerFieldNames.CheckoutAttributes,
                     request.StoreId);
-            if (checkoutAttributes.Any())
+            //null until the customer chooses checkout attributes, and again once an order clears them
+            if (checkoutAttributes is { Count: > 0 })
             {
                 var attributeValues = await _checkoutAttributeParser.ParseCheckoutAttributeValues(checkoutAttributes);
                 foreach (var attributeValue in attributeValues)
diff --git a/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs
new file mode 100644
index 0000000000..552175cd81
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs
@@ -0,0 +1,210 @@
+using Grand.Infrastructure.Modules;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Grand.Mediator;
+using Grand.SharedKernel;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.ApplicationParts;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using System.Reflection;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Tests.Modules;
+
+[TestClass]
+[DoNotParallelize]
+public class ModuleLoaderTests
+{
+    private static readonly string MediatorAssemblyPath = typeof(IRequestHandler<,>).Assembly.Location;
+
+    private PluginFolderFixture _fixture;
+    private CapturingLoggerProvider _logs;
+
+    private string ContentRoot => Path.GetDirectoryName(_fixture.PluginsFolder)!;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+        _logs = new CapturingLoggerProvider();
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    public void LoadModules_HostAssemblyCopyInModuleFolder_UsesHostCopy()
+    {
+        File.Copy(MediatorAssemblyPath, Path.Combine(ModuleFolder("Grand.Module.Fake"), "Grand.Mediator.dll"));
+        AddModule("Grand.Module.Fake", """
+            public class Ping : Grand.Mediator.IRequest<string> { }
+            public class PingHandler : Grand.Mediator.IRequestHandler<Ping, string>
+            {
+                public System.Threading.Tasks.Task<string> Handle(Ping request,
+                    System.Threading.CancellationToken cancellationToken) => System.Threading.Tasks.Task.FromResult("pong");
+            }
+            """, MediatorAssemblyPath);
+
+        Load(false, "Grand.Module.Fake");
+
+        var handler = _fixture.Loaded("Grand.Module.Fake").GetType("PingHandler", true)!;
+        Assert.IsTrue(handler.GetInterfaces()
+            .Any(x => x.IsGenericType && x.GetGenericTypeDefinition() == typeof(IRequestHandler<,>)));
+        Assert.IsFalse(LoadedByModules().Any(x => x.GetName().Name == "Grand.Mediator"));
+    }
+
+    [TestMethod]
+    public void LoadModules_OnlyModuleAssemblyIsApplicationPart()
+    {
+        //a private library of the module, loaded when the module's code needs it
+        var lib = TestPluginBuilder.Compile(ModuleFolder("Grand.Module.Parts"), "Parts.Lib",
+            "namespace PartsLib { public static class Lib { public static string Value() => \"from lib\"; } }");
+        AddModule("Grand.Module.Parts", """
+            public class PartsEndpoint : Microsoft.AspNetCore.Mvc.ControllerBase { }
+            public static class Entry { public static string Run() => PartsLib.Lib.Value(); }
+            """, lib);
+
+        var mvcCoreBuilder = Load(false, "Grand.Module.Parts");
+
+        var module = _fixture.Loaded("Grand.Module.Parts");
+        CollectionAssert.AreEqual(new[] { module }, ModuleParts(mvcCoreBuilder));
+        Assert.AreEqual("from lib", module.GetType("Entry", true)!.GetMethod("Run")!.Invoke(null, null));
+    }
+
+    [TestMethod]
+    public void LoadModules_ModuleThatCannotLoad_IsLoggedCriticalAndLeftOut()
+    {
+        //its base class is in an assembly it does not ship
+        var missing = _fixture.CompileElsewhere("Broken.Missing", "namespace Missing { public class Base { } }");
+        //it uses GrandNode, so a type scan would include it
+        AddModule("Grand.Module.Broken", """
+            public class Derived : Missing.Base { }
+            public class Startup { public Grand.Infrastructure.Plugins.IPlugin Plugin; }
+            """, missing);
+        AddModule("Grand.Module.Healthy", "public class Healthy { }");
+
+        var mvcCoreBuilder = Load(false, "Grand.Module.Broken", "Grand.Module.Healthy");
+
+        Assert.IsTrue(_logs.Entries.Any(x =>
+            x.Level == LogLevel.Critical && x.Message.Contains("Grand.Module.Broken") &&
+            x.Message.Contains("Broken.Missing")));
+        var parts = ModuleParts(mvcCoreBuilder);
+        Assert.IsFalse(parts.Any(x => x.GetName().Name == "Grand.Module.Broken"));
+        Assert.IsTrue(parts.Any(x => x.GetName().Name == "Grand.Module.Healthy"));
+        //its types would fail every scan
+        Assert.IsFalse(new Infrastructure.TypeSearch.TypeSearcher().GetAssemblies().Any(x => x.GetName().Name == "Grand.Module.Broken"));
+    }
+
+    [TestMethod]
+    public void LoadModules_ModuleThatCannotLoad_FailOnPluginLoadError_Throws()
+    {
+        var missing = _fixture.CompileElsewhere("Broken.Missing", "namespace Missing { public class Base { } }");
+        AddModule("Grand.Module.Broken", "public class Derived : Missing.Base { }", missing);
+
+        var ex = Assert.Throws<GrandException>(() => Load(true, "Grand.Module.Broken"));
+        Assert.Contains("Grand.Module.Broken", ex.Message);
+    }
+
+    [TestMethod]
+    public void LoadModules_ModuleBuiltAgainstNewerHostAssembly_FailsAtStartup()
+    {
+        //the host's copy wins, and it is older than the one the module was built against; used only in a method
+        //body, so without the check the first request running it would fail
+        var newer = TestPluginBuilder.Compile(Path.Combine(ContentRoot, "newer"), "Grand.Mediator",
+            "namespace Grand.Mediator { public interface INewer { } }", new Version(99, 0, 0, 0));
+        File.Copy(newer, Path.Combine(ModuleFolder("Grand.Module.Newer"), "Grand.Mediator.dll"));
+        CompileAgainst(ModuleFolder("Grand.Module.Newer"), "Grand.Module.Newer",
+            "public static class Uses { public static object M() => typeof(Grand.Mediator.INewer); }", newer);
+
+        var mvcCoreBuilder = Load(false, "Grand.Module.Newer");
+
+        Assert.IsTrue(_logs.Entries.Any(x =>
+            x.Level == LogLevel.Critical && x.Message.Contains("Grand.Module.Newer") &&
+            x.Message.Contains("Grand.Mediator")));
+        Assert.IsFalse(ModuleParts(mvcCoreBuilder).Any());
+    }
+
+    [TestMethod]
+    public void LoadModules_LogsToTheLoggingProvidersOfTheServices()
+    {
+        //an enabled module without files: nothing is loaded, it is only logged
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string> { ["FeatureManagement:Grand.Module.Absent"] = "true" })
+            .Build();
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(ContentRoot);
+        var mvcCoreBuilder = new ServiceCollection().AddLogging(x => x.AddProvider(_logs)).AddMvcCore();
+
+        ModuleLoader.LoadModules(mvcCoreBuilder, configuration, hostEnvironment.Object);
+
+        Assert.IsTrue(_logs.Entries.Any(x =>
+            x.Category == "ModuleManager" && x.Level == LogLevel.Warning && x.Message.Contains("Grand.Module.Absent")));
+    }
+
+    private string ModuleFolder(string moduleName)
+    {
+        var folder = Path.Combine(ContentRoot, "Modules", moduleName);
+        Directory.CreateDirectory(folder);
+        return folder;
+    }
+
+    private string AddModule(string moduleName, string source, params string[] references)
+    {
+        return TestPluginBuilder.Compile(ModuleFolder(moduleName), moduleName, source, null,
+            [PluginFolderFixture.CoreAssemblyPath, .. references]);
+    }
+
+    /// <summary>
+    ///     Compiles against <paramref name="replacement" /> in place of the platform assembly of the same name
+    /// </summary>
+    private static void CompileAgainst(string outputDir, string assemblyName, string source, string replacement)
+    {
+        var replaced = Path.GetFileName(replacement);
+        var references = ((string)AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES")!)
+            .Split(Path.PathSeparator)
+            .Where(x => !string.Equals(Path.GetFileName(x), replaced, StringComparison.OrdinalIgnoreCase))
+            .Append(replacement)
+            .Select(x => MetadataReference.CreateFromFile(x));
+        var result = CSharpCompilation.Create(assemblyName, [CSharpSyntaxTree.ParseText(source)], references,
+                new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary))
+            .Emit(Path.Combine(outputDir, assemblyName + ".dll"));
+        Assert.IsTrue(result.Success, string.Join(Environment.NewLine, result.Diagnostics));
+    }
+
+    private IMvcCoreBuilder Load(bool failOnPluginLoadError, params string[] modules)
+    {
+        var settings = modules.ToDictionary(x => "FeatureManagement:" + x, _ => "true");
+        settings["Extensions:FailOnPluginLoadError"] = failOnPluginLoadError.ToString();
+        var configuration = new ConfigurationBuilder().AddInMemoryCollection(settings!).Build();
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(ContentRoot);
+        var mvcCoreBuilder = new ServiceCollection().AddMvcCore();
+
+        using var loggerFactory = LoggerFactory.Create(x => x.AddProvider(_logs));
+        ModuleLoader.LoadModules(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.CreateContext,
+            () => loggerFactory);
+        return mvcCoreBuilder;
+    }
+
+    private IEnumerable<Assembly> LoadedByModules() => _fixture.Contexts.SelectMany(x => x.Assemblies);
+
+    /// <summary>
+    ///     The application parts whose assembly a module context loaded
+    /// </summary>
+    private List<Assembly> ModuleParts(IMvcCoreBuilder mvcCoreBuilder)
+    {
+        var contexts = _fixture.Contexts;
+        return mvcCoreBuilder.PartManager.ApplicationParts.OfType<AssemblyPart>()
+            .Select(x => x.Assembly)
+            .Where(x => contexts.Contains(AssemblyLoadContext.GetLoadContext(x)))
+            .ToList();
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/CapturingLoggerProvider.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/CapturingLoggerProvider.cs
new file mode 100644
index 0000000000..333f02b6be
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/CapturingLoggerProvider.cs
@@ -0,0 +1,44 @@
+using Microsoft.Extensions.Logging;
+
+namespace Grand.Infrastructure.Tests.Plugins.Fixtures;
+
+/// <summary>
+///     Keeps every entry logged through it, for tests that check what a loader logged
+/// </summary>
+public sealed class CapturingLoggerProvider : ILoggerProvider
+{
+    private readonly List<(string Category, LogLevel Level, string Message)> _entries = [];
+
+    public IReadOnlyList<(string Category, LogLevel Level, string Message)> Entries
+    {
+        get
+        {
+            lock (_entries)
+            {
+                return _entries.ToList();
+            }
+        }
+    }
+
+    public ILogger CreateLogger(string categoryName) => new Logger(this, categoryName);
+
+    public void Dispose()
+    {
+    }
+
+    private sealed class Logger(CapturingLoggerProvider provider, string category) : ILogger
+    {
+        public IDisposable BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception exception,
+            Func<TState, Exception, string> formatter)
+        {
+            lock (provider._entries)
+            {
+                provider._entries.Add((category, logLevel, formatter(state, exception)));
+            }
+        }
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs
new file mode 100644
index 0000000000..6782219886
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs
@@ -0,0 +1,121 @@
+using Grand.Infrastructure.Plugins;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Tests.Plugins.Fixtures;
+
+/// <summary>
+///     A temporary Plugins folder for plugin loading tests, whose plugins load into collectible contexts of
+///     their own. Disposing unloads every context and removes the folder.
+/// </summary>
+public sealed class PluginFolderFixture : IDisposable
+{
+    public static readonly string CoreAssemblyPath = typeof(PluginInfoAttribute).Assembly.Location;
+    private static readonly HashSet<string> Host = new(StringComparer.OrdinalIgnoreCase) { "Grand.Infrastructure" };
+
+    private readonly string _root;
+    private readonly List<AssemblyLoadContext> _contexts = [];
+
+    public PluginFolderFixture()
+    {
+        _root = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
+        PluginsFolder = Path.Combine(_root, "Plugins");
+        Directory.CreateDirectory(PluginsFolder);
+    }
+
+    public string PluginsFolder { get; }
+
+    /// <summary>
+    ///     The contexts created so far, one per plugin loaded
+    /// </summary>
+    public IReadOnlyList<AssemblyLoadContext> Contexts
+    {
+        get
+        {
+            lock (_contexts)
+            {
+                return _contexts.ToList();
+            }
+        }
+    }
+
+    /// <summary>
+    ///     A plugin's own context, as production creates it, but collectible
+    /// </summary>
+    public AssemblyLoadContext CreateContext(string name, string mainAssemblyPath, ISet<string> hostAssemblyNames)
+    {
+        var context = new IsolatedLoadContext("plugin-tests-" + name, mainAssemblyPath, hostAssemblyNames, true);
+        lock (_contexts)
+        {
+            _contexts.Add(context);
+        }
+
+        return context;
+    }
+
+    public string Folder(string name) => Path.Combine(PluginsFolder, name);
+
+    /// <summary>
+    ///     Compiles a plugin assembly carrying <see cref="PluginInfoAttribute" /> with <paramref name="source" /> beside it.
+    /// </summary>
+    public string AddPlugin(string folder, string assemblyName, string systemName, string source = "",
+        params string[] references)
+    {
+        return TestPluginBuilder.Compile(Folder(folder), assemblyName, $$"""
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "{{systemName}}")]
+            {{source}}
+            """, null, [CoreAssemblyPath, .. references]);
+    }
+
+    /// <summary>
+    ///     Compiles an assembly outside the Plugins folder, to compile a plugin against without shipping it.
+    /// </summary>
+    public string CompileElsewhere(string assemblyName, string source)
+    {
+        return TestPluginBuilder.Compile(Path.Combine(_root, "elsewhere"), assemblyName, source);
+    }
+
+    public PluginScanResult Scan() => PluginFolderScanner.Scan(new DirectoryInfo(PluginsFolder), null, Host);
+
+    public PluginCandidate Candidate(string folder) => Scan().Plugins.Single(x => x.Folder.Name == folder);
+
+    public PluginInfo Load(string folder, bool installed)
+    {
+        var hostAssemblyNames = PluginManager.HostAssemblyNames();
+        return PluginLoader.Load(Candidate(folder), installed,
+            main => CreateContext(folder, main, hostAssemblyNames), x => x.Folder);
+    }
+
+    /// <summary>
+    ///     The one assembly of that name loaded by any of the plugins
+    /// </summary>
+    public System.Reflection.Assembly Loaded(string assemblyName) =>
+        Contexts.SelectMany(x => x.Assemblies).Single(x => x.GetName().Name == assemblyName);
+
+    /// <summary>
+    ///     The assembly of that name in the plugin's own context
+    /// </summary>
+    public static System.Reflection.Assembly Loaded(PluginInfo plugin, string assemblyName) =>
+        AssemblyLoadContext.GetLoadContext(plugin.ReferencedAssembly)!.Assemblies
+            .Single(x => x.GetName().Name == assemblyName);
+
+    public void Dispose()
+    {
+        foreach (var context in Contexts)
+            context.Unload();
+        for (var i = 0; i < 10; i++)
+        {
+            GC.Collect();
+            GC.WaitForPendingFinalizers();
+        }
+
+        try
+        {
+            Directory.Delete(_root, true);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            //a file the context still maps is released once the context is collected; the folder is in temp
+        }
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/TestPluginBuilder.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/TestPluginBuilder.cs
new file mode 100644
index 0000000000..429ff72abc
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/TestPluginBuilder.cs
@@ -0,0 +1,47 @@
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+
+namespace Grand.Infrastructure.Tests.Plugins.Fixtures;
+
+/// <summary>
+///     Compiles small assemblies to disk for plugin loading tests. The output is only ever inspected
+///     through metadata - tests must not load it into the default AssemblyLoadContext.
+/// </summary>
+public static class TestPluginBuilder
+{
+    private static readonly Lazy<IReadOnlyList<MetadataReference>> PlatformReferences = new(() =>
+        ((string)AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES")!)
+        .Split(Path.PathSeparator)
+        .Select(x => (MetadataReference)MetadataReference.CreateFromFile(x))
+        .ToList());
+
+    /// <summary>
+    ///     Compiles <paramref name="source" /> into <paramref name="outputDir" />/<paramref name="assemblyName" />.dll
+    ///     and returns the path. <paramref name="references" /> are additional assembly files to compile against.
+    /// </summary>
+    public static string Compile(string outputDir, string assemblyName, string source, Version version = null,
+        params string[] references)
+    {
+        Directory.CreateDirectory(outputDir);
+
+        var versionText = (version ?? new Version(1, 0, 0, 0)).ToString();
+        var versionSource = $"""
+                             [assembly: System.Reflection.AssemblyVersion("{versionText}")]
+                             [assembly: System.Reflection.AssemblyFileVersion("{versionText}")]
+                             """;
+
+        var compilation = CSharpCompilation.Create(
+            assemblyName,
+            [CSharpSyntaxTree.ParseText(source), CSharpSyntaxTree.ParseText(versionSource)],
+            PlatformReferences.Value.Concat(references.Select(x => MetadataReference.CreateFromFile(x))),
+            new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary));
+
+        var path = Path.Combine(outputDir, assemblyName + ".dll");
+        var result = compilation.Emit(path);
+        if (!result.Success)
+            throw new InvalidOperationException(string.Join(Environment.NewLine,
+                result.Diagnostics.Where(x => x.Severity == DiagnosticSeverity.Error)));
+
+        return path;
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs
new file mode 100644
index 0000000000..c6a603d22f
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs
@@ -0,0 +1,222 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+[DoNotParallelize]
+public class IsolatedLoadContextTests
+{
+    private PluginFolderFixture _fixture;
+    private IEnumerable<PluginInfo> _referencedPlugins;
+    private PluginLoadSnapshot _loadSnapshot;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+        _referencedPlugins = PluginManager.ReferencedPlugins;
+        _loadSnapshot = PluginManager.LoadSnapshot;
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        PluginManager.ReferencedPlugins = _referencedPlugins;
+        PluginManager.LoadSnapshot = _loadSnapshot;
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    public void TwoPlugins_DifferentDependencyVersions_BothRun()
+    {
+        var one = TestPluginBuilder.Compile(_fixture.Folder("One"), "Isolated.SharedDep", """
+            namespace SharedDep { public static class Dep { public static string Value() => "1.0"; } }
+            """, new Version(1, 0, 0, 0));
+        _fixture.AddPlugin("One", "Isolated.One", "Isolated.One", """
+            public class OnePlugin : BasePlugin { }
+            public static class Entry { public static string Run() => SharedDep.Dep.Value(); }
+            """, one);
+        var two = TestPluginBuilder.Compile(_fixture.Folder("Two"), "Isolated.SharedDep", """
+            namespace SharedDep
+            {
+                public static class Dep
+                {
+                    public static string Value() => "2.0";
+                    public static string OnlyInTwo() => "2.0 only";
+                }
+            }
+            """, new Version(2, 0, 0, 0));
+        _fixture.AddPlugin("Two", "Isolated.Two", "Isolated.Two", """
+            public class TwoPlugin : BasePlugin { }
+            public static class Entry { public static string Run() => SharedDep.Dep.OnlyInTwo(); }
+            """, two);
+
+        Load("Isolated.One,Isolated.Two");
+
+        Assert.AreEqual("1.0", Run(Plugin("Isolated.One")));
+        Assert.AreEqual("2.0 only", Run(Plugin("Isolated.Two")));
+    }
+
+    [TestMethod]
+    public void Load_HostAssemblyName_ComesFromDefaultContext()
+    {
+        _fixture.AddPlugin("Host", "Isolated.Host", "Isolated.Host", "public class HostPlugin : BasePlugin { }");
+        File.Copy(PluginFolderFixture.CoreAssemblyPath, Path.Combine(_fixture.Folder("Host"), "Grand.Infrastructure.dll"));
+
+        Load("Isolated.Host");
+
+        var plugin = Plugin("Isolated.Host");
+        Assert.IsNull(plugin.LoadError);
+        var instance = Activator.CreateInstance(plugin.PluginType);
+        Assert.IsInstanceOfType<IPlugin>(instance);
+        Assert.AreSame(typeof(IPlugin).Assembly,
+            plugin.PluginType.GetInterfaces().Single(x => x.Name == nameof(IPlugin)).Assembly);
+    }
+
+    [TestMethod]
+    public void PluginTypes_AreRecognisedByMvcApplicationPart()
+    {
+        //no Controller suffix: it is recognised only through the host's [Controller] on ControllerBase
+        _fixture.AddPlugin("Mvc", "Isolated.Mvc", "Isolated.Mvc", """
+            public class MvcPlugin : BasePlugin { }
+            public class PluginEndpoint : Microsoft.AspNetCore.Mvc.ControllerBase { }
+            """);
+
+        var mvcCoreBuilder = Load("Isolated.Mvc");
+
+        var feature = new ControllerFeature();
+        mvcCoreBuilder.PartManager.PopulateFeature(feature);
+        Assert.IsTrue(feature.Controllers.Any(x =>
+            x.Name == "PluginEndpoint" && x.Assembly == Plugin("Isolated.Mvc").ReferencedAssembly));
+    }
+
+    [TestMethod]
+    public void Load_DependencyListedInDepsJson_IsResolvedFromItsListedPath()
+    {
