From 4cf554c96706cbb46e121722658129a5850675b6 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Mon, 2 Nov 2026 08:45:11 +0100
Subject: [PATCH 01/30] Read plugin manifests from metadata and plan which
 plugin assemblies to load

---
 .../Plugins/PluginFolderScanner.cs            | 177 ++++++++++++++++++
 .../Plugins/PluginManifest.cs                 |  15 ++
 .../Plugins/PluginManifestReader.cs           | 139 ++++++++++++++
 .../Plugins/PluginVersionResolver.cs          |  20 +-
 .../Plugins/Fixtures/TestPluginBuilder.cs     |  47 +++++
 .../Plugins/PluginFolderScannerTests.cs       | 130 +++++++++++++
 .../Plugins/PluginManifestReaderTests.cs      |  92 +++++++++
 .../Plugins/PluginVersionResolverTests.cs     |   2 +-
 8 files changed, 616 insertions(+), 6 deletions(-)
 create mode 100644 src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
 create mode 100644 src/Core/Grand.Infrastructure/Plugins/PluginManifest.cs
 create mode 100644 src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/TestPluginBuilder.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManifestReaderTests.cs

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
new file mode 100644
index 0000000000..7ba0b27b92
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
@@ -0,0 +1,177 @@
+using System.Diagnostics;
+using System.Reflection;
+using System.Text.RegularExpressions;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     A plugin folder that can be loaded.
+/// </summary>
+/// <param name="MainAssemblyPath">The assembly carrying <see cref="PluginInfoAttribute" /></param>
+/// <param name="AssemblyPaths">The files to load, after the higher-version dependency rule was applied</param>
+/// <param name="AssemblyNames">
+///     Simple names of every managed, non-host dll in the folder, including a dependency whose copy was
+///     dropped in favour of another folder's higher version
+/// </param>
+public sealed record PluginCandidate(
+    DirectoryInfo Folder,
+    string MainAssemblyPath,
+    PluginManifest Manifest,
+    IReadOnlyList<string> AssemblyPaths,
+    IReadOnlyCollection<string> AssemblyNames);
+
+public sealed record PluginLoadProblem(string Folder, string Message);
+
+public sealed record PluginScanResult(
+    IReadOnlyList<PluginCandidate> Plugins,
+    IReadOnlyList<PluginLoadProblem> Problems,
+    IReadOnlyList<string> Warnings);
+
+/// <summary>
+///     Plans which plugins and which of their assemblies to load. Everything is decided from file
+///     metadata; no plugin assembly is loaded.
+/// </summary>
+public static class PluginFolderScanner
+{
+    private static readonly string[] IgnoredFolders = ["bin", "TempUploads"];
+
+    private sealed record ScannedFile(string Path, string Name, Version AssemblyVersion, Version FileVersion);
+
+    public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPattern, ISet<string> hostAssemblyNames)
+    {
+        var problems = new List<PluginLoadProblem>();
+        var warnings = new List<string>();
+        var plugins = new List<(PluginCandidate Candidate, List<ScannedFile> Files)>();
+        var systemNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        if (!pluginsFolder.Exists)
+            return new PluginScanResult([], problems, warnings);
+
+        var folders = pluginsFolder.GetDirectories()
+            .Where(x => !IgnoredFolders.Contains(x.Name, StringComparer.OrdinalIgnoreCase))
+            .OrderBy(x => x.Name, StringComparer.Ordinal);
+
+        foreach (var folder in folders)
+        {
+            var files = ScanFolder(folder, skipPattern, hostAssemblyNames, warnings);
+
+            var manifests = files
+                .Select(x => (File: x, Manifest: PluginManifestReader.Read(x.Path)))
+                .Where(x => x.Manifest != null)
+                .ToList();
+
+            if (manifests.Count == 0)
+                continue;
+
+            if (manifests.Count > 1)
+            {
+                problems.Add(new PluginLoadProblem(folder.Name,
+                    $"The folder contains {manifests.Count} plugin assemblies ({string.Join(", ", manifests.Select(x => x.File.Name))}); only one is allowed."));
+                continue;
+            }
+
+            var (main, manifest) = manifests[0];
+            if (!systemNames.Add(manifest.SystemName ?? string.Empty))
+            {
+                problems.Add(new PluginLoadProblem(folder.Name,
+                    $"The plugin system name '{manifest.SystemName}' is already used by another plugin folder."));
+                continue;
+            }
+
+            var candidate = new PluginCandidate(folder, main.Path, manifest,
+                files.Select(x => x.Path).ToList(),
+                new HashSet<string>(files.Select(x => x.Name), StringComparer.OrdinalIgnoreCase));
+            plugins.Add((candidate, files));
+        }
+
+        return new PluginScanResult(DropLowerVersions(plugins, warnings), problems, warnings);
+    }
+
+    private static List<ScannedFile> ScanFolder(DirectoryInfo folder, string skipPattern,
+        ISet<string> hostAssemblyNames, List<string> warnings)
+    {
+        var result = new List<ScannedFile>();
+        foreach (var file in folder.GetFiles("*.dll", SearchOption.TopDirectoryOnly)
+                     .OrderBy(x => x.Name, StringComparer.Ordinal))
+        {
+            if (!string.IsNullOrEmpty(skipPattern) && Matches(file.Name, skipPattern))
+                continue;
+
+            if (!PluginManifestReader.IsManagedAssembly(file.FullName))
+                continue;
+
+            AssemblyName assemblyName;
+            try
+            {
+                assemblyName = AssemblyName.GetAssemblyName(file.FullName);
+            }
+            catch (Exception ex) when (ex is BadImageFormatException or FileLoadException)
+            {
+                continue;
+            }
+
+            if (hostAssemblyNames.Contains(assemblyName.Name!))
+            {
+                warnings.Add(
+                    $"Plugin folder '{folder.Name}' ships '{file.Name}', which the application already provides; the copy is ignored.");
+                continue;
+            }
+
+            result.Add(new ScannedFile(file.FullName, assemblyName.Name!, assemblyName.Version ?? new Version(),
+                ParseFileVersion(file.FullName)));
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    ///     When two plugins ship the same dependency only the higher version is loaded, so one load
+    ///     context never sees two copies of it. A plugin's own main assembly is never dropped.
+    /// </summary>
+    private static List<PluginCandidate> DropLowerVersions(
+        List<(PluginCandidate Candidate, List<ScannedFile> Files)> plugins, List<string> warnings)
+    {
+        var dropped = new Dictionary<PluginCandidate, HashSet<string>>();
+
+        var groups = plugins
+            .SelectMany(p => p.Files.Select(f => (p.Candidate, File: f)))
+            .Where(x => !string.Equals(x.File.Path, x.Candidate.MainAssemblyPath, StringComparison.OrdinalIgnoreCase))
+            .GroupBy(x => x.File.Name, StringComparer.OrdinalIgnoreCase)
+            .Where(g => g.Select(x => x.Candidate).Distinct().Count() > 1);
+
+        foreach (var group in groups)
+        {
+            var winner = group
+                .OrderByDescending(x => x.File.AssemblyVersion)
+                .ThenByDescending(x => x.File.FileVersion)
+                .First();
+
+            foreach (var loser in group.Where(x => x != winner))
+            {
+                if (!dropped.TryGetValue(loser.Candidate, out var paths))
+                    dropped[loser.Candidate] = paths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+                paths.Add(loser.File.Path);
+
+                warnings.Add(
+                    $"'{group.Key}' is shipped by '{winner.Candidate.Folder.Name}' ({winner.File.AssemblyVersion}) and '{loser.Candidate.Folder.Name}' ({loser.File.AssemblyVersion}); only the higher version is loaded.");
+            }
+        }
+
+        return plugins
+            .Select(p => dropped.TryGetValue(p.Candidate, out var paths)
+                ? p.Candidate with { AssemblyPaths = p.Candidate.AssemblyPaths.Where(x => !paths.Contains(x)).ToList() }
+                : p.Candidate)
+            .ToList();
+    }
+
+    private static Version ParseFileVersion(string path)
+    {
+        var info = FileVersionInfo.GetVersionInfo(path);
+        return new Version(info.FileMajorPart, info.FileMinorPart, info.FileBuildPart, info.FilePrivatePart);
+    }
+
+    private static bool Matches(string fileName, string pattern)
+    {
+        return Regex.IsMatch(fileName, pattern, RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManifest.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManifest.cs
new file mode 100644
index 0000000000..432c41fa80
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManifest.cs
@@ -0,0 +1,15 @@
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     The <see cref="PluginInfoAttribute" /> values of a plugin assembly, read without loading it.
+/// </summary>
+/// <param name="SupportedVersion">
+///     Already resolved by <see cref="PluginVersionResolver" />; null when it cannot be determined.
+/// </param>
+public sealed record PluginManifest(
+    string SystemName,
+    string FriendlyName,
+    string Group,
+    string Author,
+    string Version,
+    string SupportedVersion);
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs
new file mode 100644
index 0000000000..257fdfcc8c
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs
@@ -0,0 +1,139 @@
+using System.Reflection.Metadata;
+using System.Reflection.PortableExecutable;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     Reads <see cref="PluginInfoAttribute" /> from assembly metadata. The assembly is never loaded,
+///     so a broken plugin cannot affect the process while it is still being inspected.
+/// </summary>
+public static class PluginManifestReader
+{
+    private const string CoreAssemblyName = "Grand.Infrastructure";
+    private const string AttributeNamespace = "Grand.Infrastructure.Plugins";
+    private const string AttributeName = nameof(PluginInfoAttribute);
+
+    /// <summary>
+    ///     True when the file is a managed assembly (it carries CLI metadata).
+    /// </summary>
+    public static bool IsManagedAssembly(string path)
+    {
+        try
+        {
+            using var stream = File.OpenRead(path);
+            using var peReader = new PEReader(stream);
+            return peReader.HasMetadata;
+        }
+        catch (Exception ex) when (ex is BadImageFormatException or IOException or InvalidOperationException
+                                       or UnauthorizedAccessException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    ///     Returns the manifest of a plugin assembly, or null for a non-managed file or an assembly
+    ///     without <see cref="PluginInfoAttribute" />.
+    /// </summary>
+    public static PluginManifest Read(string assemblyPath)
+    {
+        try
+        {
+            using var stream = File.OpenRead(assemblyPath);
+            using var peReader = new PEReader(stream);
+            if (!peReader.HasMetadata)
+                return null;
+
+            var reader = peReader.GetMetadataReader();
+            var provider = new StringTypeProvider();
+            foreach (var handle in reader.GetAssemblyDefinition().GetCustomAttributes())
+            {
+                var attribute = reader.GetCustomAttribute(handle);
+                if (!IsPluginInfoAttribute(reader, attribute.Constructor))
+                    continue;
+
+                var named = attribute.DecodeValue(provider).NamedArguments
+                    .ToDictionary(x => x.Name, x => x.Value as string, StringComparer.Ordinal);
+
+                return new PluginManifest(
+                    named.GetValueOrDefault(nameof(PluginInfoAttribute.SystemName)),
+                    named.GetValueOrDefault(nameof(PluginInfoAttribute.FriendlyName)),
+                    named.GetValueOrDefault(nameof(PluginInfoAttribute.Group)),
+                    named.GetValueOrDefault(nameof(PluginInfoAttribute.Author)),
+                    named.GetValueOrDefault(nameof(PluginInfoAttribute.Version)),
+                    PluginVersionResolver.ResolveSupportedVersion(GetCoreReference(reader),
+                        named.GetValueOrDefault(nameof(PluginInfoAttribute.SupportedVersion))));
+            }
+
+            return null;
+        }
+        catch (Exception ex) when (ex is BadImageFormatException or IOException or InvalidOperationException
+                                       or UnauthorizedAccessException)
+        {
+            return null;
+        }
+    }
+
+    private static Version GetCoreReference(MetadataReader reader)
+    {
+        foreach (var handle in reader.AssemblyReferences)
+        {
+            var reference = reader.GetAssemblyReference(handle);
+            if (string.Equals(reader.GetString(reference.Name), CoreAssemblyName, StringComparison.OrdinalIgnoreCase))
+                return reference.Version;
+        }
+
+        return null;
+    }
+
+    private static bool IsPluginInfoAttribute(MetadataReader reader, EntityHandle constructor)
+    {
+        StringHandle ns, name;
+        switch (constructor.Kind)
+        {
+            case HandleKind.MemberReference:
+                var member = reader.GetMemberReference((MemberReferenceHandle)constructor);
+                if (member.Parent.Kind != HandleKind.TypeReference)
+                    return false;
+                var typeRef = reader.GetTypeReference((TypeReferenceHandle)member.Parent);
+                ns = typeRef.Namespace;
+                name = typeRef.Name;
+                break;
+            case HandleKind.MethodDefinition:
+                var method = reader.GetMethodDefinition((MethodDefinitionHandle)constructor);
+                var typeDef = reader.GetTypeDefinition(method.GetDeclaringType());
+                ns = typeDef.Namespace;
+                name = typeDef.Name;
+                break;
+            default:
+                return false;
+        }
+
+        return reader.StringComparer.Equals(ns, AttributeNamespace) &&
+               reader.StringComparer.Equals(name, AttributeName);
+    }
+
+    /// <summary>
+    ///     Only string-valued named arguments are needed, so every type maps to its name.
+    /// </summary>
+    private sealed class StringTypeProvider : ICustomAttributeTypeProvider<string>
+    {
+        public string GetPrimitiveType(PrimitiveTypeCode typeCode) => typeCode.ToString();
+
+        public string GetSystemType() => "System.Type";
+
+        public string GetSZArrayType(string elementType) => elementType + "[]";
+
+        public string GetTypeFromDefinition(MetadataReader reader, TypeDefinitionHandle handle, byte rawTypeKind) =>
+            reader.GetString(reader.GetTypeDefinition(handle).Name);
+
+        public string GetTypeFromReference(MetadataReader reader, TypeReferenceHandle handle, byte rawTypeKind) =>
+            reader.GetString(reader.GetTypeReference(handle).Name);
+
+        public string GetTypeFromSerializedName(string name) => name;
+
+        public PrimitiveTypeCode GetUnderlyingEnumType(string type) => PrimitiveTypeCode.Int32;
+
+        public bool IsSystemType(string type) => type == "System.Type";
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginVersionResolver.cs b/src/Core/Grand.Infrastructure/Plugins/PluginVersionResolver.cs
index c525b02858..60b56e5996 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginVersionResolver.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginVersionResolver.cs
@@ -22,14 +22,24 @@ public static class PluginVersionResolver
     /// </returns>
     public static string ResolveSupportedVersion(Assembly pluginAssembly, string declaredVersion)
     {
-        if (!string.IsNullOrWhiteSpace(declaredVersion))
-            return declaredVersion.Trim();
-
         var coreReference = pluginAssembly?.GetReferencedAssemblies()
             .FirstOrDefault(x => string.Equals(x.Name, CoreAssemblyName, StringComparison.OrdinalIgnoreCase));
 