+        //outside the top of the folder: only the plugin's deps.json says where it is, listed the way a package's
+        //runtimes/<rid> asset is (Payments.StripeCheckout ships one)
+        var lib = TestPluginBuilder.Compile(Path.Combine(_fixture.Folder("Deps"), "lib"), "Isolated.Deps.Lib",
+            "namespace DepsLib { public static class Lib { public static string Value() => \"from lib\"; } }");
+        _fixture.AddPlugin("Deps", "Isolated.Deps", "Isolated.Deps", """
+            public class DepsPlugin : BasePlugin { }
+            public static class Entry { public static string Run() => DepsLib.Lib.Value(); }
+            """, lib);
+        File.WriteAllText(Path.Combine(_fixture.Folder("Deps"), "Isolated.Deps.deps.json"), """
+            {
+              "runtimeTarget": { "name": ".NETCoreApp,Version=v10.0" },
+              "targets": {
+                ".NETCoreApp,Version=v10.0": {
+                  "Isolated.Deps/1.0.0": {
+                    "dependencies": { "Isolated.Deps.Lib": "1.0.0" },
+                    "runtime": { "Isolated.Deps.dll": {} }
+                  },
+                  "Isolated.Deps.Lib/1.0.0": {
+                    "runtimeTargets": {
+                      "lib/Isolated.Deps.Lib.dll": { "rid": "any", "assetType": "runtime", "assemblyVersion": "1.0.0.0", "fileVersion": "1.0.0.0" }
+                    }
+                  }
+                }
+              },
+              "libraries": {
+                "Isolated.Deps/1.0.0": { "type": "project", "serviceable": false, "sha512": "" },
+                "Isolated.Deps.Lib/1.0.0": { "type": "project", "serviceable": false, "sha512": "" }
+              }
+            }
+            """);
+
+        Load("Isolated.Deps");
+
+        var plugin = Plugin("Isolated.Deps");
+        Assert.AreEqual("from lib", Run(plugin));
+        Assert.AreEqual(Path.GetFullPath(lib), PluginFolderFixture.Loaded(plugin, "Isolated.Deps.Lib").Location);
+    }
+
+    [TestMethod]
+    public void Load_AssemblyOfAnotherPlugin_IsLoadErrorNotCrash()
+    {
+        //not supported: a plugin takes nothing from another plugin's context
+        var api = _fixture.AddPlugin("Api", "Isolated.Api", "Isolated.Api", """
+            public class ApiPlugin : BasePlugin { }
+            namespace ApiTypes { public class Api { } }
+            """);
+        _fixture.AddPlugin("User", "Isolated.User", "Isolated.User", """
+            public class UserPlugin : BasePlugin { }
+            public class UsesApi : ApiTypes.Api { }
+            """, api);
+
+        Load("Isolated.Api,Isolated.User");
+
+        Assert.IsTrue(Plugin("Isolated.Api").IsActive);
+        var user = Plugin("Isolated.User");
+        Assert.IsNotNull(user.LoadError);
+        Assert.Contains("Isolated.Api", user.LoadError);
+        Assert.IsNull(user.ReferencedAssembly);
+    }
+
+    [TestMethod]
+    public void Load_AssemblyOfAnotherPluginUsedOnlyInAMethodBody_IsLoadError()
+    {
+        //GetTypes never needs it; without the check the first request running the method would fail
+        var api = _fixture.AddPlugin("Api", "Isolated.Api", "Isolated.Api", """
+            public class ApiPlugin : BasePlugin { }
+            namespace ApiTypes { public class Api { } }
+            """);
+        _fixture.AddPlugin("User", "Isolated.User", "Isolated.User", """
+            public class UserPlugin : BasePlugin { }
+            public static class Uses { public static object M() => new ApiTypes.Api(); }
+            """, api);
+
+        Load("Isolated.Api,Isolated.User");
+
+        Assert.IsTrue(Plugin("Isolated.Api").IsActive);
+        var user = Plugin("Isolated.User");
+        Assert.IsFalse(user.IsActive);
+        Assert.IsNotNull(user.LoadError);
+        Assert.Contains("Isolated.Api", user.LoadError);
+    }
+
+    [TestMethod]
+    public void FindPlugin_AssemblyInPluginsContext_FindsThePlugin()
+    {
+        _fixture.AddPlugin("Find", "Isolated.Find", "Isolated.Find", "public class FindPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(_fixture.Folder("Find"), "Isolated.Find.Core", "public class Core { }");
+
+        Load("Isolated.Find");
+
+        var plugin = Plugin("Isolated.Find");
+        Assert.AreSame(plugin, PluginManager.FindPlugin(plugin.PluginType));
+        Assert.AreSame(plugin, PluginManager.FindPlugin(PluginFolderFixture.Loaded(plugin, "Isolated.Find.Core")));
+        Assert.IsNull(PluginManager.FindPlugin(typeof(IsolatedLoadContextTests)));
+    }
+
+    private IMvcCoreBuilder Load(string installed)
+    {
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string> {
+                ["Extensions:InstalledPlugins"] = installed
+            })
+            .Build();
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(Path.GetDirectoryName(_fixture.PluginsFolder)!);
+        var mvcCoreBuilder = new ServiceCollection().AddLogging().AddMvcCore();
+
+        PluginManager.Load(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.CreateContext);
+        return mvcCoreBuilder;
+    }
+
+    private static PluginInfo Plugin(string systemName) =>
+        PluginManager.ReferencedPlugins.Single(x => x.SystemName == systemName);
+
+    private static string Run(PluginInfo plugin)
+    {
+        Assert.IsNull(plugin.LoadError);
+        return (string)plugin.ReferencedAssembly.GetType("Entry", true)!.GetMethod("Run")!.Invoke(null, null);
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
new file mode 100644
index 0000000000..95e52641c3
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
@@ -0,0 +1,370 @@
+using System.IO.Compression;
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Grand.SharedKernel;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginArchiveInstallerTests
+{
+    private static readonly string CoreAssemblyPath = typeof(PluginInfoAttribute).Assembly.Location;
+
+    private string _root;
+    private string _plugins;
+    private string _build;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _root = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
+        _plugins = Path.Combine(_root, "Plugins");
+        _build = Path.Combine(_root, "build");
+        Directory.CreateDirectory(_plugins);
+        Directory.CreateDirectory(_build);
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        if (Directory.Exists(_root))
+            Directory.Delete(_root, true);
+    }
+
+    private PluginArchiveInstaller CreateInstaller() => new(_plugins, NullLogger.Instance);
+
+    private static string Source(string systemName, string attributeExtra = "") => $$"""
+        using Grand.Infrastructure.Plugins;
+        [assembly: PluginInfo(SystemName = "{{systemName}}", FriendlyName = "Test"{{attributeExtra}})]
+        """;
+
+    /// <summary>Compiles a plugin into a fresh folder named <paramref name="folderName" /> and returns that folder.</summary>
+    private string BuildPluginFolder(string folderName, string systemName, string attributeExtra = "")
+    {
+        var folder = Path.Combine(_build, Guid.NewGuid().ToString("N"), folderName);
+        TestPluginBuilder.Compile(folder, systemName, Source(systemName, attributeExtra), null, CoreAssemblyPath);
+        return folder;
+    }
+
+    private string ZipFolder(string folder, bool includeBaseDirectory = true)
+    {
+        var zip = Path.Combine(_build, Guid.NewGuid().ToString("N") + ".zip");
+        ZipFile.CreateFromDirectory(folder, zip, CompressionLevel.Optimal, includeBaseDirectory);
+        return zip;
+    }
+
+    private string ZipEntries(params (string Name, byte[] Content)[] entries)
+    {
+        var zip = Path.Combine(_build, Guid.NewGuid().ToString("N") + ".zip");
+        using var archive = ZipFile.Open(zip, ZipArchiveMode.Create);
+        foreach (var (name, content) in entries)
+        {
+            var entry = archive.CreateEntry(name);
+            using var stream = entry.Open();
+            stream.Write(content);
+        }
+
+        return zip;
+    }
+
+    private static string Hash(string folder) => string.Join("|", Directory
+        .GetFiles(folder, "*", SearchOption.AllDirectories).Order(StringComparer.Ordinal)
+        .Select(x => Path.GetRelativePath(folder, x) + ":" + Convert.ToHexString(
+            System.Security.Cryptography.SHA256.HashData(File.ReadAllBytes(x)))));
+
+    [TestMethod]
+    public void Install_StandardPluginWithoutDeclaredVersion_Installs()
+    {
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var zip = ZipFolder(folder);
+
+        var result = CreateInstaller().Install(zip);
+
+        Assert.AreEqual("Tax.FixedRate", result.FolderName);
+        Assert.AreEqual("Tax.FixedRate", result.Manifest.SystemName);
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Tax.FixedRate.dll")));
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "TempUploads")) &&
+                       Directory.EnumerateFileSystemEntries(Path.Combine(_plugins, "TempUploads")).Any());
+    }
+
+    [TestMethod]
+    public void Install_ArchiveWithoutDirectoryEntries_Installs()
+    {
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var zip = ZipEntries(("Tax.FixedRate/Tax.FixedRate.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.FixedRate.dll"))));
+
+        CreateInstaller().Install(zip);
+
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Tax.FixedRate.dll")));
+    }
+
+    [TestMethod]
+    public void Install_BackslashEntryNames_Installs()
+    {
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var zip = ZipEntries(
+            ("Tax.FixedRate\\Tax.FixedRate.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.FixedRate.dll"))),
+            ("Tax.FixedRate\\Views\\a.txt", [1, 2, 3]));
+
+        CreateInstaller().Install(zip);
+
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Tax.FixedRate.dll")));
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Views", "a.txt")));
+    }
+
+    [TestMethod]
+    public void Install_ArchiveWrappedInPluginsFolder_Installs()
+    {
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var zip = ZipEntries(("Plugins/Tax.FixedRate/Tax.FixedRate.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.FixedRate.dll"))));
+
+        var result = CreateInstaller().Install(zip);
+
+        Assert.AreEqual("Tax.FixedRate", result.FolderName);
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Tax.FixedRate.dll")));
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Plugins")));
+    }
+
+    [TestMethod]
+    public void Install_TwoRootFolders_IsRejected()
+    {
+        var a = BuildPluginFolder("Tax.A", "Tax.A");
+        var b = BuildPluginFolder("Tax.B", "Tax.B");
+        var zip = ZipEntries(
+            ("Tax.A/Tax.A.dll", File.ReadAllBytes(Path.Combine(a, "Tax.A.dll"))),
+            ("Tax.B/Tax.B.dll", File.ReadAllBytes(Path.Combine(b, "Tax.B.dll"))));
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.A")));
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.B")));
+    }
+
+    [TestMethod]
+    public void Install_DllInSubfolderOfRoot_DoesNotTouchOtherPlugin()
+    {
+        var existing = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        File.Copy(Path.Combine(existing, "Tax.FixedRate.dll"), Path.Combine(target, "Tax.FixedRate.dll"));
+        var before = Hash(target);
+
+        var inner = BuildPluginFolder("Inner", "X");
+        var zip = ZipEntries(("Tax.FixedRate/Inner/X.dll", File.ReadAllBytes(Path.Combine(inner, "X.dll"))));
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.AreEqual(before, Hash(target));
+    }
+
+    [TestMethod]
+    public void Install_OtherVersion_IsRejected()
+    {
+        var folder = BuildPluginFolder("Tax.Old", "Tax.Old", ", SupportedVersion = \"1.0\"");
+        var zip = ZipFolder(folder);
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.Old")));
+    }
+
+    [TestMethod]
+    public void Install_SystemNameUsedByAnotherFolder_IsRejected()
+    {
+        var existing = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        File.Copy(Path.Combine(existing, "Tax.FixedRate.dll"), Path.Combine(target, "Tax.FixedRate.dll"));
+
+        var copy = BuildPluginFolder("Tax.FixedRateCopy", "tax.fixedrate");
+        var zip = ZipFolder(copy);
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.FixedRateCopy")));
+    }
+
+    [TestMethod]
+    public void Install_IntoFolderOfAnotherPlugin_IsRejectedAndLeavesItUntouched()
+    {
+        var existing = BuildPluginFolder("Payments.StripeCheckout", "Payments.StripeCheckout");
+        var target = Path.Combine(_plugins, "Payments.StripeCheckout");
+        Directory.CreateDirectory(target);
+        File.Copy(Path.Combine(existing, "Payments.StripeCheckout.dll"),
+            Path.Combine(target, "Payments.StripeCheckout.dll"));
+        File.WriteAllText(Path.Combine(target, "keep.txt"), "keep");
+        var before = Hash(target);
+
+        var other = BuildPluginFolder("Payments.StripeCheckout", "Other");
+        var ex = Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(ZipFolder(other)));
+
+        Assert.Contains("Payments.StripeCheckout", ex.Message);
+        Assert.Contains("Other", ex.Message);
+        Assert.AreEqual(before, Hash(target));
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Other")));
+    }
+
+    [TestMethod]
+    public void Install_CaseVariantRoot_ReplacesTheExistingFolderInPlace()
+    {
+        var existing = BuildPluginFolder("Payments.StripeCheckout", "Payments.StripeCheckout");
+        var target = Path.Combine(_plugins, "Payments.StripeCheckout");
+        Directory.CreateDirectory(target);
+        File.Copy(Path.Combine(existing, "Payments.StripeCheckout.dll"),
+            Path.Combine(target, "Payments.StripeCheckout.dll"));
+        File.WriteAllText(Path.Combine(target, "old.txt"), "old");
+
+        var upload = BuildPluginFolder("payments.stripecheckout", "Payments.StripeCheckout");
+        var result = CreateInstaller().Install(ZipFolder(upload));
+
+        //the existing folder's exact name, whatever the file system's case sensitivity
+        Assert.AreEqual("Payments.StripeCheckout", result.FolderName);
+        var folders = Directory.GetDirectories(_plugins).Select(Path.GetFileName)
+            .Where(x => x != "TempUploads").ToList();
+        CollectionAssert.AreEqual(new[] { "Payments.StripeCheckout" }, folders);
+        Assert.IsFalse(File.Exists(Path.Combine(target, "old.txt")));
+        Assert.IsTrue(File.Exists(Path.Combine(target, "Payments.StripeCheckout.dll")));
+    }
+
+    [TestMethod]
+    public void Install_TooManyEntries_IsRejected()
+    {
+        var entries = Enumerable.Range(0, PluginArchiveInstaller.MaxEntries + 1)
+            .Select(x => ($"Tax.Big/f{x}.txt", Array.Empty<byte>())).ToArray();
+        var zip = ZipEntries(entries);
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.Big")));
+    }
+
+    [TestMethod]
+    public void Install_ReplacesExistingVersion()
+    {
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        File.WriteAllText(Path.Combine(target, "old.txt"), "old");
+
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        CreateInstaller().Install(ZipFolder(folder));
+
+        Assert.IsFalse(File.Exists(Path.Combine(target, "old.txt")));
+        Assert.IsTrue(File.Exists(Path.Combine(target, "Tax.FixedRate.dll")));
+    }
+
+    [TestMethod]
+    [OSCondition(OperatingSystems.Windows)]
+    public void Install_TargetFileLocked_LeavesPreviousVersion()
+    {
+        var old = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        var oldDll = Path.Combine(target, "Tax.FixedRate.dll");
+        File.Copy(Path.Combine(old, "Tax.FixedRate.dll"), oldDll);
+        File.WriteAllText(Path.Combine(target, "other.txt"), "keep");
+        var before = Hash(target);
+
+        var zip = ZipFolder(BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate"));
+
+        using (new FileStream(oldDll, FileMode.Open, FileAccess.Read, FileShare.None))
+        {
+            Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+        }
+
+        Assert.AreEqual(before, Hash(target));
+    }
+
+    [TestMethod]
+    [DataRow("bin")]
+    [DataRow("TempUploads")]
+    [DataRow("..")]
+    public void Install_ReservedFolderName_IsRejected(string name)
+    {
+        var folder = BuildPluginFolder(name, "Tax.Reserved");
+        var zip = ZipEntries(($"{name}/Tax.Reserved.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.Reserved.dll"))));
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+    }
+
+    [TestMethod]
+    public void Install_RealSizeExceedsLimitDespiteForgedHeader_IsRejected()
+    {
+        var content = System.Security.Cryptography.RandomNumberGenerator.GetBytes(20_000);
+        var zip = ZipEntries(("Tax.Big/big.bin", content));
+        //understate the uncompressed size in the central directory header
+        var bytes = File.ReadAllBytes(zip);
+        var signature = new byte[] { 0x50, 0x4B, 0x01, 0x02 };
+        var at = bytes.AsSpan().LastIndexOf(signature);
+        BitConverter.GetBytes(1).CopyTo(bytes, at + 24);
+        File.WriteAllBytes(zip, bytes);
+        var installer = new PluginArchiveInstaller(_plugins, NullLogger.Instance) { UncompressedBytesLimit = 1000 };
+
+        Assert.ThrowsExactly<GrandException>(() => installer.Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.Big")));
+    }
+
+    [TestMethod]
+    [DataRow("../x.dll")]
+    [DataRow("../../x.dll")]
+    [DataRow("..\\..\\x.dll")]
+    public void Install_ZipSlipEntry_IsRejected(string entryName)
+    {
+        var existing = Path.Combine(_plugins, "Tax.Existing");
+        Directory.CreateDirectory(existing);
+        File.WriteAllText(Path.Combine(existing, "keep.txt"), "keep");
+        var before = Hash(_plugins);
+        var zip = ZipEntries((entryName, [1, 2, 3]));
+
+        var ex = Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.AreEqual(PluginArchiveInstaller.PathOutsideMessage, ex.Message);
+        Assert.AreEqual(before, Hash(_plugins));
+        Assert.IsFalse(File.Exists(Path.Combine(_root, "x.dll")));
+        Assert.IsFalse(File.Exists(Path.Combine(_plugins, "x.dll")));
+        var temp = Path.Combine(_plugins, "TempUploads");
+        Assert.IsTrue(!Directory.Exists(temp) || !Directory.EnumerateFileSystemEntries(temp).Any());
+    }
+
+    [TestMethod]
+    public void DeleteArchive_RemovesOnlyTheArchive()
+    {
+        var temp = Path.Combine(_plugins, "TempUploads");
+        var other = Path.Combine(temp, Guid.NewGuid().ToString(), "previous");
+        Directory.CreateDirectory(other);
+        File.WriteAllText(Path.Combine(other, "old.txt"), "old");
+        var archive = Path.Combine(temp, Guid.NewGuid() + ".zip");
+        File.WriteAllText(archive, "zip");
+
+        PluginArchiveInstaller.DeleteArchive(archive, NullLogger.Instance);
+
+        Assert.IsFalse(File.Exists(archive));
+        Assert.AreEqual(1, Directory.GetFiles(temp, "old.txt", SearchOption.AllDirectories).Length);
+    }
+
+    [TestMethod]
+    public void Install_RollbackFails_KeepsPreviousVersion()
+    {
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        File.WriteAllText(Path.Combine(target, "old.txt"), "old");
+        var zip = ZipFolder(BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate"));
+        var calls = 0;
+        var installer = new PluginArchiveInstaller(_plugins, NullLogger.Instance) {
+            MoveDirectory = (from, to) => {
+                //the move aside succeeds; moving the new folder in and the rollback both fail
+                if (calls++ == 0) Directory.Move(from, to);
+                else throw new IOException("simulated");
+            }
+        };
+
+        var ex = Assert.Throws<GrandException>(() => installer.Install(zip));
+
+        StringAssert.Contains(ex.Message, "preserved");
+        var kept = Directory.GetFiles(_plugins, "old.txt", SearchOption.AllDirectories);
+        Assert.AreEqual(1, kept.Length);
+        Assert.AreEqual("old", File.ReadAllText(kept[0]));
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
index b1a2607be2..146c6d48ac 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
@@ -1,4 +1,5 @@
 using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
 using Grand.SharedKernel.Extensions;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 using TestContext = NUnit.Framework.TestContext;
@@ -48,6 +49,47 @@ public async Task MarkPluginAsUninstalled()
         Assert.HasCount(1, plugins);
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task MarkPluginAsUninstalled_DifferentCase_Removes()
+    {
+        await PluginExtensions.MarkPluginAsInstalled("Plugin1");
+        await PluginExtensions.MarkPluginAsUninstalled("plugin1");
+        var plugins = PluginExtensions.ParseInstalledPluginsFile(PluginPaths.Instance.InstalledPluginsFile);
+        Assert.IsEmpty(plugins);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task MarkPluginAsInstalled_Concurrent_KeepsBoth()
+    {
+        var names = Enumerable.Range(0, 20).Select(i => $"plugin{i}").ToList();
+        await Task.WhenAll(names.Select(n => Task.Run(() => PluginExtensions.MarkPluginAsInstalled(n))));
+        var plugins = PluginExtensions.ParseInstalledPluginsFile(PluginPaths.Instance.InstalledPluginsFile);
+        Assert.HasCount(20, plugins);
+        CollectionAssert.AreEquivalent(names, plugins.ToList());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void ParseInstalledPluginsFile_InvalidJson_ThrowsWithPath()
+    {
+        var path = PluginPaths.Instance.InstalledPluginsFile;
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+        File.WriteAllText(path, "{ not json");
+        try
+        {
+            var ex = Assert.Throws<Grand.SharedKernel.GrandException>(() =>
+                PluginExtensions.ParseInstalledPluginsFile(path));
+            StringAssert.Contains(ex.Message, path);
+            StringAssert.Contains(ex.Message, "is not a valid installed-plugins file");
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
     [TestMethod]
     [DoNotParallelize]
     public void OnlyInstalledPlugins_Assembly_NotAPlugin_ReturnsTrue()
@@ -97,6 +139,103 @@ public void OnlyInstalledPlugins_Assembly_InstalledPlugin_ReturnsTrue()
         }
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public void OnlyInstalledPlugins_SatelliteOfUninstalledPlugin_ReturnsFalse()
+    {
+        using var fixture = new PluginFolderFixture();