-        return coreReference?.Version == null
+        return ResolveSupportedVersion(coreReference?.Version, declaredVersion);
+    }
+
+    /// <summary>
+    ///     Same rule as the <see cref="Assembly" /> overload, for callers that read the reference from metadata.
+    /// </summary>
+    /// <param name="coreReference">The version of the plugin's Grand.Infrastructure reference, if it has one</param>
+    /// <param name="declaredVersion">The version declared on <see cref="PluginInfoAttribute" />, if any</param>
+    public static string ResolveSupportedVersion(Version coreReference, string declaredVersion)
+    {
+        if (!string.IsNullOrWhiteSpace(declaredVersion))
+            return declaredVersion.Trim();
+
+        return coreReference == null
             ? null
-            : $"{coreReference.Version.Major}.{coreReference.Version.Minor}";
+            : $"{coreReference.Major}.{coreReference.Minor}";
     }
 }
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/TestPluginBuilder.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/TestPluginBuilder.cs
new file mode 100644
index 0000000000..429ff72abc
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/TestPluginBuilder.cs
@@ -0,0 +1,47 @@
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+
+namespace Grand.Infrastructure.Tests.Plugins.Fixtures;
+
+/// <summary>
+///     Compiles small assemblies to disk for plugin loading tests. The output is only ever inspected
+///     through metadata - tests must not load it into the default AssemblyLoadContext.
+/// </summary>
+public static class TestPluginBuilder
+{
+    private static readonly Lazy<IReadOnlyList<MetadataReference>> PlatformReferences = new(() =>
+        ((string)AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES")!)
+        .Split(Path.PathSeparator)
+        .Select(x => (MetadataReference)MetadataReference.CreateFromFile(x))
+        .ToList());
+
+    /// <summary>
+    ///     Compiles <paramref name="source" /> into <paramref name="outputDir" />/<paramref name="assemblyName" />.dll
+    ///     and returns the path. <paramref name="references" /> are additional assembly files to compile against.
+    /// </summary>
+    public static string Compile(string outputDir, string assemblyName, string source, Version version = null,
+        params string[] references)
+    {
+        Directory.CreateDirectory(outputDir);
+
+        var versionText = (version ?? new Version(1, 0, 0, 0)).ToString();
+        var versionSource = $"""
+                             [assembly: System.Reflection.AssemblyVersion("{versionText}")]
+                             [assembly: System.Reflection.AssemblyFileVersion("{versionText}")]
+                             """;
+
+        var compilation = CSharpCompilation.Create(
+            assemblyName,
+            [CSharpSyntaxTree.ParseText(source), CSharpSyntaxTree.ParseText(versionSource)],
+            PlatformReferences.Value.Concat(references.Select(x => MetadataReference.CreateFromFile(x))),
+            new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary));
+
+        var path = Path.Combine(outputDir, assemblyName + ".dll");
+        var result = compilation.Emit(path);
+        if (!result.Success)
+            throw new InvalidOperationException(string.Join(Environment.NewLine,
+                result.Diagnostics.Where(x => x.Severity == DiagnosticSeverity.Error)));
+
+        return path;
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
new file mode 100644
index 0000000000..c4e0414322
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
@@ -0,0 +1,130 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginFolderScannerTests
+{
+    private static readonly string CoreAssemblyPath = typeof(PluginInfoAttribute).Assembly.Location;
+    private static readonly HashSet<string> Host = ["Grand.Infrastructure"];
+
+    private string _root;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _root = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_root);
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        if (Directory.Exists(_root))
+            Directory.Delete(_root, true);
+    }
+
+    private string Folder(string name) => Path.Combine(_root, name);
+
+    private string AddPlugin(string folder, string assemblyName, string systemName)
+    {
+        return TestPluginBuilder.Compile(Folder(folder), assemblyName, $$"""
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "{{systemName}}")]
+            """, null, CoreAssemblyPath);
+    }
+
+    private PluginScanResult Scan(string skipPattern = null) =>
+        PluginFolderScanner.Scan(new DirectoryInfo(_root), skipPattern, Host);
+
+    [TestMethod]
+    public void Scan_DuplicateSystemName_SecondFolderIsProblem()
+    {
+        AddPlugin("A", "Scan.A", "Scan.Same");
+        AddPlugin("B", "Scan.B", "scan.same");
+
+        var result = Scan();
+
+        Assert.HasCount(1, result.Plugins);
+        Assert.AreEqual("A", result.Plugins[0].Folder.Name);
+        Assert.HasCount(1, result.Problems);
+        Assert.AreEqual("B", result.Problems[0].Folder);
+    }
+
+    [TestMethod]
+    public void Scan_SameDependencyTwoVersions_KeepsHigherVersionOnce()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        AddPlugin("B", "Scan.B", "Scan.B");
+        var low = TestPluginBuilder.Compile(Folder("A"), "Shared.Lib", "public class Lib { }", new Version(1, 0, 0, 0));
+        var high = TestPluginBuilder.Compile(Folder("B"), "Shared.Lib", "public class Lib { }", new Version(2, 0, 0, 0));
+
+        var result = Scan();
+
+        Assert.HasCount(2, result.Plugins);
+        var a = result.Plugins.Single(x => x.Folder.Name == "A");
+        var b = result.Plugins.Single(x => x.Folder.Name == "B");
+        CollectionAssert.DoesNotContain(a.AssemblyPaths.ToList(), low);
+        CollectionAssert.Contains(b.AssemblyPaths.ToList(), high);
+        Assert.AreEqual(1, result.Plugins.SelectMany(x => x.AssemblyPaths)
+            .Count(x => Path.GetFileName(x) == "Shared.Lib.dll"));
+        Assert.Contains("Shared.Lib", a.AssemblyNames);
+        Assert.IsTrue(result.Warnings.Any(x => x.Contains("Shared.Lib") && x.Contains("'A'") && x.Contains("'B'")));
+    }
+
+    [TestMethod]
+    public void Scan_HostAssemblyInPluginFolder_IsSkippedAndNotOwned()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        File.Copy(CoreAssemblyPath, Path.Combine(Folder("A"), "Grand.Infrastructure.dll"));
+
+        var result = Scan();
+
+        var plugin = result.Plugins.Single();
+        Assert.IsFalse(plugin.AssemblyPaths.Any(x => Path.GetFileName(x) == "Grand.Infrastructure.dll"));
+        Assert.DoesNotContain("Grand.Infrastructure", plugin.AssemblyNames);
+        Assert.HasCount(1, result.Warnings);
+    }
+
+    [TestMethod]
+    public void Scan_NativeDll_IsIgnoredWithoutProblem()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        File.WriteAllBytes(Path.Combine(Folder("A"), "native.dll"),
+            System.Security.Cryptography.RandomNumberGenerator.GetBytes(4096));
+
+        var result = Scan();
+
+        Assert.HasCount(1, result.Plugins);
+        Assert.IsEmpty(result.Problems);
+        Assert.IsFalse(result.Plugins[0].AssemblyPaths.Any(x => Path.GetFileName(x) == "native.dll"));
+    }
+
+    [TestMethod]
+    public void Scan_SkipPattern_ExcludesMatchingFiles()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        TestPluginBuilder.Compile(Folder("A"), "Skipped.Lib", "public class Lib { }");
+
+        var result = Scan("^Skipped");
+
+        var plugin = result.Plugins.Single();
+        Assert.IsFalse(plugin.AssemblyPaths.Any(x => Path.GetFileName(x) == "Skipped.Lib.dll"));
+        Assert.DoesNotContain("Skipped.Lib", plugin.AssemblyNames);
+    }
+
+    [TestMethod]
+    public void Scan_BinAndTempUploadsFolders_AreIgnored()
+    {
+        AddPlugin("bin", "Scan.Bin", "Scan.Bin");
+        AddPlugin("TempUploads", "Scan.Temp", "Scan.Temp");
+        AddPlugin("A", "Scan.A", "Scan.A");
+
+        var result = Scan();
+
+        Assert.AreEqual("A", result.Plugins.Single().Folder.Name);
+        Assert.IsEmpty(result.Problems);
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManifestReaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManifestReaderTests.cs
new file mode 100644
index 0000000000..f1d6632610
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManifestReaderTests.cs
@@ -0,0 +1,92 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginManifestReaderTests
+{
+    private static readonly string CoreAssemblyPath = typeof(PluginInfoAttribute).Assembly.Location;
+
+    private string _folder;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _folder = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_folder);
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        if (Directory.Exists(_folder))
+            Directory.Delete(_folder, true);
+    }
+
+    private static string PluginSource(string attributeArguments) => $$"""
+        using Grand.Infrastructure.Plugins;
+        [assembly: PluginInfo({{attributeArguments}})]
+        """;
+
+    [TestMethod]
+    public void Read_PluginWithoutDeclaredVersion_ResolvesFromCoreReference()
+    {
+        var path = TestPluginBuilder.Compile(_folder, "Reader.NoVersion",
+            PluginSource("""SystemName = "Reader.NoVersion", FriendlyName = "No version", Group = "Misc", Author = "me", Version = "1.2" """),
+            null, CoreAssemblyPath);
+
+        var manifest = PluginManifestReader.Read(path);
+
+        Assert.IsNotNull(manifest);
+        Assert.AreEqual("Reader.NoVersion", manifest.SystemName);
+        Assert.AreEqual("No version", manifest.FriendlyName);
+        Assert.AreEqual("Misc", manifest.Group);
+        Assert.AreEqual("me", manifest.Author);
+        Assert.AreEqual("1.2", manifest.Version);
+        Assert.AreEqual(GrandVersion.SupportedPluginVersion, manifest.SupportedVersion);
+    }
+
+    [TestMethod]
+    public void Read_DeclaredVersion_IsTrimmed()
+    {
+        var path = TestPluginBuilder.Compile(_folder, "Reader.Declared",
+            PluginSource("""SystemName = "Reader.Declared", SupportedVersion = " 2.3 " """),
+            null, CoreAssemblyPath);
+
+        var manifest = PluginManifestReader.Read(path);
+
+        Assert.AreEqual("2.3", manifest.SupportedVersion);
+    }
+
+    [TestMethod]
+    public void Read_AssemblyWithoutAttribute_ReturnsNull()
+    {
+        var path = TestPluginBuilder.Compile(_folder, "Reader.Plain", "public class Plain { }");
+
+        Assert.IsNull(PluginManifestReader.Read(path));
+    }
+
+    [TestMethod]
+    public void Read_NonManagedFile_ReturnsNull()
+    {
+        var path = Path.Combine(_folder, "native.dll");
+        File.WriteAllBytes(path, System.Security.Cryptography.RandomNumberGenerator.GetBytes(4096));
+
+        Assert.IsNull(PluginManifestReader.Read(path));
+        Assert.IsFalse(PluginManifestReader.IsManagedAssembly(path));
+    }
+
+    [TestMethod]
+    public void Read_DoesNotLoadAssembly()
+    {
+        var path = TestPluginBuilder.Compile(_folder, "Reader.NotLoaded",
+            PluginSource("""SystemName = "Reader.NotLoaded" """), null, CoreAssemblyPath);
+
+        PluginManifestReader.Read(path);
+
+        Assert.IsFalse(AppDomain.CurrentDomain.GetAssemblies()
+            .Any(x => x.GetName().Name == "Reader.NotLoaded"));
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginVersionResolverTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginVersionResolverTests.cs
index bcf6a85c96..13623b1590 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginVersionResolverTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginVersionResolverTests.cs
@@ -61,7 +61,7 @@ public void ResolveSupportedVersion_AssemblyWithoutCoreReference_ReturnsNull()
     [TestMethod]
     public void ResolveSupportedVersion_NoAssembly_ReturnsNull()
     {
-        var result = PluginVersionResolver.ResolveSupportedVersion(null, null);
+        var result = PluginVersionResolver.ResolveSupportedVersion((Assembly)null, null);
 
         Assert.IsNull(result);
     }

From 40cb2b7af71b197b25da6a8ea308a7a3867821d5 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Mon, 2 Nov 2026 09:25:24 +0100
Subject: [PATCH 02/30] Load each plugin in isolation so a faulty plugin folder
 cannot stop the store

---
 .../Configuration/ExtensionsConfig.cs         |   6 +
 .../Plugins/PluginExtensions.cs               |  15 +-
 .../Plugins/PluginFolderScanner.cs            | 116 ++++--
 .../Plugins/PluginInfo.cs                     |  20 +
 .../Plugins/PluginLoader.cs                   | 117 ++++++
 .../Plugins/PluginManager.cs                  | 353 ++++++++----------
 .../Plugins/PluginManifestReader.cs           |  92 ++---
 .../Plugins/Fixtures/PluginFolderFixture.cs   |  82 ++++
 .../Plugins/PluginExtensionsTests.cs          |  72 ++++
 .../Plugins/PluginFolderScannerTests.cs       |  35 ++
 .../Plugins/PluginLoaderTests.cs              |  89 +++++
 .../Grand.Web.Admin/App_Data/appsettings.json |   4 +-
 .../Areas/Admin/Views/Plugin/List.cshtml      |   7 +-
 .../Controllers/PluginController.cs           |   4 +-
 .../Models/Plugins/PluginModel.cs             |   3 +
 .../Grand.Web.Store/App_Data/appsettings.json |   4 +-
 .../App_Data/appsettings.json                 |   4 +-
 .../App_Data/Resources/DefaultLanguage.xml    | Bin 1648866 -> 1649066 bytes
 .../App_Data/Resources/Upgrade/en_250.xml     |   3 +
 src/Web/Grand.Web/App_Data/appsettings.json   |   4 +-
 20 files changed, 751 insertions(+), 279 deletions(-)
 create mode 100644 src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs

diff --git a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
index 49b4ba903f..c4af49daf9 100644
--- a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
+++ b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
@@ -29,4 +29,10 @@ public class ExtensionsConfig
     ///     List of installed plugins (comma separated)
     /// </summary>
     public string InstalledPlugins { get; set; }
+
+    /// <summary>
+    ///     Stop the application when an installed plugin fails to load. Off: the plugin is logged,
+    ///     listed with its error and left inactive, and the application starts without it.
+    /// </summary>
+    public bool FailOnPluginLoadError { get; set; }
 }
\ No newline at end of file
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs b/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
index e06d9c8c14..7e5e723d32 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
@@ -40,12 +40,21 @@ public static bool OnlyInstalledPlugins(Type type)
     }
 
     /// <summary>
-    ///     Whether the assembly may contribute types: true unless it belongs to a plugin that is not installed
+    ///     Whether the assembly may contribute types: true unless it belongs only to plugins that are not
+    ///     active (not installed, or failed to load). Any assembly of a plugin counts, not only the one
+    ///     carrying <see cref="PluginInfoAttribute" />; a dependency several plugins ship counts while one
+    ///     of them is active.
     /// </summary>
     public static bool OnlyInstalledPlugins(Assembly assembly)
     {
-        var plugin = PluginManager.FindPlugin(assembly);
-        return plugin == null || plugin.Installed;
+        ArgumentNullException.ThrowIfNull(assembly);
+
+        var name = assembly.GetName().Name;
+        var owners = PluginManager.ReferencedPlugins?
+            .Where(x => x.AssemblyNames.Contains(name, StringComparer.OrdinalIgnoreCase))
+            .ToList();
+
+        return owners is not { Count: > 0 } || owners.Any(x => x.IsActive);
     }
 
     public static IList<string> ParseInstalledPluginsFile(string filePath)
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
index 7ba0b27b92..e27d0f146a 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
@@ -35,8 +35,12 @@ public static class PluginFolderScanner
 {
     private static readonly string[] IgnoredFolders = ["bin", "TempUploads"];
 
-    private sealed record ScannedFile(string Path, string Name, Version AssemblyVersion, Version FileVersion);
+    private sealed record ScannedFile(string Path, string Name, Version AssemblyVersion, Version FileVersion,
+        PluginManifest Manifest);
 
+    /// <summary>
+    ///     Never throws because of one folder or file: what cannot be read becomes a problem of its folder.
+    /// </summary>
     public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPattern, ISet<string> hostAssemblyNames)
     {
         var problems = new List<PluginLoadProblem>();
@@ -47,18 +51,27 @@ public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPatt
         if (!pluginsFolder.Exists)
             return new PluginScanResult([], problems, warnings);
 
-        var folders = pluginsFolder.GetDirectories()
-            .Where(x => !IgnoredFolders.Contains(x.Name, StringComparer.OrdinalIgnoreCase))
-            .OrderBy(x => x.Name, StringComparer.Ordinal);
+        DirectoryInfo[] folders;
+        try
+        {
+            folders = pluginsFolder.GetDirectories()
+                .Where(x => !IgnoredFolders.Contains(x.Name, StringComparer.OrdinalIgnoreCase))
+                .OrderBy(x => x.Name, StringComparer.Ordinal)
+                .ToArray();
+        }
+        catch (Exception ex) when (IsReadFailure(ex))
+        {
+            problems.Add(new PluginLoadProblem(pluginsFolder.Name, $"The folder could not be read: {ex.Message}"));
+            return new PluginScanResult([], problems, warnings);
+        }
 
         foreach (var folder in folders)
         {
-            var files = ScanFolder(folder, skipPattern, hostAssemblyNames, warnings);
+            var files = ScanFolder(folder, skipPattern, hostAssemblyNames, warnings, problems);
+            if (files == null)
+                continue;
 
-            var manifests = files
-                .Select(x => (File: x, Manifest: PluginManifestReader.Read(x.Path)))
-                .Where(x => x.Manifest != null)
-                .ToList();
+            var manifests = files.Where(x => x.Manifest != null).ToList();
 
             if (manifests.Count == 0)
                 continue;
@@ -66,12 +79,19 @@ public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPatt
             if (manifests.Count > 1)
             {
                 problems.Add(new PluginLoadProblem(folder.Name,
-                    $"The folder contains {manifests.Count} plugin assemblies ({string.Join(", ", manifests.Select(x => x.File.Name))}); only one is allowed."));
+                    $"The folder contains {manifests.Count} plugin assemblies ({string.Join(", ", manifests.Select(x => x.Name))}); only one is allowed."));
+                continue;
+            }
+
+            var main = manifests[0];
+            var manifest = main.Manifest;
+            if (string.IsNullOrWhiteSpace(manifest.SystemName))
+            {
+                problems.Add(new PluginLoadProblem(folder.Name, "has no SystemName"));
                 continue;
             }
 
-            var (main, manifest) = manifests[0];
-            if (!systemNames.Add(manifest.SystemName ?? string.Empty))
+            if (!systemNames.Add(manifest.SystemName))
             {
                 problems.Add(new PluginLoadProblem(folder.Name,
                     $"The plugin system name '{manifest.SystemName}' is already used by another plugin folder."));
@@ -87,43 +107,77 @@ public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPatt
         return new PluginScanResult(DropLowerVersions(plugins, warnings), problems, warnings);
     }
 
+    /// <summary>
+    ///     Returns the folder's assemblies, or null when the folder or one of its files cannot be read; the
+    ///     folder is then a problem, since the unread file may be the plugin itself or one it needs.
+    /// </summary>
     private static List<ScannedFile> ScanFolder(DirectoryInfo folder, string skipPattern,
-        ISet<string> hostAssemblyNames, List<string> warnings)
+        ISet<string> hostAssemblyNames, List<string> warnings, List<PluginLoadProblem> problems)
     {
+        FileInfo[] dlls;
+        try
+        {
+            dlls = folder.GetFiles("*.dll", SearchOption.TopDirectoryOnly);
+        }
+        catch (Exception ex) when (IsReadFailure(ex))
+        {
+            problems.Add(new PluginLoadProblem(folder.Name, $"The folder could not be read: {ex.Message}"));
+            return null;
+        }
+
         var result = new List<ScannedFile>();
-        foreach (var file in folder.GetFiles("*.dll", SearchOption.TopDirectoryOnly)
-                     .OrderBy(x => x.Name, StringComparer.Ordinal))
+        foreach (var file in dlls.OrderBy(x => x.Name, StringComparer.Ordinal))
         {
             if (!string.IsNullOrEmpty(skipPattern) && Matches(file.Name, skipPattern))
                 continue;
 
-            if (!PluginManifestReader.IsManagedAssembly(file.FullName))
-                continue;
-
-            AssemblyName assemblyName;
             try
             {
-                assemblyName = AssemblyName.GetAssemblyName(file.FullName);
+                var scanned = ScanFile(folder, file, hostAssemblyNames, warnings);
+                if (scanned != null)
+                    result.Add(scanned);
             }
-            catch (Exception ex) when (ex is BadImageFormatException or FileLoadException)
+            catch (Exception ex) when (IsReadFailure(ex))
             {
-                continue;
+                problems.Add(new PluginLoadProblem(folder.Name, $"'{file.Name}' could not be read: {ex.Message}"));
+                return null;
             }
+        }
 
-            if (hostAssemblyNames.Contains(assemblyName.Name!))
-            {
-                warnings.Add(
-                    $"Plugin folder '{folder.Name}' ships '{file.Name}', which the application already provides; the copy is ignored.");
-                continue;
-            }
+        return result;
+    }
 
-            result.Add(new ScannedFile(file.FullName, assemblyName.Name!, assemblyName.Version ?? new Version(),
-                ParseFileVersion(file.FullName)));
+    private static ScannedFile ScanFile(DirectoryInfo folder, FileInfo file, ISet<string> hostAssemblyNames,
+        List<string> warnings)
+    {
+        if (!PluginManifestReader.IsManagedAssembly(file.FullName))
+            return null;
+
+        AssemblyName assemblyName;
+        try
+        {
+            assemblyName = AssemblyName.GetAssemblyName(file.FullName);
+        }
+        catch (BadImageFormatException)
+        {
+            //metadata without an assembly manifest, such as a module: nothing to load
+            return null;
         }
 
-        return result;
+        if (hostAssemblyNames.Contains(assemblyName.Name!))
+        {
+            warnings.Add(
+                $"Plugin folder '{folder.Name}' ships '{file.Name}', which the application already provides; the copy is ignored.");
+            return null;
+        }
+
+        return new ScannedFile(file.FullName, assemblyName.Name!, assemblyName.Version ?? new Version(),
+            ParseFileVersion(file.FullName), PluginManifestReader.Read(file.FullName));
     }
 
+    private static bool IsReadFailure(Exception ex) =>
+        ex is IOException or UnauthorizedAccessException or BadImageFormatException;
+
     /// <summary>
     ///     When two plugins ship the same dependency only the higher version is loaded, so one load
     ///     context never sees two copies of it. A plugin's own main assembly is never dropped.
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
index 472e196565..f835088e0d 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
@@ -15,6 +15,9 @@ public PluginInfo(
         ReferencedAssembly = referencedAssembly;
         OriginalAssemblyFile = originalAssemblyFile;
         PluginType = pluginType;
+        if (referencedAssembly != null)
+            AssemblyNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+                { referencedAssembly.GetName().Name! };
     }
 
     public PluginInfo()
@@ -81,6 +84,23 @@ public PluginInfo()
     /// </summary>
     public bool Installed { get; set; }
 