+        fixture.AddPlugin("Sat", "Ext.Sat", "Ext.Sat", "public class SatPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(fixture.Folder("Sat"), "Ext.Sat.Core", "public class Core { }");
+        var plugin = fixture.Load("Sat", false);
+
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [plugin];
+            Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(fixture.Loaded("Ext.Sat.Core")));
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void OnlyInstalledPlugins_InstalledPluginWithLoadError_ReturnsFalse()
+    {
+        using var fixture = new PluginFolderFixture();
+        var missing = fixture.CompileElsewhere("Ext.MissingDep", "namespace Missing { public class Base { } }");
+        fixture.AddPlugin("Broken", "Ext.Broken", "Ext.Broken", """
+            public class Derived : Missing.Base { }
+            public class BrokenPlugin : BasePlugin { }
+            """, missing);
+        TestPluginBuilder.Compile(fixture.Folder("Broken"), "Ext.Broken.Core", "public class Core { }");
+        var plugin = fixture.Load("Broken", true);
+        Assert.IsNotNull(plugin.LoadError);
+
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [plugin];
+            Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(fixture.Loaded("Ext.Broken.Core")));
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void OnlyInstalledPlugins_DependencyShippedByInstalledAndUninstalledPlugin_OnlyTheInstalledCopyCounts()
+    {
+        using var fixture = new PluginFolderFixture();
+        fixture.AddPlugin("A", "Ext.A", "Ext.A", "public class APlugin : BasePlugin { }");
+        fixture.AddPlugin("B", "Ext.B", "Ext.B", "public class BPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(fixture.Folder("A"), "Ext.Shared", "public class Shared { }");
+        TestPluginBuilder.Compile(fixture.Folder("B"), "Ext.Shared", "public class Shared { }");
+        var uninstalled = fixture.Load("A", false);
+        var installed = fixture.Load("B", true);
+
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [uninstalled, installed];
+            //each plugin loaded its own copy into its own context
+            Assert.IsTrue(PluginExtensions.OnlyInstalledPlugins(PluginFolderFixture.Loaded(installed, "Ext.Shared")));
+            Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(PluginFolderFixture.Loaded(uninstalled, "Ext.Shared")));
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void OnlyInstalledPlugins_AssemblyOutsidePluginContextsSharedWithInstalledPlugin_ReturnsTrue()
+    {
+        //an assembly no plugin context holds is matched by name, as before plugins had contexts of their own
+        var name = typeof(SampleBasePlugin).Assembly.GetName().Name;
+        var uninstalled = new PluginInfo { SystemName = "Uninstalled", AssemblyNames = new HashSet<string> { name } };
+        var installed = new PluginInfo
+            { SystemName = "Installed", Installed = true, AssemblyNames = new HashSet<string> { name } };
+
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [uninstalled];
+            Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(typeof(SampleBasePlugin).Assembly));
+            PluginManager.ReferencedPlugins = [uninstalled, installed];
+            Assert.IsTrue(PluginExtensions.OnlyInstalledPlugins(typeof(SampleBasePlugin).Assembly));
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
     private static PluginInfo SamplePluginInfo(bool installed)
     {
         return new PluginInfo(null, typeof(SampleBasePlugin).Assembly, typeof(SampleBasePlugin)) {
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
new file mode 100644
index 0000000000..c3b1996206
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
@@ -0,0 +1,201 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginFolderScannerTests
+{
+    private static readonly string CoreAssemblyPath = typeof(PluginInfoAttribute).Assembly.Location;
+    private static readonly HashSet<string> Host = ["Grand.Infrastructure"];
+
+    private string _root;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _root = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_root);
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        if (Directory.Exists(_root))
+            Directory.Delete(_root, true);
+    }
+
+    private string Folder(string name) => Path.Combine(_root, name);
+
+    private string AddPlugin(string folder, string assemblyName, string systemName)
+    {
+        return TestPluginBuilder.Compile(Folder(folder), assemblyName, $$"""
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "{{systemName}}")]
+            """, null, CoreAssemblyPath);
+    }
+
+    private PluginScanResult Scan(string skipPattern = null) =>
+        PluginFolderScanner.Scan(new DirectoryInfo(_root), skipPattern, Host);
+
+    [TestMethod]
+    public void Scan_DuplicateSystemName_SecondFolderIsProblem()
+    {
+        AddPlugin("A", "Scan.A", "Scan.Same");
+        AddPlugin("B", "Scan.B", "scan.same");
+
+        var result = Scan();
+
+        Assert.HasCount(1, result.Plugins);
+        Assert.AreEqual("A", result.Plugins[0].Folder.Name);
+        Assert.HasCount(1, result.Problems);
+        Assert.AreEqual("B", result.Problems[0].Folder);
+        Assert.AreEqual("scan.same", result.Problems[0].SystemNames.Single());
+    }
+
+    [TestMethod]
+    public void Scan_SameDependencyTwoVersions_EachFolderKeepsItsOwn()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        AddPlugin("B", "Scan.B", "Scan.B");
+        var low = TestPluginBuilder.Compile(Folder("A"), "Shared.Lib", "public class Lib { }", new Version(1, 0, 0, 0));
+        var high = TestPluginBuilder.Compile(Folder("B"), "Shared.Lib", "public class Lib { }", new Version(2, 0, 0, 0));
+
+        var result = Scan();
+
+        //each plugin loads into its own context, so neither copy has to give way
+        Assert.HasCount(2, result.Plugins);
+        var a = result.Plugins.Single(x => x.Folder.Name == "A");
+        var b = result.Plugins.Single(x => x.Folder.Name == "B");
+        CollectionAssert.Contains(a.AssemblyPaths.ToList(), low);
+        CollectionAssert.Contains(b.AssemblyPaths.ToList(), high);
+        Assert.Contains("Shared.Lib", a.AssemblyNames);
+        Assert.Contains("Shared.Lib", b.AssemblyNames);
+        Assert.IsEmpty(result.Warnings);
+    }
+
+    [TestMethod]
+    public void Scan_IncompatiblePluginShipsHigherVersion_CompatibleKeepsItsCopy()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        var own = TestPluginBuilder.Compile(Folder("A"), "Shared.Lib", "public class Lib { }", new Version(1, 0, 0, 0));
+        TestPluginBuilder.Compile(Folder("B"), "Scan.B", """
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "Scan.B", SupportedVersion = "1.0")]
+            """, null, CoreAssemblyPath);
+        TestPluginBuilder.Compile(Folder("B"), "Shared.Lib", "public class Lib { }", new Version(2, 0, 0, 0));
+
+        var result = Scan();
+
+        CollectionAssert.Contains(result.Plugins.Single(x => x.Folder.Name == "A").AssemblyPaths.ToList(), own);
+        Assert.IsEmpty(result.Warnings);
+    }
+
+    [TestMethod]
+    public void Scan_HostAssemblyInPluginFolder_IsSkippedAndNotOwned()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        File.Copy(CoreAssemblyPath, Path.Combine(Folder("A"), "Grand.Infrastructure.dll"));
+
+        var result = Scan();
+
+        var plugin = result.Plugins.Single();
+        Assert.IsFalse(plugin.AssemblyPaths.Any(x => Path.GetFileName(x) == "Grand.Infrastructure.dll"));
+        Assert.DoesNotContain("Grand.Infrastructure", plugin.AssemblyNames);
+        Assert.HasCount(1, result.Warnings);
+    }
+
+    [TestMethod]
+    public void Scan_NativeDll_IsIgnoredWithoutProblem()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        File.WriteAllBytes(Path.Combine(Folder("A"), "native.dll"),
+            System.Security.Cryptography.RandomNumberGenerator.GetBytes(4096));
+
+        var result = Scan();
+
+        Assert.HasCount(1, result.Plugins);
+        Assert.IsEmpty(result.Problems);
+        Assert.IsFalse(result.Plugins[0].AssemblyPaths.Any(x => Path.GetFileName(x) == "native.dll"));
+    }
+
+    [TestMethod]
+    public void Scan_SkipPattern_ExcludesMatchingFiles()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        TestPluginBuilder.Compile(Folder("A"), "Skipped.Lib", "public class Lib { }");
+
+        var result = Scan("^Skipped");
+
+        var plugin = result.Plugins.Single();
+        Assert.IsFalse(plugin.AssemblyPaths.Any(x => Path.GetFileName(x) == "Skipped.Lib.dll"));
+        Assert.DoesNotContain("Skipped.Lib", plugin.AssemblyNames);
+    }
+
+    [TestMethod]
+    public void Scan_SkipPatternTimesOut_IsProblemOfThatFolderOnly()
+    {
+        var slow = new string('a', 40);
+        AddPlugin("A", "Scan.A", "Scan.A");
+        TestPluginBuilder.Compile(Folder("A"), slow, "public class Lib { }");
+        AddPlugin("B", "Scan.B", "Scan.B");
+
+        //catastrophic backtracking on the long name; the other file names fail on the first character
+        var result = Scan("^(a+)+$");
+
+        Assert.AreEqual("B", result.Plugins.Single().Folder.Name);
+        var problem = result.Problems.Single();
+        Assert.AreEqual("A", problem.Folder);
+        Assert.Contains(slow + ".dll", problem.Message);
+        Assert.Contains("PluginSkipLoadingPattern", problem.Message);
+    }
+
+    [TestMethod]
+    [OSCondition(OperatingSystems.Windows)]
+    public void Scan_UnreadableMainAssembly_IsProblemNamingTheFolder()
+    {
+        var path = AddPlugin("A", "Scan.A", "Scan.A");
+        AddPlugin("B", "Scan.B", "Scan.B");
+
+        PluginScanResult result;
+        using (new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.None))
+        {
+            result = Scan();
+        }
+
+        Assert.AreEqual("B", result.Plugins.Single().Folder.Name);
+        var problem = result.Problems.Single();
+        Assert.AreEqual("A", problem.Folder);
+        Assert.Contains("Scan.A.dll", problem.Message);
+    }
+
+    [TestMethod]
+    public void Scan_EmptyOrMissingSystemName_IsProblem()
+    {
+        AddPlugin("A", "Scan.A", "");
+        TestPluginBuilder.Compile(Folder("B"), "Scan.B", """
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(FriendlyName = "No system name")]
+            """, null, CoreAssemblyPath);
+
+        var result = Scan();
+
+        Assert.IsEmpty(result.Plugins);
+        Assert.HasCount(2, result.Problems);
+        Assert.IsTrue(result.Problems.All(x => x.Message == "has no SystemName"));
+    }
+
+    [TestMethod]
+    public void Scan_BinAndTempUploadsFolders_AreIgnored()
+    {
+        AddPlugin("bin", "Scan.Bin", "Scan.Bin");
+        AddPlugin("TempUploads", "Scan.Temp", "Scan.Temp");
+        AddPlugin("A", "Scan.A", "Scan.A");
+
+        var result = Scan();
+
+        Assert.AreEqual("A", result.Plugins.Single().Folder.Name);
+        Assert.IsEmpty(result.Problems);
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs
new file mode 100644
index 0000000000..a2e13ae9f1
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs
@@ -0,0 +1,57 @@
+using Grand.Infrastructure.Plugins;
+using Grand.SharedKernel;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginInfoTests
+{
+    public interface IMissingDependency;
+
+    public class NeedyPlugin(IMissingDependency dependency) : BasePlugin
+    {
+        public IMissingDependency Dependency { get; } = dependency;
+    }
+
+    [TestMethod]
+    public void Instance_DependencyMissing_KeepsInnerException()
+    {
+        var services = new ServiceCollection();
+        services.AddTransient<NeedyPlugin>();
+        using var provider = services.BuildServiceProvider();
+        var info = new PluginInfo { SystemName = "Needy", PluginType = typeof(NeedyPlugin) };
+
+        var ex = Assert.Throws<GrandException>(() => info.Instance(provider));
+
+        Assert.IsNotNull(ex.InnerException);
+        Assert.IsInstanceOfType<InvalidOperationException>(ex.InnerException);
+        StringAssert.Contains(ex.Message, "Needy");
+    }
+
+    [TestMethod]
+    public void Instance_NoPluginType_ThrowsGrandException()
+    {
+        using var provider = new ServiceCollection().BuildServiceProvider();
+        var info = new PluginInfo { SystemName = "Empty", SupportedVersion = GrandVersion.SupportedPluginVersion };
+
+        var ex = Assert.Throws<GrandException>(() => info.Instance(provider));
+
+        Assert.AreEqual("Plugin Empty has no IPlugin class", ex.Message);
+    }
+
+    [TestMethod]
+    public void Instance_IncompatiblePlugin_SaysWhichVersionItWasBuiltFor()
+    {
+        using var provider = new ServiceCollection().BuildServiceProvider();
+        //an incompatible plugin is listed from its manifest and never loaded
+        var info = new PluginInfo { SystemName = "Old", SupportedVersion = "1.0" };
+
+        var ex = Assert.Throws<GrandException>(() => info.Instance(provider));
+
+        Assert.AreEqual(
+            $"Plugin Old was built for GrandNode version 1.0 and is not compatible with the current version {GrandVersion.SupportedPluginVersion}",
+            ex.Message);
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
new file mode 100644
index 0000000000..8ac3ccc88a
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
@@ -0,0 +1,174 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Grand.SharedKernel;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginLoaderTests
+{
+    private PluginFolderFixture _fixture;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    public void Load_MissingDependency_SetsLoadErrorAndDoesNotThrow()
+    {
+        var missing = _fixture.CompileElsewhere("Loader.MissingDep", "namespace Missing { public class Base { } }");
+        _fixture.AddPlugin("P", "Loader.Missing", "Loader.Missing", """
+            public class Derived : Missing.Base { }
+            public class MissingPlugin : BasePlugin { }
+            """, missing);
+
+        var plugin = _fixture.Load("P", true);
+
+        Assert.IsNotNull(plugin.LoadError);
+        Assert.Contains("Loader.MissingDep", plugin.LoadError);
+        Assert.IsNull(plugin.PluginType);
+        Assert.IsFalse(plugin.IsActive);
+        Assert.AreEqual("Loader.Missing", plugin.SystemName);
+    }
+
+    [TestMethod]
+    public void Load_AbstractPluginBase_PicksConcreteTypeAndBuildsProvider()
+    {
+        _fixture.AddPlugin("P", "Loader.Abstract", "Loader.Abstract", """
+            public interface IAbstractPlugin : IPlugin { }
+            public abstract class AbstractPluginBase : BasePlugin, IAbstractPlugin { }
+            public class ConcretePlugin : AbstractPluginBase { }
+            """);
+
+        var plugin = _fixture.Load("P", true);
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreEqual("ConcretePlugin", plugin.PluginType.Name);
+        Assert.IsTrue(plugin.IsActive);
+
+        //PluginManager registers the plugin type and nothing else
+        var services = new ServiceCollection();
+        services.AddScoped(plugin.PluginType);
+        using var provider = services.BuildServiceProvider(new ServiceProviderOptions { ValidateOnBuild = true });
+        using var scope = provider.CreateScope();
+        Assert.IsInstanceOfType<IPlugin>(scope.ServiceProvider.GetRequiredService(plugin.PluginType));
+    }
+
+    [TestMethod]
+    public void Load_NoIPluginClass_SetsLoadError()
+    {
+        _fixture.AddPlugin("P", "Loader.NoPlugin", "Loader.NoPlugin", "public class NotAPlugin { }");
+
+        var plugin = _fixture.Load("P", true);
+
+        Assert.AreEqual("has no IPlugin class", plugin.LoadError);
+        Assert.IsNull(plugin.PluginType);
+    }
+
+    [TestMethod]
+    public void Load_DependencyKeptByIncompatiblePlugin_StillResolves()
+    {
+        const string sharedSource = "namespace Shared { public class Base { } }";
+        var shared = TestPluginBuilder.Compile(_fixture.Folder("A"), "Loader.Shared", sharedSource,
+            new Version(1, 0, 0, 0));
+        _fixture.AddPlugin("A", "Loader.A", "Loader.A", """
+            public class Derived : Shared.Base { }
+            public class APlugin : BasePlugin { }
+            """, shared);
+        //a plugin built for another version ships the higher copy; it is never loaded, so it must not take the dependency
+        TestPluginBuilder.Compile(_fixture.Folder("B"), "Loader.Shared", sharedSource, new Version(2, 0, 0, 0));
+        TestPluginBuilder.Compile(_fixture.Folder("B"), "Loader.B", """
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "Loader.B", SupportedVersion = "1.0")]
+            """, null, PluginFolderFixture.CoreAssemblyPath);
+
+        var plugin = _fixture.Load("A", true);
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreEqual("APlugin", plugin.PluginType.Name);
+    }
+
+    [TestMethod]
+    public void Load_ThirdPartyLibraryWithTypeOnAbsentAssembly_StillLoads()
+    {
+        //a library's optional integration: a type built on an assembly the library does not ship
+        var optional = _fixture.CompileElsewhere("Loader.Optional", "namespace Optional { public class Base { } }");
+        var library = TestPluginBuilder.Compile(_fixture.Folder("P"), "Loader.ThirdParty", """
+            namespace ThirdParty { public class Used { } public class Integration : Optional.Base { } }
+            """, null, optional);
+        _fixture.AddPlugin("P", "Loader.UsesLibrary", "Loader.UsesLibrary", """
+            public class UsesLibraryPlugin : BasePlugin { public ThirdParty.Used Used { get; } = new(); }
+            """, library);
+
+        var plugin = _fixture.Load("P", true);
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.IsTrue(plugin.IsActive);
+        Assert.AreEqual("UsesLibraryPlugin", plugin.PluginType.Name);
+    }
+
+    [TestMethod]
+    public void Problem_KnownSystemNameOfInstalledPlugin_IsInstalledAndFailsStrictMode()
+    {
+        _fixture.AddPlugin("Multi", "Loader.One", "Loader.One");
+        _fixture.AddPlugin("Multi", "Loader.Two", "Loader.Two");
+        var problems = _fixture.Scan().Problems;
+
+        var problem = problems.Single();
+        CollectionAssert.AreEquivalent(new[] { "Loader.One", "Loader.Two" }, problem.SystemNames.ToList());
+        var entries = PluginLoader.DescribeProblem(problem, ["loader.one"]).ToList();
+
+        var one = entries.Single(x => x.SystemName == "Loader.One");
+        Assert.IsTrue(one.Installed);
+        Assert.AreEqual(problem.Message, one.LoadError);
+        Assert.IsFalse(entries.Single(x => x.SystemName == "Loader.Two").Installed);
+
+        var ex = Assert.ThrowsExactly<GrandException>(() => PluginLoader.ThrowOnLoadError(entries, problems, true));
+        Assert.Contains("Loader.One", ex.Message);
+        PluginLoader.ThrowOnLoadError(entries, problems, false);
+    }
+
+    [TestMethod]
+    public void Problem_UnknownSystemName_FailsStrictModeOnly()
+    {
+        _fixture.AddPlugin("Nameless", "Loader.Nameless", "");
+        var problems = _fixture.Scan().Problems;
+
+        var problem = problems.Single();
+        Assert.IsEmpty(problem.SystemNames);
+        var entries = PluginLoader.DescribeProblem(problem, []).ToList();
+        Assert.AreEqual("Nameless", entries.Single().SystemName);
+        //the folder to remove, although no plugin file was identified
+        Assert.AreEqual("Nameless", entries.Single().FolderName);
+        Assert.IsNull(entries.Single().OriginalAssemblyFile);
+        Assert.IsFalse(entries.Single().Installed);
+
+        var ex = Assert.ThrowsExactly<GrandException>(() => PluginLoader.ThrowOnLoadError(entries, problems, true));
+        Assert.Contains("Nameless", ex.Message);
+        Assert.Contains("has no SystemName", ex.Message);
+        PluginLoader.ThrowOnLoadError(entries, problems, false);
+    }
+
+    [TestMethod]
+    public void Load_SatelliteAssembly_IsInAssemblyNames()
+    {
+        _fixture.AddPlugin("P", "Loader.Sat", "Loader.Sat", "public class SatPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(_fixture.Folder("P"), "Loader.Sat.Core", "public class Core { }");
+
+        var plugin = _fixture.Load("P", false);
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.Contains("Loader.Sat", plugin.AssemblyNames);
+        Assert.Contains("Loader.Sat.Core", plugin.AssemblyNames);
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
new file mode 100644
index 0000000000..eae3ad3998
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
@@ -0,0 +1,331 @@
+using Grand.Domain;
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Grand.SharedKernel;
+using LiteDB;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using System.Collections;
+using System.Reflection;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+[DoNotParallelize]
+public class PluginManagerTests
+{
+    private static readonly string DomainAssemblyPath = typeof(BaseEntity).Assembly.Location;
+
+    private PluginFolderFixture _fixture;
+    private IEnumerable<PluginInfo> _referencedPlugins;
+    private PluginLoadSnapshot _loadSnapshot;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+        _referencedPlugins = PluginManager.ReferencedPlugins;
+        _loadSnapshot = PluginManager.LoadSnapshot;
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        PluginManager.ReferencedPlugins = _referencedPlugins;
+        PluginManager.LoadSnapshot = _loadSnapshot;
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    public void Load_UninstalledPlugin_IsListedButNotLoaded()
+    {
+        var main = _fixture.AddPlugin("Uninstalled", "Manager.Uninstalled", "Manager.Uninstalled",
+            "public class UninstalledPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(_fixture.Folder("Uninstalled"), "Manager.Uninstalled.Core", "public class Core { }");
+
+        Load();
+
+        var plugin = Plugin("Manager.Uninstalled");
+        Assert.IsFalse(plugin.Installed);
+        Assert.IsNull(plugin.LoadError);
+        Assert.IsNull(plugin.ReferencedAssembly);
+        Assert.IsNull(plugin.PluginType);
+        //the list and the logo come from the scan
+        Assert.AreEqual(main, plugin.OriginalAssemblyFile.FullName);
+        Assert.Contains("Manager.Uninstalled.Core", plugin.AssemblyNames);
+        Assert.IsFalse(IsLoaded("Manager.Uninstalled"));
+        Assert.IsFalse(IsLoaded("Manager.Uninstalled.Core"));
+    }
+
+    [TestMethod]