+    /// <summary>
+    ///     Why the plugin could not be loaded; null when it loaded
+    /// </summary>
+    public string LoadError { get; internal set; }
+
+    /// <summary>
+    ///     Simple names of the plugin's assemblies, compared case-insensitively. Taken from the plugin
+    ///     folder, so they are known whether or not the plugin was loaded.
+    /// </summary>
+    public IReadOnlyCollection<string> AssemblyNames { get; internal set; } =
+        new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>
+    ///     Installed and loaded: only an active plugin contributes types to the application
+    /// </summary>
+    public bool IsActive => Installed && LoadError == null;
+
     public T Instance<T>(IServiceProvider serviceProvider) where T : class, IPlugin
     {
         object instance;
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
new file mode 100644
index 0000000000..8aa02b24cb
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
@@ -0,0 +1,117 @@
+using System.Reflection;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     Loads one planned plugin. A fault of the plugin never escapes: it becomes
+///     <see cref="PluginInfo.LoadError" />, so one plugin folder cannot stop the application.
+/// </summary>
+public static class PluginLoader
+{
+    public const string NoPluginClassError = "has no IPlugin class";
+
+    /// <summary>
+    ///     Loads the candidate's assemblies into <paramref name="context" /> and finds its plugin class.
+    /// </summary>
+    /// <param name="prepareFile">The shadow-copy step; the file to load in place of the given one</param>
+    /// <returns>
+    ///     The plugin. When <see cref="PluginInfo.LoadError" /> is set, <see cref="PluginInfo.PluginType" /> and
+    ///     <see cref="PluginInfo.ReferencedAssembly" /> are null.
+    /// </returns>
+    public static PluginInfo Load(PluginCandidate candidate, bool installed, AssemblyLoadContext context,
+        Func<FileInfo, FileInfo> prepareFile)
+    {
+        ArgumentNullException.ThrowIfNull(candidate);
+        ArgumentNullException.ThrowIfNull(context);
+        ArgumentNullException.ThrowIfNull(prepareFile);
+
+        var plugin = Describe(candidate, installed);
+        try
+        {
+            Assembly main = null;
+            var assemblies = new List<Assembly>();
+            foreach (var path in candidate.AssemblyPaths)
+            {
+                var file = prepareFile(new FileInfo(path));
+                var assembly = LoadFromPath(context, file.FullName);
+                assemblies.Add(assembly);
+                if (!string.Equals(path, candidate.MainAssemblyPath, StringComparison.OrdinalIgnoreCase))
+                    continue;
+
+                main = assembly;
+                plugin.PluginFileName = file.Name;
+            }
+
+            //every assembly is loaded before any type is resolved, so the order of the files does not matter
+            Type pluginType = null;
+            foreach (var assembly in assemblies)
+            {
+                var types = assembly.GetTypes();
+                if (assembly == main)
+                    pluginType = types.FirstOrDefault(IsPluginClass);
+            }
+
+            if (pluginType == null)
+                return Failed(plugin, NoPluginClassError);
+
+            plugin.ReferencedAssembly = main;
+            plugin.PluginType = pluginType;
+            return plugin;
+        }
+        catch (ReflectionTypeLoadException ex)
+        {
+            return Failed(plugin, ex.LoaderExceptions.FirstOrDefault(x => x != null)?.Message ?? ex.Message);
+        }
+        catch (Exception ex)
+        {
+            //FileLoadException, FileNotFoundException, BadImageFormatException and whatever else a plugin's
+            //files can cause; the plugin is reported, the application goes on
+            return Failed(plugin, ex.Message);
+        }
+    }
+
+    /// <summary>
+    ///     The plugin as its manifest describes it, without loading anything.
+    /// </summary>
+    internal static PluginInfo Describe(PluginCandidate candidate, bool installed)
+    {
+        var manifest = candidate.Manifest;
+        return new PluginInfo {
+            FriendlyName = manifest.FriendlyName,
+            Group = manifest.Group,
+            SystemName = manifest.SystemName,
+            Version = manifest.Version,
+            SupportedVersion = manifest.SupportedVersion,
+            Author = manifest.Author,
+            PluginFileName = Path.GetFileName(candidate.MainAssemblyPath),
+            OriginalAssemblyFile = new FileInfo(candidate.MainAssemblyPath),
+            AssemblyNames = new HashSet<string>(candidate.AssemblyNames, StringComparer.OrdinalIgnoreCase),
+            Installed = installed
+        };
+    }
+
+    /// <summary>
+    ///     A file already loaded into the context (it resolved as another plugin's dependency) is reused;
+    ///     loading it again would fail with "Assembly with same name is already loaded".
+    /// </summary>
+    private static Assembly LoadFromPath(AssemblyLoadContext context, string path)
+    {
+        var loaded = context.Assemblies.FirstOrDefault(x =>
+            string.Equals(x.Location, path, StringComparison.OrdinalIgnoreCase));
+        return loaded ?? context.LoadFromAssemblyPath(path);
+    }
+
+    private static bool IsPluginClass(Type type)
+    {
+        return typeof(IPlugin).IsAssignableFrom(type) && type.IsClass && !type.IsAbstract;
+    }
+
+    private static PluginInfo Failed(PluginInfo plugin, string error)
+    {
+        plugin.LoadError = error;
+        plugin.PluginType = null;
+        plugin.ReferencedAssembly = null;
+        return plugin;
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index 5d592b4a7d..47efb01b10 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -1,14 +1,15 @@
 using Grand.Infrastructure.Configuration;
+using Grand.SharedKernel;
 using Grand.SharedKernel.Extensions;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.ApplicationParts;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
+using System.Collections.Concurrent;
 using System.Reflection;
 using System.Runtime.CompilerServices;
 using System.Runtime.Loader;
-using System.Text.RegularExpressions;
 
 namespace Grand.Infrastructure.Plugins;
 
@@ -31,6 +32,7 @@ public static class PluginManager
     private static DirectoryInfo _pluginFolder;
     private static ExtensionsConfig _config;
     private static ILogger _logger;
+    private static Func<AssemblyLoadContext, AssemblyName, Assembly> _resolveDependency;
 
     #endregion
 
@@ -60,127 +62,114 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
 
             _pluginFolder = new DirectoryInfo(Path.Combine(hostEnvironment.ContentRootPath, CommonPath.Plugins));
             _copyFolder = new DirectoryInfo(Path.Combine(hostEnvironment.ContentRootPath, CommonPath.Plugins, "bin"));
-                
-            var referencedPlugins = new List<PluginInfo>();
-            try
-            {
-                var installedPluginSystemNames =
-                    !string.IsNullOrEmpty(_config.InstalledPlugins)
-                        ? _config.InstalledPlugins.Split(",").Select(x => x.Trim())
-                        : PluginExtensions.ParseInstalledPluginsFile(PluginPaths.Instance.InstalledPluginsFile);
-
-                _logger.LogInformation("Creating shadow copy folder and querying for dlls");
-                Directory.CreateDirectory(_pluginFolder.FullName);
-                Directory.CreateDirectory(_copyFolder.FullName);
-                var binFiles = _copyFolder.GetFiles("*", SearchOption.AllDirectories);
-                if (_config.PluginShadowCopy)
-                    //clear out shadow plugins
-                    foreach (var f in binFiles)
-                    {
-                        _logger.LogInformation("Deleting {FName}", f.Name);
-                        try
-                        {
-                            var fileName = Path.GetFileName(f.FullName);
-                            if (fileName.Equals("index.htm", StringComparison.OrdinalIgnoreCase))
-                                continue;
-
-                            File.Delete(f.FullName);
-                        }
-                        catch (Exception exc)
-                        {
-                            _logger.LogError(exc, "PluginManager");
-                        }
-                    }
 
-                //load description files
-                foreach (var plugin in GetPluginInfo())
+            var installedPluginSystemNames =
+                (!string.IsNullOrEmpty(_config.InstalledPlugins)
+                    ? _config.InstalledPlugins.Split(",").Select(x => x.Trim())
+                    : PluginExtensions.ParseInstalledPluginsFile(PluginPaths.Instance.InstalledPluginsFile))
+                .ToList();
+
+            _logger.LogInformation("Creating shadow copy folder and querying for dlls");
+            Directory.CreateDirectory(_pluginFolder.FullName);
+            Directory.CreateDirectory(_copyFolder.FullName);
+            var binFiles = _copyFolder.GetFiles("*", SearchOption.AllDirectories);
+            if (_config.PluginShadowCopy)
+                //clear out shadow plugins
+                foreach (var f in binFiles)
                 {
-                    if (plugin.SupportedVersion != GrandVersion.SupportedPluginVersion)
-                    {
-                        _logger.LogInformation("Incompatible plugin {PluginSystemName}", plugin.SystemName);
-                        //set as not installed
-                        referencedPlugins.Add(plugin);
-                        continue;
-                    }
-
-                    //some validation
-                    if (string.IsNullOrWhiteSpace(plugin.SystemName))
-                        throw new Exception($"The plugin '{plugin.SystemName}' has no system name.");
-                    if (referencedPlugins.Contains(plugin))
-                        throw new Exception($"The plugin with '{plugin.SystemName}' system name is already defined");
-
-                    //set 'Installed' property
-                    plugin.Installed = installedPluginSystemNames
-                        .FirstOrDefault(x => x.Equals(plugin.SystemName, StringComparison.OrdinalIgnoreCase)) != null;
-
+                    _logger.LogInformation("Deleting {FName}", f.Name);
                     try
                     {
-                        if (!_config.PluginShadowCopy)
-                        {
-                            //remove deps.json files 
-                            var depsFiles =
-                                plugin.OriginalAssemblyFile.Directory!.GetFiles("*.deps.json",
-                                    SearchOption.TopDirectoryOnly);
-                            foreach (var f in depsFiles)
-                                try
-                                {
-                                    File.Delete(f.FullName);
-                                }
-                                catch (Exception exc)
-                                {
-                                    _logger.LogError(exc, "PluginManager");
-                                }
-                        }
-
-                        //controllers and views only for an installed plugin - an uninstalled one must not be routable
-                        if (plugin.Installed)
-                            AddApplicationPart(mvcCoreBuilder, plugin.ReferencedAssembly, plugin.SystemName,
-                                plugin.PluginFileName);
-
-                        //register interface for IPlugin - also when not installed, Install resolves it from DI
-                        RegisterPluginInterface(mvcCoreBuilder, plugin.ReferencedAssembly);
-
-                        //init plugin type
-                        foreach (var t in plugin.ReferencedAssembly.GetTypes())
-                            if (typeof(IPlugin).IsAssignableFrom(t))
-                                if (!t.GetTypeInfo().IsInterface)
-                                    if (t.GetTypeInfo().IsClass && !t.GetTypeInfo().IsAbstract)
-                                    {
-                                        plugin.PluginType = t;
-                                        break;
-                                    }
-
-                        referencedPlugins.Add(plugin);
-                    }
-                    catch (ReflectionTypeLoadException ex)
-                    {
-                        var msg = $"Plugin '{plugin.FriendlyName}'. ";
-                        msg = ex.LoaderExceptions.Aggregate(msg,
-                            (current, e) => current + e!.Message + Environment.NewLine);
+                        var fileName = Path.GetFileName(f.FullName);
+                        if (fileName.Equals("index.htm", StringComparison.OrdinalIgnoreCase))
+                            continue;
 
-                        var fail = new Exception(msg, ex);
-                        throw fail;
+                        File.Delete(f.FullName);
                     }
-                    catch (Exception ex)
+                    catch (Exception exc)
                     {
-                        var msg = $"Plugin '{plugin.FriendlyName}'. {ex.Message}";
-
-                        var fail = new Exception(msg, ex);
-                        throw fail;
+                        _logger.LogError(exc, "PluginManager");
                     }
                 }
+
+            //plan from metadata first: nothing is loaded for a folder that cannot be loaded
+            var scan = PluginFolderScanner.Scan(_pluginFolder, _config.PluginSkipLoadingPattern, HostAssemblyNames());
+            foreach (var warning in scan.Warnings)
+                _logger.LogWarning("{PluginWarning}", warning);
+
+            var referencedPlugins = new List<PluginInfo>();
+            foreach (var problem in scan.Problems)
+            {
+                _logger.LogError("Plugin folder {PluginFolder} could not be loaded: {LoadError}",
+                    problem.Folder, problem.Message);
+                referencedPlugins.Add(new PluginInfo {
+                    SystemName = problem.Folder,
+                    FriendlyName = problem.Folder,
+                    LoadError = problem.Message
+                });
             }
-            catch (Exception ex)
+
+            //a dependency can be asked for twice (resolved for one plugin, then loaded by the one shipping it);
+            //it is copied once
+            var shadowCopies = new ConcurrentDictionary<string, FileInfo>(StringComparer.OrdinalIgnoreCase);
+            Func<FileInfo, FileInfo> prepareFile = _config.PluginShadowCopy
+                ? file => shadowCopies.GetOrAdd(file.FullName,
+                    _ => ShadowCopyFile(file, Directory.CreateDirectory(_copyFolder.FullName)))
+                : file => file;
+
+            var compatible = scan.Plugins
+                .Where(x => x.Manifest.SupportedVersion == GrandVersion.SupportedPluginVersion)
+                .ToList();
+            ResolveDependenciesFrom(compatible, prepareFile);
+
+            foreach (var candidate in scan.Plugins)
             {
-                var msg = string.Empty;
-                for (var e = ex; e != null; e = e.InnerException)
-                    msg += e.Message + Environment.NewLine;
+                if (candidate.Manifest.SupportedVersion != GrandVersion.SupportedPluginVersion)
+                {
+                    _logger.LogInformation("Incompatible plugin {PluginSystemName}", candidate.Manifest.SystemName);
+                    //listed as not installed, and not loaded
+                    referencedPlugins.Add(PluginLoader.Describe(candidate, false));
+                    continue;
+                }
+
+                if (!_config.PluginShadowCopy)
+                    DeleteDepsFiles(candidate.Folder);
+
+                var installed = installedPluginSystemNames.Contains(candidate.Manifest.SystemName,
+                    StringComparer.OrdinalIgnoreCase);
+                var plugin = PluginLoader.Load(candidate, installed, AssemblyLoadContext.Default, prepareFile);
+                referencedPlugins.Add(plugin);
+
+                //controllers and views only for an installed plugin - an uninstalled one must not be routable
+                if (plugin.LoadError == null && plugin.Installed)
+                {
+                    var error = AddApplicationPart(mvcCoreBuilder, plugin);
+                    if (error != null)
+                    {
+                        plugin.LoadError = error;
+                        plugin.PluginType = null;
+                        plugin.ReferencedAssembly = null;
+                    }
+                }
 