+    public void Load_InstalledPlugin_IsLoaded()
+    {
+        _fixture.AddPlugin("Installed", "Manager.Installed", "Manager.Installed",
+            "public class InstalledPlugin : BasePlugin { }");
+
+        Load("Manager.Installed");
+
+        var plugin = Plugin("Manager.Installed");
+        Assert.IsTrue(plugin.IsActive);
+        Assert.AreEqual("InstalledPlugin", plugin.PluginType.Name);
+        Assert.AreSame(_fixture.Loaded("Manager.Installed"), plugin.ReferencedAssembly);
+    }
+
+    [TestMethod]
+    public void Load_IncompatiblePlugin_IsListedButNotLoaded()
+    {
+        TestPluginBuilder.Compile(_fixture.Folder("Old"), "Manager.Old", """
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "Manager.Old", SupportedVersion = "1.0")]
+            public class OldPlugin : BasePlugin { }
+            """, null, PluginFolderFixture.CoreAssemblyPath);
+
+        Load("Manager.Old");
+
+        var plugin = Plugin("Manager.Old");
+        Assert.IsFalse(plugin.Installed);
+        Assert.IsNull(plugin.ReferencedAssembly);
+        Assert.IsNull(plugin.PluginType);
+        Assert.IsNotNull(plugin.OriginalAssemblyFile);
+        //nor on demand: a plugin built for another version is never installed
+        using var provider = new ServiceCollection().BuildServiceProvider();
+        Assert.ThrowsExactly<GrandException>(() => plugin.Instance<IPlugin>(provider));
+        Assert.IsFalse(IsLoaded("Manager.Old"));
+    }
+
+    [TestMethod]
+    public void Instance_UninstalledPlugin_LoadsOnDemandAndActivates()
+    {
+        _fixture.AddPlugin("OnDemand", "Manager.OnDemand", "Manager.OnDemand", """
+            public class OnDemandPlugin(System.IServiceProvider services) : BasePlugin
+            {
+                public System.IServiceProvider Services { get; } = services;
+            }
+            """);
+        Load();
+        var plugin = Plugin("Manager.OnDemand");
+
+        //an uninstalled plugin is not registered in DI
+        using var provider = new ServiceCollection().BuildServiceProvider();
+        var instance = plugin.Instance<IPlugin>(provider);
+
+        Assert.AreEqual("OnDemandPlugin", instance.GetType().Name);
+        Assert.AreSame(plugin, instance.PluginInfo);
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreSame(_fixture.Loaded("Manager.OnDemand"), plugin.ReferencedAssembly);
+        Assert.AreSame(instance.GetType(), plugin.PluginType);
+        //installed only after the restart: until then it contributes no types to any scan
+        Assert.IsFalse(plugin.Installed);
+        Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(plugin.ReferencedAssembly));
+    }
+
+    [TestMethod]
+    public void Instance_ConcurrentCalls_LoadThePluginOnce()
+    {
+        _fixture.AddPlugin("Concurrent", "Manager.Concurrent", "Manager.Concurrent",
+            "public class ConcurrentPlugin : BasePlugin { }");
+        Load();
+        var plugin = Plugin("Manager.Concurrent");
+        using var provider = new ServiceCollection().BuildServiceProvider();
+
+        var types = new Type[8];
+        Parallel.For(0, types.Length, i => types[i] = plugin.Instance<IPlugin>(provider).GetType());
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreEqual(1, types.Distinct().Count());
+        Assert.HasCount(1, _fixture.Contexts);
+        Assert.HasCount(1, _fixture.Contexts.Single().Assemblies.Where(x => x.GetName().Name == "Manager.Concurrent"));
+    }
+
+    [TestMethod]
+    public void Instance_UninstalledPluginThatCannotLoad_KeepsLoadErrorAndThrows()
+    {
+        var missing = _fixture.CompileElsewhere("Manager.MissingDep", "namespace Missing { public class Base { } }");
+        _fixture.AddPlugin("Broken", "Manager.Broken", "Manager.Broken", """
+            public class Derived : Missing.Base { }
+            public class BrokenPlugin : BasePlugin { }
+            """, missing);
+        Load();
+        var plugin = Plugin("Manager.Broken");
+        using var provider = new ServiceCollection().BuildServiceProvider();
+
+        var ex = Assert.ThrowsExactly<GrandException>(() => plugin.Instance<IPlugin>(provider));
+
+        Assert.IsNotNull(plugin.LoadError);
+        Assert.Contains("Manager.MissingDep", plugin.LoadError);
+        Assert.Contains(plugin.LoadError, ex.Message);
+        Assert.IsNull(plugin.PluginType);
+        Assert.IsNull(plugin.ReferencedAssembly);
+    }
+
+    [TestMethod]
+    public void Instance_OnLiteDb_BuildsTheMappersOfThePluginLoadedOnDemand()
+    {
+        //installing a plugin uses its entities on the running site, among requests reading the same mappers
+        _fixture.AddPlugin("Lite", "Manager.Lite", "Manager.Lite", """
+            public class LitePluginEntity : Grand.Domain.BaseEntity { }
+            public class LitePlugin : BasePlugin { }
+            """, DomainAssemblyPath);
+        Load(useLiteDb: true);
+        var plugin = Plugin("Manager.Lite");
+        Assert.DoesNotContain("LitePluginEntity", MappedTypeNames());
+        using var provider = new ServiceCollection().BuildServiceProvider();
+
+        plugin.Instance<IPlugin>(provider);
+
+        Assert.Contains("LitePluginEntity", MappedTypeNames());
+    }
+
+    [TestMethod]
+    public void Load_ShadowCopy_LoadsTheWholeFolderFromItsOwnCopy()
+    {
+        var main = _fixture.AddPlugin("Shadow", "Manager.Shadow", "Manager.Shadow",
+            "public class ShadowPlugin : BasePlugin { }");
+        WriteDepsJson(_fixture.Folder("Shadow"), "Manager.Shadow");
+        Directory.CreateDirectory(Path.Combine(_fixture.Folder("Shadow"), "runtimes", "any"));
+        File.WriteAllText(Path.Combine(_fixture.Folder("Shadow"), "runtimes", "any", "native.txt"), "native");
+        //left by an earlier start: a file the plugin no longer ships, another plugin's copy, the copy of a removed
+        //plugin folder, the old flat layout
+        Directory.CreateDirectory(ShadowFolder("Shadow"));
+        File.WriteAllText(Path.Combine(ShadowFolder("Shadow"), "Removed.dll"), "old");
+        Directory.CreateDirectory(_fixture.Folder("Other"));
+        Directory.CreateDirectory(ShadowFolder("Other"));
+        File.WriteAllText(Path.Combine(ShadowFolder("Other"), "Other.dll"), "other");
+        Directory.CreateDirectory(Path.Combine(ShadowFolder("Gone"), "runtimes"));
+        File.WriteAllText(Path.Combine(ShadowFolder("Gone"), "runtimes", "Gone.dll"), "gone");
+        File.WriteAllText(Path.Combine(_fixture.PluginsFolder, "bin", "Flat.dll"), "flat");
+
+        Load("Manager.Shadow", shadowCopy: true);
+
+        var plugin = Plugin("Manager.Shadow");
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreEqual(Path.Combine(ShadowFolder("Shadow"), "Manager.Shadow.dll"), plugin.ReferencedAssembly.Location);
+        Assert.AreEqual(main, plugin.OriginalAssemblyFile.FullName);
+        Assert.IsTrue(File.Exists(Path.Combine(ShadowFolder("Shadow"), "Manager.Shadow.deps.json")));
+        Assert.IsTrue(File.Exists(Path.Combine(ShadowFolder("Shadow"), "runtimes", "any", "native.txt")));
+        Assert.IsFalse(File.Exists(Path.Combine(ShadowFolder("Shadow"), "Removed.dll")));
+        Assert.IsTrue(File.Exists(Path.Combine(ShadowFolder("Other"), "Other.dll")));
+        Assert.IsFalse(Directory.Exists(ShadowFolder("Gone")));
+        Assert.IsFalse(File.Exists(Path.Combine(_fixture.PluginsFolder, "bin", "Flat.dll")));
+        //the plugin's own folder keeps its deps.json
+        Assert.IsTrue(File.Exists(Path.Combine(_fixture.Folder("Shadow"), "Manager.Shadow.deps.json")));
+    }
+
+    [TestMethod]
+    public void Load_ShadowCopy_CopiesOnlyFilesThatChanged()
+    {
+        _fixture.AddPlugin("Copy", "Manager.Copy", "Manager.Copy", "public class CopyPlugin : BasePlugin { }");
+        var unchanged = Path.Combine(_fixture.Folder("Copy"), "unchanged.txt");
+        var changed = Path.Combine(_fixture.Folder("Copy"), "changed.txt");
+        File.WriteAllText(unchanged, "source");
+        File.WriteAllText(changed, "source");
+        Load("Manager.Copy", shadowCopy: true);
+        //same size and time as its source: taken as up to date, so the marker survives the next start
+        var unchangedCopy = Path.Combine(ShadowFolder("Copy"), "unchanged.txt");
+        File.WriteAllText(unchangedCopy, "marker");
+        File.SetLastWriteTimeUtc(unchangedCopy, File.GetLastWriteTimeUtc(unchanged));
+        File.WriteAllText(changed, "a newer, longer source");
+
+        Load("Manager.Copy", shadowCopy: true);
+
+        Assert.AreEqual("marker", File.ReadAllText(unchangedCopy));
+        Assert.AreEqual("a newer, longer source", File.ReadAllText(Path.Combine(ShadowFolder("Copy"), "changed.txt")));
+        Assert.IsTrue(Plugin("Manager.Copy").IsActive);
+    }
+
+    [TestMethod]
+    public void Load_ShadowCopyOff_LoadsFromThePluginFolderAndKeepsDepsJson()
+    {
+        var main = _fixture.AddPlugin("Direct", "Manager.Direct", "Manager.Direct",
+            "public class DirectPlugin : BasePlugin { }");
+        WriteDepsJson(_fixture.Folder("Direct"), "Manager.Direct");
+
+        Load("Manager.Direct");
+
+        var plugin = Plugin("Manager.Direct");
+        Assert.IsTrue(plugin.IsActive);
+        Assert.AreEqual(main, plugin.ReferencedAssembly.Location);
+        Assert.IsTrue(File.Exists(Path.Combine(_fixture.Folder("Direct"), "Manager.Direct.deps.json")));
+        Assert.IsFalse(Directory.Exists(ShadowFolder("Direct")));
+    }
+
+    [TestMethod]
+    public void Load_SecondFolderOfAnInstalledSystemName_IsNotInstalledAndDoesNotStopTheApplication()
+    {
+        _fixture.AddPlugin("A", "Manager.TwiceA", "Manager.Twice", "public class TwiceA : BasePlugin { }");
+        _fixture.AddPlugin("B", "Manager.TwiceB", "Manager.Twice", "public class TwiceB : BasePlugin { }");
+
+        Load("Manager.Twice", failOnPluginLoadError: true);
+
+        var entries = PluginManager.ReferencedPlugins.Where(x => x.SystemName == "Manager.Twice").ToList();
+        Assert.HasCount(2, entries);
+        Assert.IsTrue(entries[0].IsActive);
+        Assert.AreEqual("A", entries[0].FolderName);
+        Assert.IsFalse(entries[1].Installed);
+        Assert.IsNotNull(entries[1].LoadError);
+        Assert.AreEqual("B", entries[1].FolderName);
+    }
+
+    [TestMethod]
+    public void Load_LogsToTheLoggingProvidersOfTheServices()
+    {
+        var logs = new CapturingLoggerProvider();
+
+        Load(logs: logs);
+
+        Assert.IsTrue(logs.Entries.Any(x =>
+            x.Category == "PluginManager" && x.Message.Contains("Creating shadow copy folder")));
+    }
+
+    private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = false, bool shadowCopy = false,
+        CapturingLoggerProvider logs = null, bool failOnPluginLoadError = false)
+    {
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string> {
+                ["Extensions:InstalledPlugins"] = installed,
+                ["Extensions:PluginShadowCopy"] = shadowCopy.ToString(),
+                ["Extensions:FailOnPluginLoadError"] = failOnPluginLoadError.ToString(),
+                ["Database:UseLiteDb"] = useLiteDb.ToString()
+            })
+            .Build();
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(Path.GetDirectoryName(_fixture.PluginsFolder)!);
+        var mvcCoreBuilder = new ServiceCollection().AddLogging(x =>
+        {
+            if (logs != null)
+                x.AddProvider(logs);
+        }).AddMvcCore();
+
+        PluginManager.Load(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.CreateContext);
+    }
+
+    private string ShadowFolder(string folder) => Path.Combine(_fixture.PluginsFolder, "bin", folder);
+
+    private static void WriteDepsJson(string folder, string assemblyName)
+    {
+        File.WriteAllText(Path.Combine(folder, assemblyName + ".deps.json"), $$"""
+            {
+              "runtimeTarget": { "name": ".NETCoreApp,Version=v10.0" },
+              "targets": { ".NETCoreApp,Version=v10.0": { "{{assemblyName}}/1.0.0": { "runtime": { "{{assemblyName}}.dll": {} } } } },
+              "libraries": { "{{assemblyName}}/1.0.0": { "type": "project", "serviceable": false, "sha512": "" } }
+            }
+            """);
+    }
+
+    private static PluginInfo Plugin(string systemName) =>
+        PluginManager.ReferencedPlugins.Single(x => x.SystemName == systemName);
+
+    private static bool IsLoaded(string assemblyName) =>
+        AssemblyLoadContext.All.SelectMany(x => x.Assemblies).Any(x => x.GetName().Name == assemblyName);
+
+    private static List<string> MappedTypeNames()
+    {
+        var entities = typeof(BsonMapper).GetField("_entities", BindingFlags.NonPublic | BindingFlags.Instance)!;
+        return ((IDictionary)entities.GetValue(BsonMapper.Global)!).Keys.Cast<Type>().Select(x => x.Name).ToList();
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManifestReaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManifestReaderTests.cs
new file mode 100644
index 0000000000..f1d6632610
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManifestReaderTests.cs
@@ -0,0 +1,92 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginManifestReaderTests
+{
+    private static readonly string CoreAssemblyPath = typeof(PluginInfoAttribute).Assembly.Location;
+
+    private string _folder;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _folder = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_folder);
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        if (Directory.Exists(_folder))
+            Directory.Delete(_folder, true);
+    }
+
+    private static string PluginSource(string attributeArguments) => $$"""
+        using Grand.Infrastructure.Plugins;
+        [assembly: PluginInfo({{attributeArguments}})]
+        """;
+
+    [TestMethod]
+    public void Read_PluginWithoutDeclaredVersion_ResolvesFromCoreReference()
+    {
+        var path = TestPluginBuilder.Compile(_folder, "Reader.NoVersion",
+            PluginSource("""SystemName = "Reader.NoVersion", FriendlyName = "No version", Group = "Misc", Author = "me", Version = "1.2" """),
+            null, CoreAssemblyPath);
+
+        var manifest = PluginManifestReader.Read(path);
+
+        Assert.IsNotNull(manifest);
+        Assert.AreEqual("Reader.NoVersion", manifest.SystemName);
+        Assert.AreEqual("No version", manifest.FriendlyName);
+        Assert.AreEqual("Misc", manifest.Group);
+        Assert.AreEqual("me", manifest.Author);
+        Assert.AreEqual("1.2", manifest.Version);
+        Assert.AreEqual(GrandVersion.SupportedPluginVersion, manifest.SupportedVersion);
+    }
+
+    [TestMethod]
+    public void Read_DeclaredVersion_IsTrimmed()
+    {
+        var path = TestPluginBuilder.Compile(_folder, "Reader.Declared",
+            PluginSource("""SystemName = "Reader.Declared", SupportedVersion = " 2.3 " """),
+            null, CoreAssemblyPath);
+
+        var manifest = PluginManifestReader.Read(path);
+
+        Assert.AreEqual("2.3", manifest.SupportedVersion);
+    }
+
+    [TestMethod]
+    public void Read_AssemblyWithoutAttribute_ReturnsNull()
+    {
+        var path = TestPluginBuilder.Compile(_folder, "Reader.Plain", "public class Plain { }");
+
+        Assert.IsNull(PluginManifestReader.Read(path));
+    }
+
+    [TestMethod]
+    public void Read_NonManagedFile_ReturnsNull()
+    {
+        var path = Path.Combine(_folder, "native.dll");
+        File.WriteAllBytes(path, System.Security.Cryptography.RandomNumberGenerator.GetBytes(4096));
+
+        Assert.IsNull(PluginManifestReader.Read(path));
+        Assert.IsFalse(PluginManifestReader.IsManagedAssembly(path));
+    }
+
+    [TestMethod]
+    public void Read_DoesNotLoadAssembly()
+    {
+        var path = TestPluginBuilder.Compile(_folder, "Reader.NotLoaded",
+            PluginSource("""SystemName = "Reader.NotLoaded" """), null, CoreAssemblyPath);
+
+        PluginManifestReader.Read(path);
+
+        Assert.IsFalse(AppDomain.CurrentDomain.GetAssemblies()
+            .Any(x => x.GetName().Name == "Reader.NotLoaded"));
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs
new file mode 100644
index 0000000000..b3024c7193
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs
@@ -0,0 +1,187 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using System.Text.Json;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginPendingChangesTests
+{
+    private PluginFolderFixture _fixture;
+    private string _installedFile;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+        _installedFile = Path.Combine(Path.GetDirectoryName(_fixture.PluginsFolder)!, "App_Data",
+            "InstalledPlugins.cfg");
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_NothingChanged_IsEmpty()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        _fixture.AddPlugin("B", "Pending.B", "Pending.B");
+        WriteInstalled("Pending.A");
+
+        var changes = PendingAfter(() => { });
+
+        Assert.IsEmpty(changes);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_MarkedInstalledAfterLoad_ReportsInstalled()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled();
+
+        var changes = PendingAfter(() => WriteInstalled("Pending.A"));
+
+        Assert.AreEqual(new PluginPendingChange("Pending.A", "A", PluginPendingChangeKind.Installed),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_MarkedUninstalledAfterLoad_ReportsUninstalled()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled("Pending.A");
+
+        var changes = PendingAfter(() => WriteInstalled());
+
+        Assert.AreEqual(new PluginPendingChange("Pending.A", "A", PluginPendingChangeKind.Uninstalled),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_NewPluginFolder_ReportsAdded()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled();
+
+        var changes = PendingAfter(() =>
+        {
+            _fixture.AddPlugin("B", "Pending.B", "Pending.B");
+            //a folder without a plugin assembly is not a plugin
+            Directory.CreateDirectory(_fixture.Folder("NotAPlugin"));
+        });
+
+        Assert.AreEqual(new PluginPendingChange("Pending.B", "B", PluginPendingChangeKind.Added), changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_NewFolderWithoutPluginAssembly_IsNotReported()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled();
+
+        var changes = PendingAfter(() =>
+        {
+            Directory.CreateDirectory(_fixture.Folder("Native"));
+            File.WriteAllBytes(Path.Combine(_fixture.Folder("Native"), "native.dll"), [0x4D, 0x5A, 1, 2, 3]);
+            TestPluginBuilder.Compile(_fixture.Folder("Library"), "Pending.Library", "public class Library { }");
+        });
+
+        Assert.IsEmpty(changes);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_LoadedFolderDeleted_ReportsRemoved()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        _fixture.AddPlugin("B", "Pending.B", "Pending.B");
+        WriteInstalled();
+
+        var changes = PendingAfter(() => Directory.Delete(_fixture.Folder("B"), true));
+
+        Assert.AreEqual(new PluginPendingChange("Pending.B", "B", PluginPendingChangeKind.Removed),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_MainDllReplaced_ReportsUpdated()
+    {
+        var main = _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled("Pending.A");
+        var loadedLength = new FileInfo(main).Length;
+
+        var changes = PendingAfter(() =>
+        {
+            _fixture.AddPlugin("A", "Pending.A", "Pending.A", "public class AddedInTheNewVersion { }");
+            Assert.AreNotEqual(loadedLength, new FileInfo(main).Length);
+        });
+
+        Assert.AreEqual(new PluginPendingChange("Pending.A", "A", PluginPendingChangeKind.Updated),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_OnlyDependencyReplaced_ReportsUpdated()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        TestPluginBuilder.Compile(_fixture.Folder("A"), "Pending.A.Dependency", "public class Dependency { }");
+        WriteInstalled("Pending.A");
+
+        var changes = PendingAfter(() => TestPluginBuilder.Compile(_fixture.Folder("A"), "Pending.A.Dependency",
+            "public class Dependency { } public class AddedInTheNewVersion { }"));
+
+        Assert.AreEqual(new PluginPendingChange("Pending.A", "A", PluginPendingChangeKind.Updated),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_PluginCopiedIntoAFolderThatHadNone_ReportsAdded()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        Directory.CreateDirectory(_fixture.Folder("B"));
+        WriteInstalled();
+
+        var changes = PendingAfter(() => _fixture.AddPlugin("B", "Pending.B", "Pending.B"));
+
+        Assert.AreEqual(new PluginPendingChange("Pending.B", "B", PluginPendingChangeKind.Added), changes.Single());
+    }
+
+    /// <summary>
+    ///     Records the state as <see cref="PluginManager.Load" /> does, applies the change and compares
+    /// </summary>
+    private IReadOnlyList<PluginPendingChange> PendingAfter(Action change)
+    {
+        var loadSnapshot = PluginManager.LoadSnapshot;
+        try
+        {
+            PluginManager.LoadSnapshot = PluginLoadSnapshot.Capture(new DirectoryInfo(_fixture.PluginsFolder),
+                _fixture.Scan(), PluginExtensions.ParseInstalledPluginsFile(_installedFile), _installedFile, null);
+
+            change();
+
+            return PluginManager.GetPendingChanges();
+        }
+        finally
+        {
+            PluginManager.LoadSnapshot = loadSnapshot;
+        }
+    }
+
+    private void WriteInstalled(params string[] systemNames)
+    {
+        Directory.CreateDirectory(Path.GetDirectoryName(_installedFile)!);
+        File.WriteAllText(_installedFile, JsonSerializer.Serialize(systemNames));
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginVersionResolverTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginVersionResolverTests.cs
index bcf6a85c96..13623b1590 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginVersionResolverTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginVersionResolverTests.cs
@@ -61,7 +61,7 @@ public void ResolveSupportedVersion_AssemblyWithoutCoreReference_ReturnsNull()
     [TestMethod]
     public void ResolveSupportedVersion_NoAssembly_ReturnsNull()
     {
-        var result = PluginVersionResolver.ResolveSupportedVersion(null, null);
+        var result = PluginVersionResolver.ResolveSupportedVersion((Assembly)null, null);
 