-                var fail = new Exception(msg, ex);
-                throw fail;
+                if (plugin.LoadError != null)
+                {
+                    _logger.LogError("Plugin folder {PluginFolder} could not be loaded: {LoadError}",
+                        candidate.Folder.Name, plugin.LoadError);
+                    continue;
+                }
+
+                //register the plugin class - also when not installed, Install resolves it from DI
+                if (plugin.PluginType != null)
+                    mvcCoreBuilder.Services.AddScoped(plugin.PluginType);
             }
 
             ReferencedPlugins = referencedPlugins;
+
+            var failed = referencedPlugins.FirstOrDefault(x => x.Installed && x.LoadError != null);
+            if (failed != null && _config.FailOnPluginLoadError)
+                throw new GrandException(
+                    $"The installed plugin '{failed.SystemName}' could not be loaded: {failed.LoadError}");
         }
     }
 
@@ -226,55 +215,58 @@ public static void ClearPlugins()
 
     #region Utilities
 
-    private static IList<PluginInfo> GetPluginInfo()
+    /// <summary>
+    ///     Simple names of the assemblies the application itself provides; a plugin's copy of one is never loaded
+    /// </summary>
+    private static HashSet<string> HostAssemblyNames()
     {
-        ArgumentNullException.ThrowIfNull(_pluginFolder);
-
-        var result = new List<PluginInfo>();
-        foreach (var pluginFile in _pluginFolder.GetFiles("*.dll", SearchOption.AllDirectories))
-        {
-            if (!IsPackagePluginFolder(pluginFile.Directory))
-                continue;
-
-            if (!string.IsNullOrEmpty(_config.PluginSkipLoadingPattern)
-                && Matches(pluginFile.Name, _config.PluginSkipLoadingPattern))
-                continue;
-
-            //prepare plugin info
-            var plugins = PreparePluginInfo(pluginFile);
-            if (plugins == null)
-                continue;
-
-            result.Add(plugins);
-        }
+        var trusted = AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES") as string ?? string.Empty;
+        return trusted.Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries)
+            .Select(Path.GetFileNameWithoutExtension)
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+    }
 
-        return result;
+    /// <summary>
+    ///     When two plugins ship the same dependency only one copy is loaded (see <see cref="PluginFolderScanner" />).
+    ///     The plugin whose copy was dropped finds the kept one here, also before the plugin shipping it is loaded.
+    /// </summary>
+    private static void ResolveDependenciesFrom(IEnumerable<PluginCandidate> plugins,
+        Func<FileInfo, FileInfo> prepareFile)
+    {
+        var paths = plugins
+            .SelectMany(x => x.AssemblyPaths)
+            .GroupBy(Path.GetFileNameWithoutExtension, StringComparer.OrdinalIgnoreCase)
+            .ToDictionary(x => x.Key, x => x.First(), StringComparer.OrdinalIgnoreCase);
+
+        if (_resolveDependency != null)
+            AssemblyLoadContext.Default.Resolving -= _resolveDependency;
+
+        _resolveDependency = (context, name) =>
+            name.Name != null && paths.TryGetValue(name.Name, out var path)
+                ? context.LoadFromAssemblyPath(prepareFile(new FileInfo(path)).FullName)
+                : null;
+        AssemblyLoadContext.Default.Resolving += _resolveDependency;
     }
 
-    private static PluginInfo PreparePluginInfo(FileInfo pluginFile)
+    private static void DeleteDepsFiles(DirectoryInfo folder)
     {
-        var plug = _config.PluginShadowCopy
-            ? ShadowCopyFile(pluginFile, Directory.CreateDirectory(_copyFolder.FullName))
-            : pluginFile;
-
-        var assembly = AssemblyLoadContext.Default.LoadFromAssemblyPath(plug.FullName);
-
-        var pluginInfo = assembly.GetCustomAttribute<PluginInfoAttribute>();
-        if (pluginInfo == null) return null;
-
-        var plugin = new PluginInfo {
-            FriendlyName = pluginInfo.FriendlyName,
-            Group = pluginInfo.Group,
-            SystemName = pluginInfo.SystemName,
-            Version = pluginInfo.Version,
-            SupportedVersion = PluginVersionResolver.ResolveSupportedVersion(assembly, pluginInfo.SupportedVersion),
-            Author = pluginInfo.Author,
-            PluginFileName = plug.Name,
-            OriginalAssemblyFile = pluginFile,
-            ReferencedAssembly = assembly
-        };
-
-        return plugin;
+        //remove deps.json files
+        try
+        {
+            foreach (var f in folder.GetFiles("*.deps.json", SearchOption.TopDirectoryOnly))
+                try
+                {
+                    File.Delete(f.FullName);
+                }
+                catch (Exception exc)
+                {
+                    _logger.LogError(exc, "PluginManager");
+                }
+        }
+        catch (Exception exc)
+        {
+            _logger.LogError(exc, "PluginManager");
+        }
     }
 
     /// <summary>
@@ -341,61 +333,32 @@ private static FileInfo ShadowCopyFile(FileInfo plug, DirectoryInfo shadowCopyPl
         return shadowCopiedPlug;
     }
 
-    private static bool Matches(string fullName, string pattern)
-    {
-        return Regex.IsMatch(fullName, pattern, RegexOptions.IgnoreCase | RegexOptions.Compiled, TimeSpan.FromSeconds(1));
-    }
-
-    private static void AddApplicationPart(IMvcCoreBuilder mvcCoreBuilder,
-        Assembly assembly, string systemName, string filename)
+    /// <summary>
+    ///     Adds the plugin's controllers and views; returns the error when its parts cannot be read
+    /// </summary>
+    private static string AddApplicationPart(IMvcCoreBuilder mvcCoreBuilder, PluginInfo plugin)
     {
         try
         {
             //we can now register the plugin definition
-            _logger.LogInformation("Adding to ApplicationParts: '{0}'", systemName);
-            mvcCoreBuilder.AddApplicationPart(assembly);
+            _logger.LogInformation("Adding to ApplicationParts: '{0}'", plugin.SystemName);
 
-            var relatedAssemblies = RelatedAssemblyAttribute.GetRelatedAssemblies(assembly, false);
-            foreach (var relatedAssembly in relatedAssemblies)
-            {
-                var applicationPartFactory = ApplicationPartFactory.GetApplicationPartFactory(relatedAssembly);
-                foreach (var part in applicationPartFactory.GetApplicationParts(relatedAssembly))
-                    mvcCoreBuilder.PartManager.ApplicationParts.Add(part);
-            }
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "PluginManager");
-            throw new InvalidOperationException(
-                $"The plugin directory for the {systemName} file exists in a folder outside of the allowed grandnode folder hierarchy - exception because of {filename} - exception: {ex.Message}");
-        }
-    }
+            //related parts are read first, so a failure adds nothing
+            var relatedParts = RelatedAssemblyAttribute.GetRelatedAssemblies(plugin.ReferencedAssembly, false)
+                .SelectMany(x => ApplicationPartFactory.GetApplicationPartFactory(x).GetApplicationParts(x))
+                .ToList();
 
-    private static void RegisterPluginInterface(IMvcCoreBuilder mvcCoreBuilder, Assembly assembly)
-    {
-        try
-        {
-            foreach (var t in assembly.GetTypes())
-                if (typeof(IPlugin).IsAssignableFrom(t))
-                    mvcCoreBuilder.Services.AddScoped(t);
+            mvcCoreBuilder.AddApplicationPart(plugin.ReferencedAssembly);
+            foreach (var part in relatedParts)
+                mvcCoreBuilder.PartManager.ApplicationParts.Add(part);
+
+            return null;
         }
         catch (Exception ex)
         {
-            _logger.LogError(ex, "RegisterPluginInterface");
+            return ex.Message;
         }
     }
 
-    /// <summary>
-    ///     Determines if the folder is a bin plugin folder for a package
-    /// </summary>
-    /// <param name="folder"></param>
-    /// <returns></returns>
-    private static bool IsPackagePluginFolder(DirectoryInfo folder)
-    {
-        if (folder == null) return false;
-        if (folder.Name.Equals("bin", StringComparison.InvariantCultureIgnoreCase)) return false;
-        return folder.Parent != null && folder.Parent.Name.Equals("Plugins", StringComparison.OrdinalIgnoreCase);
-    }
-
     #endregion
 }
\ No newline at end of file
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs
index 257fdfcc8c..dfa9ecd1bd 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManifestReader.cs
@@ -14,63 +14,71 @@ public static class PluginManifestReader
     private const string AttributeName = nameof(PluginInfoAttribute);
 
     /// <summary>
-    ///     True when the file is a managed assembly (it carries CLI metadata).
+    ///     True when the file is a managed assembly (it carries CLI metadata). A file that is not a
+    ///     PE image is not managed; a file that cannot be read throws.
     /// </summary>
+    /// <exception cref="IOException">The file cannot be opened or read</exception>
+    /// <exception cref="UnauthorizedAccessException">The file cannot be opened</exception>
     public static bool IsManagedAssembly(string path)
     {
-        try
-        {
-            using var stream = File.OpenRead(path);
-            using var peReader = new PEReader(stream);
-            return peReader.HasMetadata;
-        }
-        catch (Exception ex) when (ex is BadImageFormatException or IOException or InvalidOperationException
-                                       or UnauthorizedAccessException)
-        {
-            return false;
-        }
+        using var stream = File.OpenRead(path);
+        using var peReader = new PEReader(stream);
+        return HasMetadata(peReader);
     }
 
     /// <summary>
     ///     Returns the manifest of a plugin assembly, or null for a non-managed file or an assembly
     ///     without <see cref="PluginInfoAttribute" />.
     /// </summary>
+    /// <exception cref="IOException">The file cannot be opened or read</exception>
+    /// <exception cref="UnauthorizedAccessException">The file cannot be opened</exception>
+    /// <exception cref="BadImageFormatException">The attribute cannot be decoded</exception>
     public static PluginManifest Read(string assemblyPath)
     {
-        try
+        using var stream = File.OpenRead(assemblyPath);
+        using var peReader = new PEReader(stream);
+        if (!HasMetadata(peReader))
+            return null;
+
+        var reader = peReader.GetMetadataReader();
+        var provider = new StringTypeProvider();
+        foreach (var handle in reader.GetAssemblyDefinition().GetCustomAttributes())
         {
-            using var stream = File.OpenRead(assemblyPath);
-            using var peReader = new PEReader(stream);
-            if (!peReader.HasMetadata)
-                return null;
-
-            var reader = peReader.GetMetadataReader();
-            var provider = new StringTypeProvider();
-            foreach (var handle in reader.GetAssemblyDefinition().GetCustomAttributes())
-            {
-                var attribute = reader.GetCustomAttribute(handle);
-                if (!IsPluginInfoAttribute(reader, attribute.Constructor))
-                    continue;
-
-                var named = attribute.DecodeValue(provider).NamedArguments
-                    .ToDictionary(x => x.Name, x => x.Value as string, StringComparer.Ordinal);
-
-                return new PluginManifest(
-                    named.GetValueOrDefault(nameof(PluginInfoAttribute.SystemName)),
-                    named.GetValueOrDefault(nameof(PluginInfoAttribute.FriendlyName)),
-                    named.GetValueOrDefault(nameof(PluginInfoAttribute.Group)),
-                    named.GetValueOrDefault(nameof(PluginInfoAttribute.Author)),
-                    named.GetValueOrDefault(nameof(PluginInfoAttribute.Version)),
-                    PluginVersionResolver.ResolveSupportedVersion(GetCoreReference(reader),
-                        named.GetValueOrDefault(nameof(PluginInfoAttribute.SupportedVersion))));
-            }
+            var attribute = reader.GetCustomAttribute(handle);
+            if (!IsPluginInfoAttribute(reader, attribute.Constructor))
+                continue;
+
+            var named = new Dictionary<string, string>(StringComparer.Ordinal);
+            foreach (var argument in attribute.DecodeValue(provider).NamedArguments)
+                if (!named.TryAdd(argument.Name!, argument.Value as string))
+                    throw new BadImageFormatException(
+                        $"The PluginInfo attribute of '{Path.GetFileName(assemblyPath)}' sets {argument.Name} more than once.");
+
+            return new PluginManifest(
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.SystemName)),
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.FriendlyName)),
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.Group)),
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.Author)),
+                named.GetValueOrDefault(nameof(PluginInfoAttribute.Version)),
+                PluginVersionResolver.ResolveSupportedVersion(GetCoreReference(reader),
+                    named.GetValueOrDefault(nameof(PluginInfoAttribute.SupportedVersion))));
+        }
 