         Assert.IsNull(result);
     }
diff --git a/src/Tests/Grand.Infrastructure.Tests/Startup/StartupApplicationTests.cs b/src/Tests/Grand.Infrastructure.Tests/Startup/StartupApplicationTests.cs
index 9cae2e28b9..7971d2a6e7 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Startup/StartupApplicationTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Startup/StartupApplicationTests.cs
@@ -17,9 +17,9 @@ public class StartupApplicationTests
 {
     [TestMethod]
     [DoNotParallelize]
-    public void ConfigureServices_OnLiteDb_BuildsTheMappersOfAnUninstalledPlugin()
+    public void ConfigureServices_OnLiteDb_BuildsTheMappersOfAnInstalledPlugin()
     {
-        //installing a plugin uses its entities on the running site, among requests reading the same mappers
+        //an uninstalled plugin is not loaded at startup; LoadForInstall builds its mappers (PluginManagerTests)
         DataSettingsManager.Initialize(Path.Combine(Path.GetTempPath(), $"{Guid.NewGuid()}.cfg"));
         var referencedPlugins = PluginManager.ReferencedPlugins;
         try
@@ -27,7 +27,7 @@ public void ConfigureServices_OnLiteDb_BuildsTheMappersOfAnUninstalledPlugin()
             PluginManager.ReferencedPlugins = [
                 new PluginInfo(null, typeof(SampleBasePlugin).Assembly, typeof(SampleBasePlugin)) {
                     SystemName = "SamplePlugin",
-                    Installed = false
+                    Installed = true
                 }
             ];
             var configuration = new ConfigurationBuilder()
diff --git a/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs b/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
index 16c4e37cf3..d576f25536 100644
--- a/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
@@ -1,7 +1,13 @@
-using Grand.Infrastructure.Caching;
+using Grand.Domain.Configuration;
+using Grand.Infrastructure.Caching;
+using Grand.Infrastructure.Mapper;
 using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Startup;
 using Grand.Infrastructure.Tests.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
+using System.Reflection;
+using System.Runtime.Loader;
 
 namespace Grand.Infrastructure.Tests.TypeSearcher;
 
@@ -65,6 +71,116 @@ public void GetAssemblies_KeepsInstalledPluginAssembly()
         }
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetAssemblies_NothingChanged_ReturnsTheSameList()
+    {
+        var first = _typeSearcher.GetAssemblies();
+
+        Assert.AreSame(first, new TypeSearch.TypeSearcher().GetAssemblies());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetAssemblies_AfterAssemblyLoaded_IncludesIt()
+    {
+        const string name = "Grand.Infrastructure.Tests.LateLoaded";
+        var dir = Path.Combine(Path.GetTempPath(), "grand-typesearcher-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var path = TestPluginBuilder.Compile(dir, name, """
+                [assembly: System.Reflection.AssemblyProduct("grandnode")]
+                public class LateLoadedMarker { }
+                """);
+
+            Assert.DoesNotContain(x => x.GetName().Name == name, _typeSearcher.GetAssemblies());
+
+            // The type cache keeps the assembly reachable, so the context is never unloaded; the
+            // fixture holds one inert class and implements nothing a scan looks for.
+            var context = new AssemblyLoadContext("late-loaded", true);
+            using var stream = new MemoryStream(File.ReadAllBytes(path));
+            var loaded = context.LoadFromStream(stream);
+
+            Assert.Contains(loaded, _typeSearcher.GetAssemblies());
+        }
+        finally
+        {
+            Directory.Delete(dir, true);
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetAssemblies_SameAssemblyInTwoContexts_IncludesBoth()
+    {
+        const string name = "Grand.Infrastructure.Tests.SharedLibrary";
+        var dir = Path.Combine(Path.GetTempPath(), "grand-typesearcher-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            //as two plugins each shipping the same library load it, each into its own context
+            var path = TestPluginBuilder.Compile(dir, name, """
+                [assembly: System.Reflection.AssemblyProduct("grandnode")]
+                public class SharedLibraryMarker { }
+                """);
+            var copies = new[] { "shared-one", "shared-two" }.Select(contextName =>
+            {
+                using var stream = new MemoryStream(File.ReadAllBytes(path));
+                return new AssemblyLoadContext(contextName, true).LoadFromStream(stream);
+            }).ToList();
+
+            var assemblies = _typeSearcher.GetAssemblies();
+
+            Assert.Contains(copies[0], assemblies);
+            Assert.Contains(copies[1], assemblies);
+        }
+        finally
+        {
+            Directory.Delete(dir, true);
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetAssemblies_AfterReferencedPluginsReplaced_Recomputes()
+    {
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [SamplePluginInfo(true)];
+            Assert.Contains(typeof(SampleBasePlugin).Assembly, _typeSearcher.GetAssemblies());
+
+            PluginManager.ReferencedPlugins = [SamplePluginInfo(false)];
+            Assert.DoesNotContain(typeof(SampleBasePlugin).Assembly, _typeSearcher.GetAssemblies());
+
+            PluginManager.ReferencedPlugins = [SamplePluginInfo(true)];
+            Assert.Contains(typeof(SampleBasePlugin).Assembly, _typeSearcher.GetAssemblies());
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void ClassesOfType_SameResultAsUncachedScan()
+    {
+        foreach (var type in new[] { typeof(IStartupApplication), typeof(ISettings), typeof(IAutoMapperProfile) })
+        {
+            var expected = UncachedScan(type, _typeSearcher.GetAssemblies());
+
+            CollectionAssert.AreEquivalent(expected, _typeSearcher.ClassesOfType(type).ToList());
+            CollectionAssert.AreEquivalent(expected, _typeSearcher.ClassesOfType(type).ToList());
+        }
+    }
+
+    private static List<Type> UncachedScan(Type assignTypeFrom, IEnumerable<Assembly> assemblies)
+    {
+        return assemblies.SelectMany(a => a.GetTypes())
+            .Where(t => assignTypeFrom.IsAssignableFrom(t) && !t.IsInterface && t.IsClass && !t.IsAbstract)
+            .ToList();
+    }
+
     private static PluginInfo SamplePluginInfo(bool installed)
     {
         return new PluginInfo(null, typeof(SampleBasePlugin).Assembly, typeof(SampleBasePlugin)) {
diff --git a/src/Tests/Grand.Modules.Tests/Plugins/Shipping/ByWeightShippingCalcPluginTests.cs b/src/Tests/Grand.Modules.Tests/Plugins/Shipping/ByWeightShippingCalcPluginTests.cs
new file mode 100644
index 0000000000..6601f238d2
--- /dev/null
+++ b/src/Tests/Grand.Modules.Tests/Plugins/Shipping/ByWeightShippingCalcPluginTests.cs
@@ -0,0 +1,56 @@
+using Grand.Business.Core.Interfaces.Catalog.Prices;
+using Grand.Business.Core.Interfaces.Catalog.Products;
+using Grand.Business.Core.Interfaces.Checkout.CheckoutAttributes;
+using Grand.Business.Core.Interfaces.Checkout.Shipping;
+using Grand.Business.Core.Interfaces.Common.Directory;
+using Grand.Business.Core.Utilities.Checkout;
+using Grand.Domain.Catalog;
+using Grand.Domain.Common;
+using Grand.Domain.Customers;
+using Grand.Domain.Orders;
+using Grand.Domain.Shipping;
+using Grand.Infrastructure;
+using Grand.Web.Common.Localization;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using Shipping.ByWeight;
+using Shipping.ByWeight.Services;
+
+namespace Grand.Modules.Tests.Plugins.Shipping;
+
+[TestClass]
+public class ByWeightShippingCalcPluginTests
+{
+    [TestMethod]
+    public async Task GetShippingOptions_CustomerWithoutCheckoutAttributes_DoesNotThrow()
+    {
+        var product = new Product { Weight = 2 };
+        var productService = new Mock<IProductService>();
+        productService.Setup(x => x.GetProductById(product.Id, It.IsAny<bool>())).ReturnsAsync(product);
+        var contextAccessor = new Mock<IContextAccessor>();
+        contextAccessor.Setup(x => x.StoreContext.CurrentStore).Returns(new Grand.Domain.Stores.Store());
+        contextAccessor.Setup(x => x.WorkContext.CurrentCustomer).Returns(new Customer());
+        var shippingMethodService = new Mock<IShippingMethodService>();
+        shippingMethodService
+            .Setup(x => x.GetAllShippingMethods(It.IsAny<string>(), It.IsAny<Customer>(), It.IsAny<string>()))
+            .ReturnsAsync(new List<ShippingMethod>());
+        var provider = new ByWeightShippingCalcPlugin(shippingMethodService.Object, contextAccessor.Object,
+            Mock.Of<IRequestTranslationService>(), productService.Object, Mock.Of<ICheckoutAttributeParser>(),
+            Mock.Of<ICurrencyService>(), Mock.Of<IPricingService>(), Mock.Of<IShippingByWeightService>(),
+            new ByWeightShippingSettings());
+        //a customer who never chose checkout attributes, or whose choice the last order cleared
+        var request = new GetShippingOptionRequest {
+            Customer = new Customer(),
+            StoreId = "store",
+            ShippingAddress = new Address(),
+            Items = [
+                new GetShippingOptionRequest.PackageItem(new ShoppingCartItem
+                    { ProductId = product.Id, Quantity = 1, IsFreeShipping = true })
+            ]
+        };
+
+        var response = await provider.GetShippingOptions(request);
+
+        Assert.IsTrue(response.Success);
+    }
+}
diff --git a/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs b/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs
new file mode 100644
index 0000000000..b9dbaf9c79
--- /dev/null
+++ b/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs
@@ -0,0 +1,51 @@
+using Grand.Domain.Permissions;
+using Grand.Web.Admin.Components;
+using Grand.Web.Common.Security.Authorization;
+using Microsoft.AspNetCore.Mvc.ViewComponents;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Web.Admin.Tests.Components;
+
+[TestClass]
+public class PluginRestartNoticeViewComponentTests
+{
+    [TestMethod]
+    public async Task InvokeAsync_WithoutPluginsPermission_RendersNothing()
+    {
+        var permissionService = new Mock<IRequestPermissionService>();
+        permissionService.Setup(x => x.Authorize(StandardPermission.ManagePlugins)).ReturnsAsync(false);
+
+        var result = await new PluginRestartNoticeViewComponent(permissionService.Object).InvokeAsync();
+
+        Assert.IsInstanceOfType(result, typeof(ContentViewComponentResult));
+    }
+
+    [TestMethod]
+    public async Task InvokeAsync_NoPendingChanges_RendersNothing()
+    {
+        //plugins are never loaded in this test process, so nothing is pending
+        var permissionService = new Mock<IRequestPermissionService>();
+        permissionService.Setup(x => x.Authorize(StandardPermission.ManagePlugins)).ReturnsAsync(true);
+
+        var result = await new PluginRestartNoticeViewComponent(permissionService.Object).InvokeAsync();
+
+        Assert.IsInstanceOfType(result, typeof(ContentViewComponentResult));
+        permissionService.Verify(x => x.Authorize(StandardPermission.ManagePlugins), Times.Once);
+    }
+
+    [TestMethod]
+    public void View_UsesTheAdminNoteMarkup()
+    {
+        //the admin UI guide keeps genuine messages in note note-*, like the other warning components
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir != null && !Directory.Exists(Path.Combine(dir.FullName, "src", "Web")))
+            dir = dir.Parent;
+        Assert.IsNotNull(dir, "repository root not found");
+        var source = File.ReadAllText(Path.Combine(dir.FullName, "src", "Web", "Grand.Web.Admin", "Areas", "Admin",
+            "Views", "Shared", "Components", "PluginRestartNotice", "Default.cshtml"));
+
+        Assert.Contains("class=\"note note-warning\"", source);
+        Assert.DoesNotContain("alert", source);
+    }
+}
diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
new file mode 100644
index 0000000000..3b940cf09d
--- /dev/null
+++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
@@ -0,0 +1,418 @@
+using Grand.Domain.Customers;
+using Grand.Infrastructure;
+using Grand.Infrastructure.Configuration;
+using Grand.Infrastructure.Plugins;
+using Grand.Web.Admin.Controllers;
+using Grand.Web.Common.Audit;
+using Grand.Web.Common.Localization;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Routing;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using System.Reflection;
+
+namespace Grand.Web.Admin.Tests.Controllers;
+
+[TestClass]
+public class PluginControllerTests
+{
+    private const string SystemName = "Tests.Plugin";
+
+    private string _contentRoot;
+    private ExtensionsConfig _extConfig;
+    private Mock<IHostApplicationLifetime> _applicationLifetime;
+    private Mock<IAuditEventRecorder> _auditEventRecorder;
+    private Mock<IPlugin> _plugin;
+    private Mock<IServiceProvider> _serviceProvider;
+    private PluginController _controller;
+
+    [TestInitialize]
+    public void Setup()
+    {
+        _contentRoot = Path.Combine(Path.GetTempPath(), "grand-plugin-controller-tests", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_contentRoot);
+
+        _extConfig = new ExtensionsConfig();
+        _applicationLifetime = new Mock<IHostApplicationLifetime>();
+        _auditEventRecorder = new Mock<IAuditEventRecorder>();
+        _plugin = new Mock<IPlugin>();
+        _serviceProvider = new Mock<IServiceProvider>();
+        _serviceProvider.Setup(x => x.GetService(typeof(IPlugin))).Returns(_plugin.Object);
+
+        var translationService = new Mock<IRequestTranslationService>();
+        translationService.Setup(x => x.GetResource(It.IsAny<string>())).Returns((string key) => key);
+
+        var workContext = new Mock<IWorkContext>();
+        workContext.Setup(x => x.CurrentCustomer).Returns(new Customer { Email = "admin@example.com" });
+        var contextAccessor = new Mock<IContextAccessor>();
+        contextAccessor.Setup(x => x.WorkContext).Returns(workContext.Object);
+
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(_contentRoot);
+
+        _controller = new PluginController(
+            translationService.Object,
+            new Mock<ILogger<PluginController>>().Object,
+            _applicationLifetime.Object,
+            contextAccessor.Object,
+            _serviceProvider.Object,
+            new Mock<IEnumTranslationService>().Object,
+            hostEnvironment.Object,
+            _extConfig,
+            _auditEventRecorder.Object);
+
+        //RedirectToAction builds its URL helper, and an error notification logs, through the request services
+        var urlHelperFactory = new Mock<IUrlHelperFactory>();
+        urlHelperFactory.Setup(x => x.GetUrlHelper(It.IsAny<ActionContext>())).Returns(new Mock<IUrlHelper>().Object);
+        var httpContext = new DefaultHttpContext {
+            RequestServices = new ServiceCollection()
+                .AddLogging()
+                .AddSingleton(urlHelperFactory.Object)
+                .BuildServiceProvider()
+        };
+        _controller.ControllerContext = new ControllerContext { HttpContext = httpContext };
+        _controller.TempData = new TempDataDictionary(httpContext, new Mock<ITempDataProvider>().Object);
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        Directory.Delete(_contentRoot, true);
+    }
+
+    [TestMethod]
+    public void ReloadList_IsPostOnly()
+    {
+        var method = typeof(PluginController).GetMethod(nameof(PluginController.ReloadList));
+        Assert.IsNotNull(method);
+        Assert.IsNotNull(method.GetCustomAttribute<HttpPostAttribute>());
+        Assert.IsNull(method.GetCustomAttribute<HttpGetAttribute>());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_DoesNotStopApplication()
+    {
+        await WithPlugins(async () =>
+        {
+            await _controller.Install(SystemName);
+
+            _plugin.Verify(x => x.Install(), Times.Once);
+            _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+        }, Plugin(false));
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Uninstall_DoesNotStopApplication()
+    {
+        await WithPlugins(async () =>
+        {
+            await _controller.Uninstall(SystemName);
+
+            _plugin.Verify(x => x.Uninstall(), Times.Once);
+            _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+        }, Plugin(true));
+    }
+
+    [TestMethod]
+    public async Task ReloadList_StopsApplicationAndAudits()
+    {
+        await _controller.ReloadList();
+
+        _auditEventRecorder.Verify(x => x.Plugin("*", "restarted"), Times.Once);
+        _applicationLifetime.Verify(x => x.StopApplication(), Times.Once);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Remove_InstalledPlugin_DoesNotDeleteFolder()
+    {
+        var folder = Path.Combine(_contentRoot, "Plugins", "Tests.Plugin");
+        Directory.CreateDirectory(folder);
+        var mainAssembly = Path.Combine(folder, "Tests.Plugin.dll");
+        await File.WriteAllTextAsync(mainAssembly, "");
+        var plugin = new PluginInfo(new FileInfo(mainAssembly), null, typeof(IPlugin)) {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion,
+            Installed = true
+        };
+
+        await WithPlugins(async () =>
+        {
+            await _controller.Remove(SystemName, "Tests.Plugin");
+
+            Assert.IsTrue(Directory.Exists(folder));
+            _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+        }, plugin);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_WhenInstalledPluginsConfigured_DoesNotInstall()
+    {
+        _extConfig.InstalledPlugins = "Other.Plugin";
+
+        await WithPlugins(async () =>
+        {
+            await _controller.Install(SystemName);
+
+            _plugin.Verify(x => x.Install(), Times.Never);
+        }, Plugin(false));
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_ShowsTheAfterRestartText()
+    {
+        await WithPlugins(async () =>
+        {
+            await _controller.Install(SystemName);
+
+            CollectionAssert.Contains(Notifications("Success"), "Admin.Plugins.Installed.AfterRestart");
+        }, Plugin(false));
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Uninstall_PluginWithLoadError_MarksUninstalledWithoutInstance()
+    {
+        var plugin = BrokenPlugin(null);
+
+        await WithInstalledFile(async installedFile =>
+        {
+            await WithPlugins(async () =>
+            {
+                await _controller.Uninstall(SystemName);
+
+                CollectionAssert.DoesNotContain(PluginExtensions.ParseInstalledPluginsFile(installedFile).ToList(),
+                    SystemName);
+                _serviceProvider.Verify(x => x.GetService(It.IsAny<Type>()), Times.Never);
+                _plugin.Verify(x => x.Uninstall(), Times.Never);
+                _auditEventRecorder.Verify(x => x.Plugin(SystemName, "uninstalled"), Times.Once);
+                CollectionAssert.Contains(Notifications("Warning"), "Admin.Plugins.Uninstalled.NotCleanedUp");
+                _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+            }, plugin);
+        });
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Remove_AfterUninstallOfBrokenPlugin_DeletesFolder()
+    {
+        var folder = Path.Combine(_contentRoot, "Plugins", "Tests.Plugin");
+        Directory.CreateDirectory(folder);
+        var mainAssembly = Path.Combine(folder, "Tests.Plugin.dll");
+        await File.WriteAllTextAsync(mainAssembly, "");
+        var plugin = BrokenPlugin(new FileInfo(mainAssembly));
+
+        await WithInstalledFile(async _ =>
+        {
+            await WithPlugins(async () =>
+            {
+                await _controller.Uninstall(SystemName);
+                await _controller.Remove(SystemName, "Tests.Plugin");
+
+                Assert.IsFalse(Directory.Exists(folder));
+                _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+            }, plugin);
+        });
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Remove_SecondFolderOfASystemName_DeletesOnlyThatFolder()
+    {
+        var working = Path.Combine(_contentRoot, "Plugins", "Tests.Plugin");
+        Directory.CreateDirectory(working);
+        var mainAssembly = Path.Combine(working, "Tests.Plugin.dll");
+        await File.WriteAllTextAsync(mainAssembly, "");
+        var copy = Directory.CreateDirectory(Path.Combine(_contentRoot, "Plugins", "Tests.Plugin.Copy")).FullName;
+        var plugin = new PluginInfo(new FileInfo(mainAssembly), null, typeof(IPlugin)) {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion
+        };
+        var duplicate = PluginLoader.DescribeProblem(
+            new PluginLoadProblem("Tests.Plugin.Copy", "already used", [SystemName]), []).Single();
+
+        await WithPlugins(async () =>
+        {
+            await _controller.Remove(SystemName, "Tests.Plugin.Copy");
+
+            Assert.IsFalse(Directory.Exists(copy));
+            Assert.IsTrue(Directory.Exists(working));
+        }, plugin, duplicate);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Remove_FolderWhosePluginWasNotIdentified_DeletesIt()
+    {
+        var folder = Directory.CreateDirectory(Path.Combine(_contentRoot, "Plugins", "Broken")).FullName;
+        var entry = PluginLoader.DescribeProblem(new PluginLoadProblem("Broken", "has no SystemName"), []).Single();
+
+        await WithPlugins(async () =>
+        {
+            await _controller.Remove("Broken", "Broken");
+
+            Assert.IsFalse(Directory.Exists(folder));
+            CollectionAssert.Contains(Notifications("Success"), "Admin.Plugins.Removed.AfterRestart");
+        }, entry);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_AfterRemoveBeforeRestart_Refuses()
+    {
+        await WithLoadedFolder(false, folder => Directory.Delete(folder, true), async installedFile =>
+        {
+            await _controller.Install(SystemName);
+
+            _plugin.Verify(x => x.Install(), Times.Never);
+            Assert.IsEmpty(PluginExtensions.ParseInstalledPluginsFile(installedFile));
+            CollectionAssert.Contains(Notifications("Error"), "Admin.Plugins.RestartFirst");
+        });
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_AfterUpdateBeforeRestart_Refuses()
+    {
+        await WithLoadedFolder(false, ReplaceMainAssembly, async installedFile =>
+        {
+            await _controller.Install(SystemName);
+
+            _plugin.Verify(x => x.Install(), Times.Never);
+            Assert.IsEmpty(PluginExtensions.ParseInstalledPluginsFile(installedFile));
+            CollectionAssert.Contains(Notifications("Error"), "Admin.Plugins.RestartFirst");
+        });
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Uninstall_AfterUpdateBeforeRestart_Refuses()
+    {
+        await WithLoadedFolder(true, ReplaceMainAssembly, async installedFile =>
+        {
+            await _controller.Uninstall(SystemName);
+
+            _plugin.Verify(x => x.Uninstall(), Times.Never);
+            CollectionAssert.Contains(PluginExtensions.ParseInstalledPluginsFile(installedFile).ToList(), SystemName);
+            CollectionAssert.Contains(Notifications("Error"), "Admin.Plugins.RestartFirst");
+        });
+    }
+
+    /// <summary>
+    ///     Runs with the plugin loaded from its folder as PluginManager.Load records it, after
+    ///     <paramref name="changeOnDisk" /> changed that folder
+    /// </summary>
+    private async Task WithLoadedFolder(bool installed, Action<string> changeOnDisk, Func<string, Task> test)
+    {
+        var pluginsFolder = new DirectoryInfo(Path.Combine(_contentRoot, "Plugins"));
+        var folder = Directory.CreateDirectory(Path.Combine(pluginsFolder.FullName, "Tests.Plugin"));
+        var mainAssembly = Path.Combine(folder.FullName, "Tests.Plugin.dll");
+        await File.WriteAllTextAsync(mainAssembly, "version 1");
+        var manifest = new PluginManifest(SystemName, SystemName, "Misc", "Tests", "1.0",
+            GrandVersion.SupportedPluginVersion);
+        var scan = new PluginScanResult(
+            [new PluginCandidate(folder, mainAssembly, manifest, [mainAssembly], [SystemName])], [], []);
+        var plugin = new PluginInfo(new FileInfo(mainAssembly), null, typeof(IPlugin)) {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion,
+            Installed = installed
+        };
+
+        await WithInstalledFile(async installedFile =>
+        {
+            var loadSnapshot = PluginManager.LoadSnapshot;
+            try
+            {
+                PluginManager.LoadSnapshot = PluginLoadSnapshot.Capture(pluginsFolder, scan,
+                    PluginExtensions.ParseInstalledPluginsFile(installedFile), installedFile, null);
+                changeOnDisk(folder.FullName);
+
+                await WithPlugins(() => test(installedFile), plugin);
+            }
+            finally
+            {
+                PluginManager.LoadSnapshot = loadSnapshot;
+            }
+        }, installed ? [SystemName] : []);
+    }
+
+    private static void ReplaceMainAssembly(string folder)
+    {
+        File.WriteAllText(Path.Combine(folder, "Tests.Plugin.dll"), "version 2, a different build");
+    }
+
+    private List<string> Notifications(string type)
+    {
+        return _controller.TempData[$"grand.notifications.{type}"] as List<string> ?? [];
+    }
+
+    /// <summary>
+    ///     An installed plugin as loading leaves one that failed: with its load error and without a plugin type,
+    ///     so no instance can be created
+    /// </summary>
+    private static PluginInfo BrokenPlugin(FileInfo mainAssembly)
+    {
+        return new PluginInfo(mainAssembly, null, null) {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion,
+            Installed = true,
+            LoadError = "Could not load file or assembly 'Tests.Plugin.Dependency'."
+        };
+    }
+
+    /// <summary>
+    ///     Runs with the installed-plugins file listing <paramref name="installed" /> (by default the plugin),
+    ///     and removes it afterwards
+    /// </summary>
+    private async Task WithInstalledFile(Func<string, Task> test, string[] installed = null)
+    {
+        //initialized once per process; a later call keeps the first path
+        PluginPaths.Initialize(Path.Combine(_contentRoot, "App_Data", "InstalledPlugins.cfg"));
+        var installedFile = PluginPaths.Instance.InstalledPluginsFile;
+        Directory.CreateDirectory(Path.GetDirectoryName(installedFile)!);
+        await File.WriteAllTextAsync(installedFile,
+            System.Text.Json.JsonSerializer.Serialize(installed ?? [SystemName]));
+        try
+        {
+            await test(installedFile);
+        }
+        finally
+        {
+            File.Delete(installedFile);
+        }
+    }
+
+    private static PluginInfo Plugin(bool installed)
+    {
+        return new PluginInfo {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion,
+            PluginType = typeof(IPlugin),
+            Installed = installed
+        };
+    }
+
+    private static async Task WithPlugins(Func<Task> test, params PluginInfo[] plugins)
+    {
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = plugins;
+            await test();
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+}
diff --git a/src/Tests/Grand.Web.Common.Tests/Infrastructure/PluginLoadContextApplicationPartsTests.cs b/src/Tests/Grand.Web.Common.Tests/Infrastructure/PluginLoadContextApplicationPartsTests.cs
new file mode 100644
index 0000000000..24586d3fce
--- /dev/null
+++ b/src/Tests/Grand.Web.Common.Tests/Infrastructure/PluginLoadContextApplicationPartsTests.cs
@@ -0,0 +1,63 @@
+using Grand.Infrastructure.Plugins;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.ApplicationParts;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.AspNetCore.Mvc.Razor.Compilation;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Web.Common.Tests.Infrastructure;
+
+/// <summary>
+///     A real built plugin, loaded into a context of its own as the application loads it: MVC must still find its
+///     controllers and its precompiled views. Inconclusive when the plugin has not been built.
+/// </summary>
+[TestClass]
+public class PluginLoadContextApplicationPartsTests
+{
+    private const string PluginName = "Widgets.Slider";
+
+    [TestMethod]
+    public void BuiltPlugin_InItsOwnContext_ControllersAndCompiledViewsAreDiscovered()
+    {
+        var path = Path.GetFullPath(Path.Combine(AppContext.BaseDirectory, "..", "..", "..", "..", "..", "Web",
+            "Grand.Web", "Plugins", PluginName, PluginName + ".dll"));
+        if (!File.Exists(path))
+            Assert.Inconclusive($"{path} is not built; run dotnet build src/Plugins/{PluginName}");
+
+        var context = new IsolatedLoadContext(PluginName, path, PluginManager.HostAssemblyNames(), true);
+        try
+        {
+            var assembly = context.LoadFromAssemblyPath(path);
+            //as PluginManager adds an installed plugin; the Razor view engine brings the compiled-views provider
+            var partManager = new ServiceCollection().AddMvcCore().AddRazorViewEngine().AddApplicationPart(assembly)
+                .PartManager;
+
+            var controllers = new ControllerFeature();
+            partManager.PopulateFeature(controllers);
+            var views = new ViewsFeature();
+            partManager.PopulateFeature(views);
+
+            Assert.IsTrue(controllers.Controllers.Any(x => x.Assembly == assembly), "no controller of the plugin");
+            var pluginViews = views.ViewDescriptors.Where(x => x.Type?.Assembly == assembly).ToList();
+            Assert.IsNotEmpty(pluginViews, "no compiled view of the plugin");
+            CollectionAssert.IsSubsetOf(
+                new[] {
+                    "/Areas/Admin/Views/WidgetsSlider/Configure.cshtml",
+                    "/Views/Shared/Components/WidgetSlider/Default.cshtml"
+                },
+                pluginViews.Select(x => x.RelativePath).ToList());
+            //the host's MVC types, not copies: the context took them from the default one
+            Assert.IsTrue(controllers.Controllers.Where(x => x.Assembly == assembly)
+                .All(x => typeof(ControllerBase).IsAssignableFrom(x)));
+            //Razor runtime compilation (Development) reads every part's references through the plugin's deps.json,
+            //which the plugin folder now keeps
+            foreach (var part in partManager.ApplicationParts.OfType<ICompilationReferencesProvider>())
+                _ = part.GetReferencePaths().ToList();
+        }
+        finally
+        {
+            context.Unload();
+        }
+    }
+}
diff --git a/src/Web/Grand.Web.Admin/App_Data/appsettings.json b/src/Web/Grand.Web.Admin/App_Data/appsettings.json
index 52adfd707b..e76fdf99e2 100644
--- a/src/Web/Grand.Web.Admin/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Admin/App_Data/appsettings.json
@@ -133,7 +133,9 @@
     //For develop you should enable if you want to copy plugin dll files to directory /Plugins/bin on application startup
     "PluginShadowCopy": true,
     //separator comma
-    "InstalledPlugins": ""
+    "InstalledPlugins": "",
+    //Stop the application when an installed plugin or an enabled module fails to load; false starts without it, shows a plugin's error on the admin plugin list and logs a module's as critical
+    "FailOnPluginLoadError": false
   },
   "AccessControl": {
     /// A value indicating whether to ignore ACL rules 
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
index 67f75c6e5d..cd4c21f4fe 100644
--- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
@@ -8,14 +8,16 @@
     var remove = Url.Action("Remove", "Plugin", new { area = Constants.AreaAdmin });
 }
 <form asp-area="@Constants.AreaAdmin" asp-controller="Plugin" asp-action="List" method="post" id="plugins-form">
-    @* the reload link stays inside the form: its handler below is delegated from #plugins-form. Upload
-       is the one primary action; the load-mode filter only toggles a class on the table, so its
+    @* the reload button restarts the application with a script POST (the [data-plugin-restart] handler in
+       _AdminLayout, shared with the restart notice), so it is a plain button and no form nests in this one.
+       Upload is the one primary action; the load-mode filter only toggles a class on the table, so its
        button is a plain button, not a submit *@
     <admin-page title="@Loc["Admin.Plugins.Local"]" icon="bi-plug">
         <page-actions>
-            <a href="@Url.Action("ReloadList", new { area = Constants.AreaAdmin })" class="btn btn-outline-secondary" id="reload-plugin-list">
+            <button type="button" class="btn btn-outline-secondary" id="reload-plugin-list" data-plugin-restart
+                    data-url="@Url.Action("ReloadList", "Plugin", new { area = Constants.AreaAdmin })">
                 <i class="bi bi-arrow-clockwise"></i> @Loc["Admin.Plugins.ReloadList"]
-            </a>
+            </button>
             <button type="button" id="importfile" class="btn btn-primary">
                 <i class="bi bi-upload"></i> @Loc["Admin.Plugins.Upload"]
             </button>
@@ -78,15 +80,6 @@
                 $("html, body").animate({ scrollTop: 0 }, 400);
                 return true;
             });
-            $("#plugins-form").on("click", "#reload-plugin-list", function (e) {
-                event.preventDefault();
-                showThrobber('@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Plugins.Fields.Reload.List"]))')
-                $("html, body").animate({ scrollTop: 0 }, 400);
-                $.get($(this).attr("href"), function (data) { });
-                setTimeout(function () {
-                    location.reload();
-                }, 10000);
-            });
         });
 