-            return null;
+        return null;
+    }
+
+    /// <summary>
+    ///     A file whose headers are not a PE image (a native dll stub, random bytes) has no metadata.
+    /// </summary>
+    private static bool HasMetadata(PEReader peReader)
+    {
+        try
+        {
+            return peReader.HasMetadata;
         }
-        catch (Exception ex) when (ex is BadImageFormatException or IOException or InvalidOperationException
-                                       or UnauthorizedAccessException)
+        catch (BadImageFormatException)
         {
-            return null;
+            return false;
         }
     }
 
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs
new file mode 100644
index 0000000000..753101905c
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs
@@ -0,0 +1,82 @@
+using Grand.Infrastructure.Plugins;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Tests.Plugins.Fixtures;
+
+/// <summary>
+///     A temporary Plugins folder and a collectible load context for plugin loading tests. Disposing
+///     unloads the context and removes the folder.
+/// </summary>
+public sealed class PluginFolderFixture : IDisposable
+{
+    public static readonly string CoreAssemblyPath = typeof(PluginInfoAttribute).Assembly.Location;
+    private static readonly HashSet<string> Host = new(StringComparer.OrdinalIgnoreCase) { "Grand.Infrastructure" };
+
+    private readonly string _root;
+
+    public PluginFolderFixture()
+    {
+        _root = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
+        PluginsFolder = Path.Combine(_root, "Plugins");
+        Directory.CreateDirectory(PluginsFolder);
+        Context = new AssemblyLoadContext("plugin-tests-" + Guid.NewGuid().ToString("N"), true);
+    }
+
+    public string PluginsFolder { get; }
+
+    public AssemblyLoadContext Context { get; }
+
+    public string Folder(string name) => Path.Combine(PluginsFolder, name);
+
+    /// <summary>
+    ///     Compiles a plugin assembly carrying <see cref="PluginInfoAttribute" /> with <paramref name="source" /> beside it.
+    /// </summary>
+    public string AddPlugin(string folder, string assemblyName, string systemName, string source = "",
+        params string[] references)
+    {
+        return TestPluginBuilder.Compile(Folder(folder), assemblyName, $$"""
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "{{systemName}}")]
+            {{source}}
+            """, null, [CoreAssemblyPath, .. references]);
+    }
+
+    /// <summary>
+    ///     Compiles an assembly outside the Plugins folder, to compile a plugin against without shipping it.
+    /// </summary>
+    public string CompileElsewhere(string assemblyName, string source)
+    {
+        return TestPluginBuilder.Compile(Path.Combine(_root, "elsewhere"), assemblyName, source);
+    }
+
+    public PluginScanResult Scan() => PluginFolderScanner.Scan(new DirectoryInfo(PluginsFolder), null, Host);
+
+    public PluginCandidate Candidate(string folder) => Scan().Plugins.Single(x => x.Folder.Name == folder);
+
+    public PluginInfo Load(string folder, bool installed)
+    {
+        return PluginLoader.Load(Candidate(folder), installed, Context, x => x);
+    }
+
+    public System.Reflection.Assembly Loaded(string assemblyName) =>
+        Context.Assemblies.Single(x => x.GetName().Name == assemblyName);
+
+    public void Dispose()
+    {
+        Context.Unload();
+        for (var i = 0; i < 10; i++)
+        {
+            GC.Collect();
+            GC.WaitForPendingFinalizers();
+        }
+
+        try
+        {
+            Directory.Delete(_root, true);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            //a file the context still maps is released once the context is collected; the folder is in temp
+        }
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
index b1a2607be2..b43f9eb9b0 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
@@ -1,4 +1,5 @@
 using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
 using Grand.SharedKernel.Extensions;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 using TestContext = NUnit.Framework.TestContext;
@@ -97,6 +98,77 @@ public void OnlyInstalledPlugins_Assembly_InstalledPlugin_ReturnsTrue()
         }
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public void OnlyInstalledPlugins_SatelliteOfUninstalledPlugin_ReturnsFalse()
+    {
+        using var fixture = new PluginFolderFixture();
+        fixture.AddPlugin("Sat", "Ext.Sat", "Ext.Sat", "public class SatPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(fixture.Folder("Sat"), "Ext.Sat.Core", "public class Core { }");
+        var plugin = fixture.Load("Sat", false);
+
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [plugin];
+            Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(fixture.Loaded("Ext.Sat.Core")));
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void OnlyInstalledPlugins_InstalledPluginWithLoadError_ReturnsFalse()
+    {
+        using var fixture = new PluginFolderFixture();
+        var missing = fixture.CompileElsewhere("Ext.MissingDep", "namespace Missing { public class Base { } }");
+        fixture.AddPlugin("Broken", "Ext.Broken", "Ext.Broken", """
+            public class Derived : Missing.Base { }
+            public class BrokenPlugin : BasePlugin { }
+            """, missing);
+        TestPluginBuilder.Compile(fixture.Folder("Broken"), "Ext.Broken.Core", "public class Core { }");
+        var plugin = fixture.Load("Broken", true);
+        Assert.IsNotNull(plugin.LoadError);
+
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [plugin];
+            Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(fixture.Loaded("Ext.Broken.Core")));
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void OnlyInstalledPlugins_DependencySharedWithInstalledPlugin_ReturnsTrue()
+    {
+        using var fixture = new PluginFolderFixture();
+        fixture.AddPlugin("A", "Ext.A", "Ext.A", "public class APlugin : BasePlugin { }");
+        fixture.AddPlugin("B", "Ext.B", "Ext.B", "public class BPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(fixture.Folder("A"), "Ext.Shared", "public class Shared { }");
+        TestPluginBuilder.Compile(fixture.Folder("B"), "Ext.Shared", "public class Shared { }");
+        var uninstalled = fixture.Load("A", false);
+        var installed = fixture.Load("B", true);
+
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [uninstalled, installed];
+            Assert.IsTrue(PluginExtensions.OnlyInstalledPlugins(fixture.Loaded("Ext.Shared")));
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
     private static PluginInfo SamplePluginInfo(bool installed)
     {
         return new PluginInfo(null, typeof(SampleBasePlugin).Assembly, typeof(SampleBasePlugin)) {
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
index c4e0414322..da4390f37f 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
@@ -115,6 +115,41 @@ public void Scan_SkipPattern_ExcludesMatchingFiles()
         Assert.DoesNotContain("Skipped.Lib", plugin.AssemblyNames);
     }
 
+    [TestMethod]
+    [OSCondition(OperatingSystems.Windows)]
+    public void Scan_UnreadableMainAssembly_IsProblemNamingTheFolder()
+    {
+        var path = AddPlugin("A", "Scan.A", "Scan.A");
+        AddPlugin("B", "Scan.B", "Scan.B");
+
+        PluginScanResult result;
+        using (new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.None))
+        {
+            result = Scan();
+        }
+
+        Assert.AreEqual("B", result.Plugins.Single().Folder.Name);
+        var problem = result.Problems.Single();
+        Assert.AreEqual("A", problem.Folder);
+        Assert.Contains("Scan.A.dll", problem.Message);
+    }
+
+    [TestMethod]
+    public void Scan_EmptyOrMissingSystemName_IsProblem()
+    {
+        AddPlugin("A", "Scan.A", "");
+        TestPluginBuilder.Compile(Folder("B"), "Scan.B", """
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(FriendlyName = "No system name")]
+            """, null, CoreAssemblyPath);
+
+        var result = Scan();
+
+        Assert.IsEmpty(result.Plugins);
+        Assert.HasCount(2, result.Problems);
+        Assert.IsTrue(result.Problems.All(x => x.Message == "has no SystemName"));
+    }
+
     [TestMethod]
     public void Scan_BinAndTempUploadsFolders_AreIgnored()
     {
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
new file mode 100644
index 0000000000..1e7d07fb9e
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
@@ -0,0 +1,89 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginLoaderTests
+{
+    private PluginFolderFixture _fixture;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    public void Load_MissingDependency_SetsLoadErrorAndDoesNotThrow()
+    {
+        var missing = _fixture.CompileElsewhere("Loader.MissingDep", "namespace Missing { public class Base { } }");
+        _fixture.AddPlugin("P", "Loader.Missing", "Loader.Missing", """
+            public class Derived : Missing.Base { }
+            public class MissingPlugin : BasePlugin { }
+            """, missing);
+
+        var plugin = _fixture.Load("P", true);
+
+        Assert.IsNotNull(plugin.LoadError);
+        Assert.Contains("Loader.MissingDep", plugin.LoadError);
+        Assert.IsNull(plugin.PluginType);
+        Assert.IsFalse(plugin.IsActive);
+        Assert.AreEqual("Loader.Missing", plugin.SystemName);
+    }
+
+    [TestMethod]
+    public void Load_AbstractPluginBase_PicksConcreteTypeAndBuildsProvider()
+    {
+        _fixture.AddPlugin("P", "Loader.Abstract", "Loader.Abstract", """
+            public interface IAbstractPlugin : IPlugin { }
+            public abstract class AbstractPluginBase : BasePlugin, IAbstractPlugin { }
+            public class ConcretePlugin : AbstractPluginBase { }
+            """);
+
+        var plugin = _fixture.Load("P", true);
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreEqual("ConcretePlugin", plugin.PluginType.Name);
+        Assert.IsTrue(plugin.IsActive);
+
+        //PluginManager registers the plugin type and nothing else
+        var services = new ServiceCollection();
+        services.AddScoped(plugin.PluginType);
+        using var provider = services.BuildServiceProvider(new ServiceProviderOptions { ValidateOnBuild = true });
+        using var scope = provider.CreateScope();
+        Assert.IsInstanceOfType<IPlugin>(scope.ServiceProvider.GetRequiredService(plugin.PluginType));
+    }
+
+    [TestMethod]
+    public void Load_NoIPluginClass_SetsLoadError()
+    {
+        _fixture.AddPlugin("P", "Loader.NoPlugin", "Loader.NoPlugin", "public class NotAPlugin { }");
+
+        var plugin = _fixture.Load("P", true);
+
+        Assert.AreEqual("has no IPlugin class", plugin.LoadError);
+        Assert.IsNull(plugin.PluginType);
+    }
+
+    [TestMethod]
+    public void Load_SatelliteAssembly_IsInAssemblyNames()
+    {
+        _fixture.AddPlugin("P", "Loader.Sat", "Loader.Sat", "public class SatPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(_fixture.Folder("P"), "Loader.Sat.Core", "public class Core { }");
+
+        var plugin = _fixture.Load("P", false);
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.Contains("Loader.Sat", plugin.AssemblyNames);
+        Assert.Contains("Loader.Sat.Core", plugin.AssemblyNames);
+    }
+}
diff --git a/src/Web/Grand.Web.Admin/App_Data/appsettings.json b/src/Web/Grand.Web.Admin/App_Data/appsettings.json
index 52adfd707b..a95affe184 100644
--- a/src/Web/Grand.Web.Admin/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Admin/App_Data/appsettings.json
@@ -133,7 +133,9 @@
     //For develop you should enable if you want to copy plugin dll files to directory /Plugins/bin on application startup
     "PluginShadowCopy": true,
     //separator comma
-    "InstalledPlugins": ""
+    "InstalledPlugins": "",
+    //Stop the application when an installed plugin fails to load; false starts without it and shows the error on the admin plugin list
+    "FailOnPluginLoadError": false
   },
   "AccessControl": {
     /// A value indicating whether to ignore ACL rules 
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
index 67f75c6e5d..6c2798e0f0 100644
--- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
@@ -115,7 +115,8 @@
 
                 var groupedData = data.Data.reduce(function (result, current) {
 
-                    if (typeof current['Group'] === 'undefined')
+                    //a folder that failed before its manifest was read has no group
+                    if (current['Group'] == null)
                         current['Group'] = "All";
 
                     result[current['Group']] = result[current['Group']] || [];
@@ -136,7 +137,9 @@
                             if (item.Group == key) {
                                 $("#" + keyId + "").append("<li id='" + item.SystemName + "' class='item-installed-" + item.Installed + "'>" +
                                     "<div class='logo'><img src='" + item.LogoUrl + "'></img></div>" +
-                                    "<div class='content'><div class='title'>" + item.FriendlyName + "<span class='install-" + item.Installed + "'>@Loc["Admin.Plugins.Fields.Installed"]</span></div><ul class='info'><li class='version'><span>@Loc["Admin.Plugins.Fields.Version"]:</span>" + item.Version + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.Author"]:</span>" + item.Author + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.SystemName"]:</span>" + item.SystemName + "</li></div></div>" +
+                                    "<div class='content'><div class='title'>" + item.FriendlyName + "<span class='install-" + item.Installed + "'>@Loc["Admin.Plugins.Fields.Installed"]</span></div><ul class='info'><li class='version'><span>@Loc["Admin.Plugins.Fields.Version"]:</span>" + item.Version + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.Author"]:</span>" + item.Author + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.SystemName"]:</span>" + item.SystemName + "</li>" +
+                                    (item.LoadError ? "<li class='version text-danger'><span>@Loc["Admin.Plugins.LoadError"]:</span>" + GrandAdmin.htmlEncode(item.LoadError) + "</li>" : "") +
+                                    "</div></div>" +
                                     "<div class='buttons'><a class='btn btn-outline-secondary btn-sm button-" + item.ConfigurationUrl + "' href='" + item.ConfigurationUrl + "'>@Loc["Admin.Plugins.Fields.Configure"]</a><input type='submit' formaction='@(installurl)?SystemName=" + item.SystemName + "' name='install-plugin-link-" + item.SystemName + "' class='btn btn-outline-secondary btn-sm install-plugin-link button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Install"]' /><input type='submit' formaction='@(uninstallurl)?SystemName=" + item.SystemName + "' name='uninstall-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm uninstall-plugin-link button-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Uninstall"]' /><input type='submit' formaction='@(remove)?SystemName=" + item.SystemName + "' name='remove-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Remove"]' /></div>"
                                 +"</li>");
                             }
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index 3a20a9606f..737acfc8aa 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -41,8 +41,8 @@ protected virtual PluginModel PreparePluginModel(PluginInfo PluginInfo)
         //logo
         pluginModel.LogoUrl = PluginInfo.GetLogoUrl(Request.PathBase);
 