         function additionalData() {
@@ -115,7 +108,8 @@
 
                 var groupedData = data.Data.reduce(function (result, current) {
 
-                    if (typeof current['Group'] === 'undefined')
+                    //a folder that failed before its manifest was read has no group
+                    if (current['Group'] == null)
                         current['Group'] = "All";
 
                     result[current['Group']] = result[current['Group']] || [];
@@ -136,8 +130,10 @@
                             if (item.Group == key) {
                                 $("#" + keyId + "").append("<li id='" + item.SystemName + "' class='item-installed-" + item.Installed + "'>" +
                                     "<div class='logo'><img src='" + item.LogoUrl + "'></img></div>" +
-                                    "<div class='content'><div class='title'>" + item.FriendlyName + "<span class='install-" + item.Installed + "'>@Loc["Admin.Plugins.Fields.Installed"]</span></div><ul class='info'><li class='version'><span>@Loc["Admin.Plugins.Fields.Version"]:</span>" + item.Version + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.Author"]:</span>" + item.Author + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.SystemName"]:</span>" + item.SystemName + "</li></div></div>" +
-                                    "<div class='buttons'><a class='btn btn-outline-secondary btn-sm button-" + item.ConfigurationUrl + "' href='" + item.ConfigurationUrl + "'>@Loc["Admin.Plugins.Fields.Configure"]</a><input type='submit' formaction='@(installurl)?SystemName=" + item.SystemName + "' name='install-plugin-link-" + item.SystemName + "' class='btn btn-outline-secondary btn-sm install-plugin-link button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Install"]' /><input type='submit' formaction='@(uninstallurl)?SystemName=" + item.SystemName + "' name='uninstall-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm uninstall-plugin-link button-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Uninstall"]' /><input type='submit' formaction='@(remove)?SystemName=" + item.SystemName + "' name='remove-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Remove"]' /></div>"
+                                    "<div class='content'><div class='title'>" + item.FriendlyName + "<span class='install-" + item.Installed + "'>@Loc["Admin.Plugins.Fields.Installed"]</span></div><ul class='info'><li class='version'><span>@Loc["Admin.Plugins.Fields.Version"]:</span>" + item.Version + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.Author"]:</span>" + item.Author + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.SystemName"]:</span>" + item.SystemName + "</li>" +
+                                    (item.LoadError ? "<li class='version text-danger'><span>@Loc["Admin.Plugins.LoadError"]:</span>" + GrandAdmin.htmlEncode(item.LoadError) + "</li>" : "") +
+                                    "</div></div>" +
+                                    "<div class='buttons'><a class='btn btn-outline-secondary btn-sm button-" + item.ConfigurationUrl + "' href='" + item.ConfigurationUrl + "'>@Loc["Admin.Plugins.Fields.Configure"]</a><input type='submit' formaction='@(installurl)?SystemName=" + item.SystemName + "' name='install-plugin-link-" + item.SystemName + "' class='btn btn-outline-secondary btn-sm install-plugin-link button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Install"]' /><input type='submit' formaction='@(uninstallurl)?SystemName=" + item.SystemName + "' name='uninstall-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm uninstall-plugin-link button-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Uninstall"]' /><input type='submit' formaction='@(remove)?SystemName=" + item.SystemName + "&folderName=" + encodeURIComponent(item.FolderName || "") + "' name='remove-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Remove"]' /></div>"
                                 +"</li>");
                             }
                         });
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml
new file mode 100644
index 0000000000..da12b0e63e
--- /dev/null
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml
@@ -0,0 +1,24 @@
+@using Grand.Infrastructure.Plugins
+@model IReadOnlyList<PluginPendingChange>
+@* the restart button is handled in _AdminLayout ([data-plugin-restart]), like the header's restart link *@
+<div class="note note-warning" role="status" id="plugin-restart-notice">
+    <div class="d-flex flex-wrap align-items-center gap-2">
+        <strong class="me-auto">
+            <i class="bi bi-exclamation-triangle" aria-hidden="true"></i> @Loc["Admin.Plugins.RestartRequired"]
+        </strong>
+        <button type="button" class="btn btn-outline-secondary btn-sm" data-plugin-restart
+                data-url="@Url.Action("ReloadList", "Plugin", new { area = Constants.AreaAdmin })">
+            <i class="bi bi-arrow-clockwise" aria-hidden="true"></i> @Loc["Admin.Plugins.RestartNow"]
+        </button>
+    </div>
+    <ul class="mb-0 mt-2">
+        @foreach (var change in Model)
+        {
+            <li><strong>@change.SystemName</strong> - @Loc[$"Admin.Plugins.RestartRequired.{change.Kind}"]</li>
+        }
+    </ul>
+    @if (Model.Any(x => x.Kind == PluginPendingChangeKind.Uninstalled))
+    {
+        <p class="mb-0 mt-2">@Loc["Admin.Plugins.RestartRequired.UninstallWarning"]</p>
+    }
+</div>
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml
index 78ddcf1d89..cc4e269b5c 100644
--- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml
@@ -247,6 +247,10 @@
         }
 
         <div class="right_col" role="main">
+            @if (!IsSectionDefined("popupwindow"))
+            {
+                @await Component.InvokeAsync("PluginRestartNotice")
+            }
             <partial name="Partials/Notifications"/>
             @RenderBody()
         </div>
@@ -287,6 +291,23 @@
                     }, 10000);
                 });
             });
+            //the plugin restart: the notice above every page and the plugin list's reload button
+            $(document).on("click", "[data-plugin-restart]", function (e) {
+                e.preventDefault();
+                var url = $(this).data("url");
+                GrandAdmin.modal.confirm('@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Common.AreYouSure"]))', {
+                    title: '@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Plugins.RestartNow"]))',
+                    confirmText: '@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Common.Yes"]))',
+                    cancelText: '@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Common.No"]))'
+                }).then(function (confirmed) {
+                    if (!confirmed) return;
+                    showThrobber('@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Header.RestartApplication.Progress"]))');
+                    $.post(url, addAntiForgeryToken({}));
+                    setTimeout(function () {
+                        location.reload();
+                    }, 10000);
+                });
+            });
         });
     </script>
 </body>
diff --git a/src/Web/Grand.Web.Admin/Components/PluginRestartNoticeViewComponent.cs b/src/Web/Grand.Web.Admin/Components/PluginRestartNoticeViewComponent.cs
new file mode 100644
index 0000000000..4485ecb08e
--- /dev/null
+++ b/src/Web/Grand.Web.Admin/Components/PluginRestartNoticeViewComponent.cs
@@ -0,0 +1,33 @@
+using Grand.Domain.Permissions;
+using Grand.Infrastructure.Plugins;
+using Grand.Web.Common.Components;
+using Grand.Web.Common.Security.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Grand.Web.Admin.Components;
+
+/// <summary>
+///     Lists the plugin changes waiting for a restart. Computed on every request, not cached: the notice goes
+///     away right after the restart and shows changes another administrator made.
+/// </summary>
+public class PluginRestartNoticeViewComponent : BaseAdminViewComponent
+{
+    private readonly IRequestPermissionService _permissionService;
+
+    public PluginRestartNoticeViewComponent(IRequestPermissionService permissionService)
+    {
+        _permissionService = permissionService;
+    }
+
+    public async Task<IViewComponentResult> InvokeAsync()
+    {
+        if (!await _permissionService.Authorize(StandardPermission.ManagePlugins))
+            return Content("");
+
+        var changes = PluginManager.GetPendingChanges();
+        if (changes.Count == 0)
+            return Content("");
+
+        return View(changes);
+    }
+}
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index 3a20a9606f..b8fcd30173 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -12,8 +12,6 @@
 using Grand.Web.Common.Localization;
 using Grand.Web.Common.Security.Authorization;
 using Microsoft.AspNetCore.Mvc;
-using System.IO.Compression;
-using System.Reflection;
 
 namespace Grand.Web.Admin.Controllers;
 
@@ -41,8 +39,9 @@ protected virtual PluginModel PreparePluginModel(PluginInfo PluginInfo)
         //logo
         pluginModel.LogoUrl = PluginInfo.GetLogoUrl(Request.PathBase);
 
-        //configuration URLs
-        if (PluginInfo.Installed)
+        //configuration URLs only for an active plugin, which was loaded at startup: listing never loads one,
+        //and a plugin that failed to load has no instance - its LoadError is shown instead
+        if (PluginInfo.IsActive)
         {
             var pluginInstance = PluginInfo.Instance(serviceProvider);
             pluginModel.ConfigurationUrl = pluginInstance.ConfigurationUrl();
@@ -71,16 +70,57 @@ protected void DeleteDirectory(string path)
 
     }
 
-    protected static byte[] ToByteArray(Stream stream)
+    /// <summary>
+    ///     The plugin's changes waiting for the restart, matched by system name and by folder
+    /// </summary>
+    private static List<PluginPendingChange> PendingChangesOf(PluginInfo pluginInfo)
     {
-        using (stream)
-        {
-            using (var memStream = new MemoryStream())
-            {
-                stream.CopyTo(memStream);
-                return memStream.ToArray();
-            }
-        }
+        var folder = pluginInfo.OriginalAssemblyFile?.Directory?.Name;
+        return PluginManager.GetPendingChanges()
+            .Where(x => string.Equals(x.SystemName, pluginInfo.SystemName, StringComparison.OrdinalIgnoreCase)
+                        || (folder != null && string.Equals(x.FolderName, folder, StringComparison.OrdinalIgnoreCase)))
+            .ToList();
+    }
+
+    /// <summary>
+    ///     Whether the plugin is installed now: an install or uninstall since the last restart already counts,
+    ///     although the plugin list still shows the state the application was started with
+    /// </summary>
+    private static bool IsInstalled(PluginInfo pluginInfo, IEnumerable<PluginPendingChange> pending)
+    {
+        var change = pending.LastOrDefault(x =>
+            x.Kind is PluginPendingChangeKind.Installed or PluginPendingChangeKind.Uninstalled);
+
+        return change?.Kind switch {
+            PluginPendingChangeKind.Installed => true,
+            PluginPendingChangeKind.Uninstalled => false,
+            _ => pluginInfo.Installed
+        };
+    }
+
+    /// <summary>
+    ///     The running code is not what is on disk any more (the folder was removed or replaced): installing or
+    ///     uninstalling it would run the old plugin's code for the new one, or for one that is gone
+    /// </summary>
+    private bool RestartRequiredFirst(IEnumerable<PluginPendingChange> pending)
+    {
+        if (!pending.Any(x => x.Kind is PluginPendingChangeKind.Removed or PluginPendingChangeKind.Updated))
+            return false;
+
+        Error(translationService.GetResource("Admin.Plugins.RestartFirst"));
+        return true;
+    }
+
+    /// <summary>
+    ///     The installed plugins are set in configuration (Extensions:InstalledPlugins), not by the admin panel
+    /// </summary>
+    private bool InstalledPluginsManagedByConfiguration()
+    {
+        if (string.IsNullOrEmpty(extConfig.InstalledPlugins))
+            return false;
+
+        Error(translationService.GetResource("Admin.Plugins.ManagedByConfiguration"));
+        return true;
     }
 
     #endregion
@@ -130,6 +170,9 @@ public IActionResult ListSelect(DataSourceRequest command, PluginListModel model
     [HttpPost]
     public async Task<IActionResult> Install(string systemName)
     {
+        if (InstalledPluginsManagedByConfiguration())
+            return RedirectToAction("List");
+
         try
         {
             var pluginInfo = PluginManager.ReferencedPlugins.FirstOrDefault(x => x.SystemName == systemName);
@@ -143,8 +186,12 @@ public async Task<IActionResult> Install(string systemName)
                 return RedirectToAction("List");
             }
 
+            var pending = PendingChangesOf(pluginInfo);
+            if (RestartRequiredFirst(pending))
+                return RedirectToAction("List");
+
             //check whether plugin is not installed
-            if (pluginInfo.Installed)
+            if (IsInstalled(pluginInfo, pending))
                 return RedirectToAction("List");
 
             //install plugin
@@ -152,13 +199,10 @@ public async Task<IActionResult> Install(string systemName)
             await plugin.Install();
             await auditEventRecorder.Plugin(systemName, "installed");
 
-            Success(translationService.GetResource("Admin.Plugins.Installed"));
+            Success(translationService.GetResource("Admin.Plugins.Installed.AfterRestart"));
 
             logger.LogInformation("The plugin has been installed by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
-
-            //stop application
-            applicationLifetime.StopApplication();
         }
         catch (Exception exc)
         {
@@ -171,6 +215,9 @@ public async Task<IActionResult> Install(string systemName)
     [HttpPost]
     public async Task<IActionResult> Uninstall(string systemName)
     {
+        if (InstalledPluginsManagedByConfiguration())
+            return RedirectToAction("List");
+
         try
         {
             var pluginInfo = PluginManager.ReferencedPlugins.FirstOrDefault(x => x.SystemName == systemName);
@@ -178,22 +225,38 @@ public async Task<IActionResult> Uninstall(string systemName)
                 //No plugin found with the specified id
                 return RedirectToAction("List");
 
+            var pending = PendingChangesOf(pluginInfo);
+            if (RestartRequiredFirst(pending))
+                return RedirectToAction("List");
+
             //check whether plugin is installed
-            if (!pluginInfo.Installed)
+            if (!IsInstalled(pluginInfo, pending))
                 return RedirectToAction("List");
 
-            //uninstall plugin
-            var plugin = pluginInfo.Instance<IPlugin>(serviceProvider);
-            await plugin.Uninstall();
-            await auditEventRecorder.Plugin(systemName, "uninstalled");
+            //a plugin that cannot be loaded has no instance to clean up after itself: it is only marked
+            //uninstalled, so it can be removed. An installed plugin was loaded at startup, one installed since
+            //then by its install; loading here only covers one that is still listed without being loaded
+            PluginManager.LoadForInstall(pluginInfo);
+            if (pluginInfo.LoadError != null)
+            {
+                await Grand.Infrastructure.Plugins.PluginExtensions.MarkPluginAsUninstalled(pluginInfo.SystemName);
+                //it never ran: the list shows it uninstalled, and removable, right away
+                pluginInfo.Installed = false;
+                await auditEventRecorder.Plugin(systemName, "uninstalled");
+
+                Warning(translationService.GetResource("Admin.Plugins.Uninstalled.NotCleanedUp"));
+            }
+            else
+            {
+                var plugin = pluginInfo.Instance<IPlugin>(serviceProvider);
+                await plugin.Uninstall();
+                await auditEventRecorder.Plugin(systemName, "uninstalled");
 
-            Success(translationService.GetResource("Admin.Plugins.Uninstalled"));
+                Success(translationService.GetResource("Admin.Plugins.Uninstalled.AfterRestart"));
+            }
 
             logger.LogInformation("The plugin has been uninstalled by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
-
-            //stop application
-            applicationLifetime.StopApplication();
         }
         catch (Exception exc)
         {
@@ -204,7 +267,7 @@ public async Task<IActionResult> Uninstall(string systemName)
     }
 
     [HttpPost]
-    public async Task<IActionResult> Remove(string systemName)
+    public async Task<IActionResult> Remove(string systemName, string folderName)
     {
         if (extConfig.DisableUploadExtensions)
         {
@@ -214,22 +277,27 @@ public async Task<IActionResult> Remove(string systemName)
 
         try
         {
-            var pluginInfo = PluginManager.ReferencedPlugins.FirstOrDefault(x => x.SystemName == systemName);
+            //by folder too: two folders may declare one system name, and only the chosen one is removed
+            var pluginInfo = PluginManager.ReferencedPlugins.FirstOrDefault(x => x.SystemName == systemName
+                && x.FolderName != null && string.Equals(x.FolderName, folderName, StringComparison.OrdinalIgnoreCase));
             if (pluginInfo == null)
                 //No plugin found with the specified id
                 return RedirectToAction("List");
 
-            DeleteDirectory(pluginInfo.OriginalAssemblyFile.DirectoryName);
+            //an installed plugin keeps its settings and data; it is uninstalled first
+            if (IsInstalled(pluginInfo, PendingChangesOf(pluginInfo)))
+            {
+                Error(translationService.GetResource("Admin.Plugins.Remove.UninstallFirst"));
+                return RedirectToAction("List");
+            }
+
+            DeleteDirectory(Path.Combine(PluginsPath, pluginInfo.FolderName));
             await auditEventRecorder.Plugin(systemName, "removed");
 
-            //uninstall plugin
-            Success(translationService.GetResource("Admin.Plugins.Removed"));
+            Success(translationService.GetResource("Admin.Plugins.Removed.AfterRestart"));
 
             logger.LogInformation("The plugin has been removed by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
-
-            //stop application
-            applicationLifetime.StopApplication();
         }
         catch (Exception exc)
         {
@@ -239,10 +307,16 @@ public async Task<IActionResult> Remove(string systemName)
         return RedirectToAction("List");
     }
 
-    public IActionResult ReloadList()
+    /// <summary>
+    ///     Restarts the application, which applies the plugin changes made since the last start. Under the
+    ///     Plugins permission, so applying them does not take the System permission a general restart needs.
+    /// </summary>
+    [HttpPost]
+    public async Task<IActionResult> ReloadList()
     {
         logger.LogInformation("Reload list of plugins by the user {CurrentCustomerEmail}",
             contextAccessor.WorkContext.CurrentCustomer.Email);
+        await auditEventRecorder.Plugin("*", "restarted");
 
         //stop application
         applicationLifetime.StopApplication();
@@ -284,10 +358,11 @@ public async Task<IActionResult> UploadPlugin(IFormFile zippedFile)
                 zippedFile.CopyTo(fileStream);
             }
 
-            Upload(zipFilePath);
-            await auditEventRecorder.Plugin(zippedFile.FileName, "uploaded");
+            var installer = new PluginArchiveInstaller(PluginsPath, logger);
+            var result = installer.Install(zipFilePath);
+            await auditEventRecorder.Plugin(result.Manifest.SystemName, "uploaded");
 
-            var message = translationService.GetResource("Admin.Plugins.Uploaded");
+            var message = translationService.GetResource("Admin.Plugins.Uploaded.AfterRestart");
             Success(message);
         }
         catch (Exception exc)
@@ -297,130 +372,15 @@ public async Task<IActionResult> UploadPlugin(IFormFile zippedFile)
         }
         finally
         {
-            // Delete temporary file
-            DeleteTempDirectory(tempDirectory);
+            //only the uploaded file is ours; the installer owns (and may keep) its per-install folders
+            PluginArchiveInstaller.DeleteArchive(zipFilePath, logger);
         }
 
         logger.LogInformation("The plugin has been uploaded by the user {CurrentCustomerEmail}",
             contextAccessor.WorkContext.CurrentCustomer.Email);
 
-        //stop application
-        applicationLifetime.StopApplication();
-
         return RedirectToAction("List");
     }
 
-    private void DeleteTempDirectory(string tempDirectory)
-    {
-        try
-        {
-            DeleteDirectory(tempDirectory);
-        }
-        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
-        {
-            //the previous plugin version moved here can hold an assembly this process has loaded;
-            //it is not loaded from here on the next start and the next upload removes it
-            logger.LogWarning(ex, "The temporary upload folder {TempDirectory} could not be deleted", tempDirectory);
-        }
-    }
-
-    private void Upload(string archivePath)
-    {
-        var pluginsPath = Path.Combine(webHostEnvironment.ContentRootPath, CommonPath.Plugins);
-        var uploadedItemDirectoryName = "";
-        PluginInfo _pluginInfo = null;
-        using (var archive = ZipFile.Open(archivePath, ZipArchiveMode.Update))
-        {
-            var rootDirectories = archive.Entries.Where(entry =>
-                entry.FullName.Count(ch => ch == '/') == 1 && entry.FullName.EndsWith("/")).ToList();
-            if (rootDirectories.Count != 1)
-                throw new Exception(
-                    "The archive should contain only one root plugin. For example, Payments.StripeCheckout.");
-
-            //get directory name (remove the ending /)
-            uploadedItemDirectoryName = rootDirectories.First().FullName.TrimEnd('/');
-
-            var supportedVersion = false;
-            var _fpath = "";
-            foreach (var entry in archive.Entries.Where(x => x.FullName.Contains(".dll")))
-            {
-                using var unzippedEntryStream = entry.Open();
-                try
-                {
-                    var assembly = Assembly.Load(ToByteArray(unzippedEntryStream));
-                    var pluginInfo = assembly.GetCustomAttribute<PluginInfoAttribute>();
-                    if (pluginInfo != null && pluginInfo.SupportedVersion == GrandVersion.SupportedPluginVersion)
-                    {
-                        supportedVersion = true;
-                        _fpath = entry.FullName[..entry.FullName.LastIndexOf("/", StringComparison.Ordinal)];
-                        archive.Entries.Where(x => !x.FullName.Contains(_fpath)).ToList()
-                            .ForEach(y => { archive.GetEntry(y.FullName)!.Delete(); });
-
-                        _pluginInfo = new PluginInfo();
-                        break;
-                    }
-                }
-                catch (Exception ex)
-                {
-                    logger.LogError(ex, ex.Message);
-                }
-            }
-
-            if (!supportedVersion)
-                throw new Exception(
-                    $"This plugin doesn't support the current version - {GrandVersion.SupportedPluginVersion}");
-
-            var pluginname = _fpath[(_fpath.LastIndexOf('/') + 1)..];
-            var _path = "";
-
-            var entries = archive.Entries.ToArray();
-            foreach (var y in entries)
-            {
-                _path = y.Name.Length > 0
-                    ? y.FullName.Replace(y.Name, "").Replace(_fpath, pluginname).TrimEnd('/')
-                    : y.FullName.Replace(_fpath, pluginname);
-
-                var entry = archive.CreateEntry($"{_path}/{y.Name}");
-                using (var a = y.Open())
-                using (var b = entry.Open())
-                {
-                    a.CopyTo(b);
-                }
-
-                archive.GetEntry(y.FullName).Delete();
-            }
-        }
-
-        if (_pluginInfo == null)
-            throw new Exception("No info file is found.");
-
-        if (string.IsNullOrEmpty(uploadedItemDirectoryName))
-            throw new Exception("Cannot get the plugin directory name");
-
-        var pathToUpload = Path.Combine(pluginsPath, uploadedItemDirectoryName);
-
-        if (!Directory.Exists(pathToUpload))
-        {
-            ZipFile.ExtractToDirectory(archivePath, pluginsPath);
-            return;
-        }
-
-        //move the previous version into the temp upload folder instead of deleting it in place:
-        //a locked assembly fails the move before anything is changed, and a failed extraction puts it back
-        var previousVersionPath = Path.Combine(Path.GetDirectoryName(archivePath)!, Guid.NewGuid().ToString());
-        Directory.Move(pathToUpload, previousVersionPath);
-        try
-        {
-            ZipFile.ExtractToDirectory(archivePath, pluginsPath);
-        }
-        catch
-        {
-            if (Directory.Exists(pathToUpload))
-                DeleteDirectory(pathToUpload);
-            Directory.Move(previousVersionPath, pathToUpload);
-            throw;
-        }
-    }
-
     #endregion
 }
\ No newline at end of file
diff --git a/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs b/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
index 7d4aa0ead9..30610d2cb9 100644
--- a/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
+++ b/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
@@ -14,6 +14,8 @@ public class PluginModel : BaseModel
     [GrandResourceDisplayName("Admin.Plugins.Fields.SystemName")]
     public string SystemName { get; set; }
 
+    public string FolderName { get; set; }
+
     [GrandResourceDisplayName("Admin.Plugins.Fields.Version")]
     public string Version { get; set; }
 
@@ -29,6 +31,9 @@ public class PluginModel : BaseModel
     [GrandResourceDisplayName("Admin.Plugins.Fields.Installed")]
     public bool Installed { get; set; }
 
+    [GrandResourceDisplayName("Admin.Plugins.LoadError")]
+    public string LoadError { get; set; }
+
 
     [GrandResourceDisplayName("Admin.Plugins.Fields.Logo")]
     public string LogoUrl { get; set; }
diff --git a/src/Web/Grand.Web.Store/App_Data/appsettings.json b/src/Web/Grand.Web.Store/App_Data/appsettings.json
index d859ae916b..cbfda6b718 100644
--- a/src/Web/Grand.Web.Store/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Store/App_Data/appsettings.json
@@ -133,7 +133,9 @@
     //For develop you should enable if you want to copy plugin dll files to directory /Plugins/bin on application startup
     "PluginShadowCopy": true,
     //separator comma
-    "InstalledPlugins": ""
+    "InstalledPlugins": "",
+    //Stop the application when an installed plugin or an enabled module fails to load; false starts without it, shows a plugin's error on the admin plugin list and logs a module's as critical
+    "FailOnPluginLoadError": false
   },
   "AccessControl": {
     /// A value indicating whether to ignore ACL rules 
diff --git a/src/Web/Grand.Web.Vendor/App_Data/appsettings.json b/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
index 52adfd707b..e76fdf99e2 100644
--- a/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
@@ -133,7 +133,9 @@
     //For develop you should enable if you want to copy plugin dll files to directory /Plugins/bin on application startup
     "PluginShadowCopy": true,
     //separator comma
-    "InstalledPlugins": ""
+    "InstalledPlugins": "",
+    //Stop the application when an installed plugin or an enabled module fails to load; false starts without it, shows a plugin's error on the admin plugin list and logs a module's as critical
+    "FailOnPluginLoadError": false
   },
   "AccessControl": {
     /// A value indicating whether to ignore ACL rules 
diff --git a/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml b/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml
index 25b55d51cd..7518fd1efb 100644
Binary files a/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml and b/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml differ
diff --git a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
index 3a8e21ebce..c54f5e6a96 100644
--- a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
+++ b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
@@ -846,6 +846,57 @@
 	<Resource Name="Admin.Settings.GeneralCommon.DefaultStoreTimeZone.Server" Area="Admin">
 		<Value>Server time zone</Value>
 	</Resource>
+	<Resource Name="Admin.Plugins.LoadError" Area="Admin">
+		<Value>Load error</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.ManagedByConfiguration" Area="Admin">
+		<Value>Installed plugins are set in the application configuration (Extensions:InstalledPlugins), so they cannot be installed or uninstalled here.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Remove.UninstallFirst" Area="Admin">
+		<Value>Uninstall the plugin before removing it.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartNow" Area="Admin">
+		<Value>Restart now</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired" Area="Admin">
+		<Value>Plugin changes take effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Added" Area="Admin">
+		<Value>Added</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Installed" Area="Admin">
+		<Value>Installed</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Removed" Area="Admin">
+		<Value>Removed</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.UninstallWarning" Area="Admin">
+		<Value>An uninstalled plugin keeps running until the restart, although its settings and texts are already removed.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Uninstalled" Area="Admin">
+		<Value>Uninstalled</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Updated" Area="Admin">
+		<Value>Updated</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Installed.AfterRestart" Area="Admin">
+		<Value>The plugin has been installed. The change takes effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Removed.AfterRestart" Area="Admin">
+		<Value>The plugin has been removed. The change takes effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Uninstalled.AfterRestart" Area="Admin">
+		<Value>The plugin has been uninstalled. The change takes effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Uninstalled.NotCleanedUp" Area="Admin">
+		<Value>The plugin has been marked as uninstalled. Its settings and texts were not removed because the plugin could not be loaded.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Uploaded.AfterRestart" Area="Admin">
+		<Value>The plugin has been uploaded. The change takes effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartFirst" Area="Admin">
+		<Value>The plugin files have changed since the application started. Restart the application before installing or uninstalling this plugin.</Value>
+	</Resource>
 	<Resource Name="Admin.Orders.OrderTags.Updated" Area="Admin">
 		<Value>The order's tag has been updated successfully.</Value>
 	</Resource>
diff --git a/src/Web/Grand.Web/App_Data/appsettings.json b/src/Web/Grand.Web/App_Data/appsettings.json
index 39578c2ac5..0ca3e0e82a 100644
--- a/src/Web/Grand.Web/App_Data/appsettings.json
+++ b/src/Web/Grand.Web/App_Data/appsettings.json
@@ -147,7 +147,9 @@
     //For develop you should enable if you want to copy plugin dll files to directory /Plugins/bin on application startup
     "PluginShadowCopy": true,
     //separator comma
-    "InstalledPlugins": ""
+    "InstalledPlugins": "",
+    //Stop the application when an installed plugin or an enabled module fails to load; false starts without it, shows a plugin's error on the admin plugin list and logs a module's as critical
+    "FailOnPluginLoadError": false
   },
   "AccessControl": {
     /// A value indicating whether to ignore ACL rules