-        //configuration URLs
-        if (PluginInfo.Installed)
+        //configuration URLs - a plugin that failed to load has no instance, its LoadError is shown instead
+        if (PluginInfo.IsActive)
         {
             var pluginInstance = PluginInfo.Instance(serviceProvider);
             pluginModel.ConfigurationUrl = pluginInstance.ConfigurationUrl();
diff --git a/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs b/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
index 7d4aa0ead9..d53ee7dcc2 100644
--- a/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
+++ b/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
@@ -29,6 +29,9 @@ public class PluginModel : BaseModel
     [GrandResourceDisplayName("Admin.Plugins.Fields.Installed")]
     public bool Installed { get; set; }
 
+    [GrandResourceDisplayName("Admin.Plugins.LoadError")]
+    public string LoadError { get; set; }
+
 
     [GrandResourceDisplayName("Admin.Plugins.Fields.Logo")]
     public string LogoUrl { get; set; }
diff --git a/src/Web/Grand.Web.Store/App_Data/appsettings.json b/src/Web/Grand.Web.Store/App_Data/appsettings.json
index d859ae916b..da98052bee 100644
--- a/src/Web/Grand.Web.Store/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Store/App_Data/appsettings.json
@@ -133,7 +133,9 @@
     //For develop you should enable if you want to copy plugin dll files to directory /Plugins/bin on application startup
     "PluginShadowCopy": true,
     //separator comma
-    "InstalledPlugins": ""
+    "InstalledPlugins": "",
+    //Stop the application when an installed plugin fails to load; false starts without it and shows the error on the admin plugin list
+    "FailOnPluginLoadError": false
   },
   "AccessControl": {
     /// A value indicating whether to ignore ACL rules 
diff --git a/src/Web/Grand.Web.Vendor/App_Data/appsettings.json b/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
index 52adfd707b..a95affe184 100644
--- a/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
@@ -133,7 +133,9 @@
     //For develop you should enable if you want to copy plugin dll files to directory /Plugins/bin on application startup
     "PluginShadowCopy": true,
     //separator comma
-    "InstalledPlugins": ""
+    "InstalledPlugins": "",
+    //Stop the application when an installed plugin fails to load; false starts without it and shows the error on the admin plugin list
+    "FailOnPluginLoadError": false
   },
   "AccessControl": {
     /// A value indicating whether to ignore ACL rules 
diff --git a/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml b/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml
index 7f27d889f67f87d81220ee7077d522e970144892..1a0074eda066f90394efc1c724488feae31822a5 100644
GIT binary patch
delta 120
zcmaEKF=f@|l!g|@7N!>F7M2#)7Pc1l7LFFq7OocV7M?A<XT+ypDi@WSwv}0fJCPxU
zL4hHap@^Yq`o=WQ<mn9(ydv!<#Cd_34~Y4JSOACxfmjHLg@G6(FABtBKr9Z#65CIR
IOG*g>0P4gkLjV8(

delta 89
zcmZ2=IpxvCl!g|@7N!>F7M2#)7Pc1l7LFFq7OocV7M?A<XT;m5NbmwN9}x2cu>cSY
c0<jPf3j?tT5Q_q_7!ZThN^GAZAt@#Z0F3t?fB*mh

diff --git a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
index 6a4d1bdafb..b82f1fa1ee 100644
--- a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
+++ b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
@@ -846,4 +846,7 @@
 	<Resource Name="Admin.Settings.GeneralCommon.DefaultStoreTimeZone.Server" Area="Admin">
 		<Value>Server time zone</Value>
 	</Resource>
+	<Resource Name="Admin.Plugins.LoadError" Area="Admin">
+		<Value>Load error</Value>
+	</Resource>
 </Language>
diff --git a/src/Web/Grand.Web/App_Data/appsettings.json b/src/Web/Grand.Web/App_Data/appsettings.json
index 39578c2ac5..5e48700de3 100644
--- a/src/Web/Grand.Web/App_Data/appsettings.json
+++ b/src/Web/Grand.Web/App_Data/appsettings.json
@@ -147,7 +147,9 @@
     //For develop you should enable if you want to copy plugin dll files to directory /Plugins/bin on application startup
     "PluginShadowCopy": true,
     //separator comma
-    "InstalledPlugins": ""
+    "InstalledPlugins": "",
+    //Stop the application when an installed plugin fails to load; false starts without it and shows the error on the admin plugin list
+    "FailOnPluginLoadError": false
   },
   "AccessControl": {
     /// A value indicating whether to ignore ACL rules 

From c7466e06bbc3cd155668f1fd254725cdef9a1e75 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Tue, 3 Nov 2026 18:52:51 +0100
Subject: [PATCH 03/30] List an installed plugin that fails at scan time as
 installed and keep incompatible plugins out of dependency dedupe

---
 .../Plugins/PluginFolderScanner.cs            | 24 +++++--
 .../Plugins/PluginLoader.cs                   | 51 +++++++++++++++
 .../Plugins/PluginManager.cs                  | 24 +++----
 .../Plugins/PluginFolderScannerTests.cs       | 18 ++++++
 .../Plugins/PluginLoaderTests.cs              | 63 +++++++++++++++++++
 5 files changed, 161 insertions(+), 19 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
index e27d0f146a..22eaace1ad 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
@@ -20,7 +20,19 @@ public sealed record PluginCandidate(
     IReadOnlyList<string> AssemblyPaths,
     IReadOnlyCollection<string> AssemblyNames);
 
-public sealed record PluginLoadProblem(string Folder, string Message);
+/// <summary>
+///     A plugin folder that cannot be loaded.
+/// </summary>
+/// <param name="SystemNames">
+///     The system names the folder declares, when they could be read; empty when the folder's plugin
+///     cannot be identified (an unreadable or undecodable file, a manifest without a system name)
+/// </param>
+public sealed record PluginLoadProblem(string Folder, string Message, IReadOnlyList<string> SystemNames)
+{
+    public PluginLoadProblem(string folder, string message) : this(folder, message, [])
+    {
+    }
+}
 
 public sealed record PluginScanResult(
     IReadOnlyList<PluginCandidate> Plugins,
@@ -79,7 +91,8 @@ public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPatt
             if (manifests.Count > 1)
             {
                 problems.Add(new PluginLoadProblem(folder.Name,
-                    $"The folder contains {manifests.Count} plugin assemblies ({string.Join(", ", manifests.Select(x => x.Name))}); only one is allowed."));
+                    $"The folder contains {manifests.Count} plugin assemblies ({string.Join(", ", manifests.Select(x => x.Name))}); only one is allowed.",
+                    manifests.Select(x => x.Manifest.SystemName).Where(x => !string.IsNullOrWhiteSpace(x)).ToList()));
                 continue;
             }
 
@@ -94,7 +107,8 @@ public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPatt
             if (!systemNames.Add(manifest.SystemName))
             {
                 problems.Add(new PluginLoadProblem(folder.Name,
-                    $"The plugin system name '{manifest.SystemName}' is already used by another plugin folder."));
+                    $"The plugin system name '{manifest.SystemName}' is already used by another plugin folder.",
+                    [manifest.SystemName]));
                 continue;
             }
 
@@ -180,7 +194,8 @@ private static bool IsReadFailure(Exception ex) =>
 
     /// <summary>
     ///     When two plugins ship the same dependency only the higher version is loaded, so one load
-    ///     context never sees two copies of it. A plugin's own main assembly is never dropped.
+    ///     context never sees two copies of it. A plugin's own main assembly is never dropped. A plugin
+    ///     built for another version is never loaded, so its copies take no part.
     /// </summary>
     private static List<PluginCandidate> DropLowerVersions(
         List<(PluginCandidate Candidate, List<ScannedFile> Files)> plugins, List<string> warnings)
@@ -188,6 +203,7 @@ private static List<PluginCandidate> DropLowerVersions(
         var dropped = new Dictionary<PluginCandidate, HashSet<string>>();
 
         var groups = plugins
+            .Where(p => p.Candidate.Manifest.SupportedVersion == GrandVersion.SupportedPluginVersion)
             .SelectMany(p => p.Files.Select(f => (p.Candidate, File: f)))
             .Where(x => !string.Equals(x.File.Path, x.Candidate.MainAssemblyPath, StringComparison.OrdinalIgnoreCase))
             .GroupBy(x => x.File.Name, StringComparer.OrdinalIgnoreCase)
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
index 8aa02b24cb..aecd118e6d 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
@@ -1,3 +1,4 @@
+using Grand.SharedKernel;
 using System.Reflection;
 using System.Runtime.Loader;
 
@@ -91,6 +92,56 @@ internal static PluginInfo Describe(PluginCandidate candidate, bool installed)
         };
     }
 
+    /// <summary>
+    ///     The list entries for a folder the scan could not plan: one per system name it declares, installed
+    ///     when that name is installed, or one named after the folder when its plugin cannot be identified.
+    /// </summary>
+    public static IEnumerable<PluginInfo> DescribeProblem(PluginLoadProblem problem,
+        IEnumerable<string> installedSystemNames)
+    {
+        ArgumentNullException.ThrowIfNull(problem);
+        ArgumentNullException.ThrowIfNull(installedSystemNames);
+
+        if (problem.SystemNames.Count == 0)
+            return [
+                new PluginInfo {
+                    SystemName = problem.Folder,
+                    FriendlyName = problem.Folder,
+                    LoadError = problem.Message
+                }
+            ];
+
+        var installed = installedSystemNames.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        return problem.SystemNames.Select(name => new PluginInfo {
+            SystemName = name,
+            FriendlyName = name,
+            LoadError = problem.Message,
+            Installed = installed.Contains(name)
+        }).ToList();
+    }
+
+    /// <summary>
+    ///     With <paramref name="failOnPluginLoadError" />, throws when an installed plugin failed to load, or
+    ///     when a folder failed before its plugin could be identified - it may be an installed one.
+    /// </summary>
+    /// <exception cref="GrandException">The plugin or folder that failed, and why</exception>
+    public static void ThrowOnLoadError(IEnumerable<PluginInfo> plugins, IEnumerable<PluginLoadProblem> problems,
+        bool failOnPluginLoadError)
+    {
+        if (!failOnPluginLoadError)
+            return;
+
+        var failed = plugins.FirstOrDefault(x => x.Installed && x.LoadError != null);
+        if (failed != null)
+            throw new GrandException(
+                $"The installed plugin '{failed.SystemName}' could not be loaded: {failed.LoadError}");
+
+        var unidentified = problems.FirstOrDefault(x => x.SystemNames.Count == 0);
+        if (unidentified != null)
+            throw new GrandException(
+                $"The plugin folder '{unidentified.Folder}' could not be loaded: {unidentified.Message}");
+    }
+
     /// <summary>
     ///     A file already loaded into the context (it resolved as another plugin's dependency) is reused;
     ///     loading it again would fail with "Assembly with same name is already loaded".
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index 47efb01b10..bb21bccc15 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -1,5 +1,4 @@
 using Grand.Infrastructure.Configuration;
-using Grand.SharedKernel;
 using Grand.SharedKernel.Extensions;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.ApplicationParts;
@@ -98,16 +97,6 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
                 _logger.LogWarning("{PluginWarning}", warning);
 
             var referencedPlugins = new List<PluginInfo>();
-            foreach (var problem in scan.Problems)
-            {
-                _logger.LogError("Plugin folder {PluginFolder} could not be loaded: {LoadError}",
-                    problem.Folder, problem.Message);
-                referencedPlugins.Add(new PluginInfo {
-                    SystemName = problem.Folder,
-                    FriendlyName = problem.Folder,
-                    LoadError = problem.Message
-                });
-            }
 
             //a dependency can be asked for twice (resolved for one plugin, then loaded by the one shipping it);
             //it is copied once
@@ -164,12 +153,17 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
                     mvcCoreBuilder.Services.AddScoped(plugin.PluginType);
             }
 
+            //after the loaded plugins: a lookup by a system name a second folder duplicates finds the working one
+            foreach (var problem in scan.Problems)
+            {
+                _logger.LogError("Plugin folder {PluginFolder} could not be loaded: {LoadError}",
+                    problem.Folder, problem.Message);
+                referencedPlugins.AddRange(PluginLoader.DescribeProblem(problem, installedPluginSystemNames));
+            }
+
             ReferencedPlugins = referencedPlugins;
 
-            var failed = referencedPlugins.FirstOrDefault(x => x.Installed && x.LoadError != null);
-            if (failed != null && _config.FailOnPluginLoadError)
-                throw new GrandException(
-                    $"The installed plugin '{failed.SystemName}' could not be loaded: {failed.LoadError}");
+            PluginLoader.ThrowOnLoadError(referencedPlugins, scan.Problems, _config.FailOnPluginLoadError);
         }
     }
 
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
index da4390f37f..cae61d6bba 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
@@ -51,6 +51,7 @@ public void Scan_DuplicateSystemName_SecondFolderIsProblem()
         Assert.AreEqual("A", result.Plugins[0].Folder.Name);
         Assert.HasCount(1, result.Problems);
         Assert.AreEqual("B", result.Problems[0].Folder);
+        Assert.AreEqual("scan.same", result.Problems[0].SystemNames.Single());
     }
 
     [TestMethod]
@@ -74,6 +75,23 @@ public void Scan_SameDependencyTwoVersions_KeepsHigherVersionOnce()
         Assert.IsTrue(result.Warnings.Any(x => x.Contains("Shared.Lib") && x.Contains("'A'") && x.Contains("'B'")));
     }
 
+    [TestMethod]
+    public void Scan_IncompatiblePluginShipsHigherVersion_CompatibleKeepsItsCopy()
+    {
+        AddPlugin("A", "Scan.A", "Scan.A");
+        var own = TestPluginBuilder.Compile(Folder("A"), "Shared.Lib", "public class Lib { }", new Version(1, 0, 0, 0));
+        TestPluginBuilder.Compile(Folder("B"), "Scan.B", """
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "Scan.B", SupportedVersion = "1.0")]
+            """, null, CoreAssemblyPath);
+        TestPluginBuilder.Compile(Folder("B"), "Shared.Lib", "public class Lib { }", new Version(2, 0, 0, 0));
+
+        var result = Scan();
+
+        CollectionAssert.Contains(result.Plugins.Single(x => x.Folder.Name == "A").AssemblyPaths.ToList(), own);
+        Assert.IsEmpty(result.Warnings);
+    }
+
     [TestMethod]
     public void Scan_HostAssemblyInPluginFolder_IsSkippedAndNotOwned()
     {
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
index 1e7d07fb9e..5fd033e60b 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
@@ -1,5 +1,6 @@
 using Grand.Infrastructure.Plugins;
 using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Grand.SharedKernel;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 
@@ -74,6 +75,68 @@ public void Load_NoIPluginClass_SetsLoadError()
         Assert.IsNull(plugin.PluginType);
     }
 
+    [TestMethod]
+    public void Load_DependencyKeptByIncompatiblePlugin_StillResolves()
+    {
+        const string sharedSource = "namespace Shared { public class Base { } }";
+        var shared = TestPluginBuilder.Compile(_fixture.Folder("A"), "Loader.Shared", sharedSource,
+            new Version(1, 0, 0, 0));
+        _fixture.AddPlugin("A", "Loader.A", "Loader.A", """
+            public class Derived : Shared.Base { }
+            public class APlugin : BasePlugin { }
+            """, shared);
+        //a plugin built for another version ships the higher copy; it is never loaded, so it must not take the dependency
+        TestPluginBuilder.Compile(_fixture.Folder("B"), "Loader.Shared", sharedSource, new Version(2, 0, 0, 0));
+        TestPluginBuilder.Compile(_fixture.Folder("B"), "Loader.B", """
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "Loader.B", SupportedVersion = "1.0")]
+            """, null, PluginFolderFixture.CoreAssemblyPath);
+
+        var plugin = _fixture.Load("A", true);
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreEqual("APlugin", plugin.PluginType.Name);
+    }
+
+    [TestMethod]
+    public void Problem_KnownSystemNameOfInstalledPlugin_IsInstalledAndFailsStrictMode()
+    {
+        _fixture.AddPlugin("Multi", "Loader.One", "Loader.One");
+        _fixture.AddPlugin("Multi", "Loader.Two", "Loader.Two");
+        var problems = _fixture.Scan().Problems;
+
+        var problem = problems.Single();
+        CollectionAssert.AreEquivalent(new[] { "Loader.One", "Loader.Two" }, problem.SystemNames.ToList());
+        var entries = PluginLoader.DescribeProblem(problem, ["loader.one"]).ToList();
+
+        var one = entries.Single(x => x.SystemName == "Loader.One");
+        Assert.IsTrue(one.Installed);
+        Assert.AreEqual(problem.Message, one.LoadError);
+        Assert.IsFalse(entries.Single(x => x.SystemName == "Loader.Two").Installed);
+
+        var ex = Assert.ThrowsExactly<GrandException>(() => PluginLoader.ThrowOnLoadError(entries, problems, true));
+        Assert.Contains("Loader.One", ex.Message);
+        PluginLoader.ThrowOnLoadError(entries, problems, false);
+    }
+
+    [TestMethod]
+    public void Problem_UnknownSystemName_FailsStrictModeOnly()
+    {
+        _fixture.AddPlugin("Nameless", "Loader.Nameless", "");
+        var problems = _fixture.Scan().Problems;
+
+        var problem = problems.Single();
+        Assert.IsEmpty(problem.SystemNames);
+        var entries = PluginLoader.DescribeProblem(problem, []).ToList();
+        Assert.AreEqual("Nameless", entries.Single().SystemName);
+        Assert.IsFalse(entries.Single().Installed);
+
+        var ex = Assert.ThrowsExactly<GrandException>(() => PluginLoader.ThrowOnLoadError(entries, problems, true));
+        Assert.Contains("Nameless", ex.Message);
+        Assert.Contains("has no SystemName", ex.Message);
+        PluginLoader.ThrowOnLoadError(entries, problems, false);
+    }
+
     [TestMethod]
     public void Load_SatelliteAssembly_IsInAssemblyNames()
     {

From 1f420243d8588714c94c622b6c1f680b076a52de Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Tue, 3 Nov 2026 19:00:47 +0100
Subject: [PATCH 04/30] Validate uploaded plugins from their manifest and
 install them atomically

---
 .../Plugins/PluginArchiveInstaller.cs         | 293 ++++++++++++++++++
 .../Plugins/PluginArchiveInstallerTests.cs    | 248 +++++++++++++++
 .../Controllers/PluginController.cs           | 117 +------
 3 files changed, 544 insertions(+), 114 deletions(-)
 create mode 100644 src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
new file mode 100644
index 0000000000..6869e23e81
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
@@ -0,0 +1,293 @@
+using System.IO.Compression;
+using Grand.SharedKernel;
+using Grand.SharedKernel.Extensions;
+using Microsoft.Extensions.Logging;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     Installs an uploaded plugin archive. The plugin is identified by the manifest in its own folder, never by
+///     loading its assemblies, and the target folder is swapped in one step so a failure leaves the previous
+///     version in place.
+/// </summary>
+public sealed class PluginArchiveInstaller(string pluginsPath, ILogger logger)
+{
+    public const int MaxEntries = 5000;
+    public const long MaxUncompressedBytes = 200L * 1024 * 1024;
+
+    private const string PluginsFolderName = "Plugins";
+    private const string BinFolderName = "bin";
+    private const string ExtractedFolderName = "x";
+    private const string PreviousFolderName = "previous";
+
+    /// <summary>
+    ///     Validates the archive and installs the plugin it contains into the plugins folder.
+    /// </summary>
+    /// <param name="archivePath">Path of the zip file</param>
+    /// <exception cref="GrandException">The archive is not an installable plugin; the message is meant for the admin</exception>
+    public PluginArchiveResult Install(string archivePath)
+    {
+        var tempRoot = Path.Combine(pluginsPath, CommonPath.TmpUploadPath, Guid.NewGuid().ToString());
+        try
+        {
+            CheckArchiveSize(archivePath);
+
+            var extracted = Path.Combine(tempRoot, ExtractedFolderName);
+            Extract(archivePath, extracted);
+            NormalizeBackslashes(extracted);
+
+            var (folderName, sourceFolder) = FindPluginFolder(extracted);
+            var manifest = ReadSingleManifest(sourceFolder);
+
+            if (!string.Equals(manifest.SupportedVersion, GrandVersion.SupportedPluginVersion, StringComparison.Ordinal))
+                throw new GrandException(
+                    $"This plugin doesn't support the current version - {GrandVersion.SupportedPluginVersion}");
+
+            if (IsSystemNameUsedByAnotherFolder(manifest.SystemName, folderName))
+                throw new GrandException(
+                    $"A plugin with the system name '{manifest.SystemName}' is already installed in another folder.");
+
+            Replace(sourceFolder, Path.Combine(pluginsPath, folderName), Path.Combine(tempRoot, PreviousFolderName));
+            return new PluginArchiveResult(folderName, manifest);
+        }
+        finally
+        {
+            DeleteTempRoot(tempRoot);
+        }
+    }
+
+    private static void CheckArchiveSize(string archivePath)
+    {
+        try
+        {
+            using var archive = ZipFile.OpenRead(archivePath);
+            if (archive.Entries.Count > MaxEntries)
+                throw new GrandException($"The archive contains too many files (the limit is {MaxEntries}).");
+
+            long total = 0;
+            foreach (var entry in archive.Entries)
+            {
+                total += entry.Length;
+                if (total > MaxUncompressedBytes)
+                    throw new GrandException(
+                        $"The archive is too large when unpacked (the limit is {MaxUncompressedBytes / 1024 / 1024} MB).");
+            }
+        }
+        catch (InvalidDataException)
+        {
+            throw new GrandException("The file is not a valid zip archive.");
+        }
+    }
+
+    private static void Extract(string archivePath, string destination)
+    {
+        Directory.CreateDirectory(destination);
+        try
+        {
+            //refuses entries that would land outside the destination
+            ZipFile.ExtractToDirectory(archivePath, destination);
+        }
+        catch (Exception ex) when (ex is IOException or InvalidDataException or UnauthorizedAccessException)
+        {
+            throw new GrandException("The archive could not be unpacked. Check that it is a valid plugin archive.");
+        }
+    }
+
+    /// <summary>
+    ///     Where '\' is not the directory separator, an entry written with backslashes is extracted as one
+    ///     file with backslashes in its name; move it to the path it stands for.
+    /// </summary>
+    private static void NormalizeBackslashes(string root)
+    {
+        if (Path.DirectorySeparatorChar == '\\')
+            return;
+
+        var rootFull = Path.GetFullPath(root) + Path.DirectorySeparatorChar;
+        foreach (var file in Directory.GetFiles(root, "*", SearchOption.AllDirectories)
+                     .Where(x => Path.GetFileName(x).Contains('\\')).ToList())
+        {
+            var relative = Path.GetRelativePath(root, file).Replace('\\', Path.DirectorySeparatorChar);
+            var destination = Path.GetFullPath(Path.Combine(root, relative));
+            if (!destination.StartsWith(rootFull, StringComparison.Ordinal))
+                throw new GrandException("The archive contains a path outside of the plugin folder.");
+
+            Directory.CreateDirectory(Path.GetDirectoryName(destination)!);
+            File.Move(file, destination, true);
+        }
+    }
+
+    /// <summary>
+    ///     The plugin folder is the one top-level folder holding the files; an archive that wraps it in a
+    ///     <c>Plugins</c> folder is unwrapped first. The folder is derived from the files, not from directory entries.
+    /// </summary>
+    private static (string Name, string Path) FindPluginFolder(string extracted)
+    {
+        var root = extracted;
+        var folders = TopLevelFolders(root);
+
+        if (folders.Count == 1 && string.Equals(folders[0], PluginsFolderName, StringComparison.OrdinalIgnoreCase))
+        {
+            root = Path.Combine(root, folders[0]);
+            folders = TopLevelFolders(root);
+        }
+
+        if (folders.Count != 1)
+            throw new GrandException(
+                "The archive should contain only one root plugin folder. For example, Payments.StripeCheckout.");
+
+        var name = folders[0];
+        if (!IsValidFolderName(name))
+            throw new GrandException($"'{name}' cannot be used as a plugin folder name.");
+
+        return (name, Path.Combine(root, name));
+    }
+
+    /// <summary>
+    ///     Names of the first path segments of all files. A file at the top level has no plugin folder to
+    ///     own it and invalidates the archive.
+    /// </summary>
+    private static List<string> TopLevelFolders(string root)
+    {
+        var names = new List<string>();
+        foreach (var file in Directory.EnumerateFiles(root, "*", SearchOption.AllDirectories))
+        {
+            var relative = Path.GetRelativePath(root, file);
+            var separator = relative.IndexOf(Path.DirectorySeparatorChar);
+            if (separator < 0)
+                throw new GrandException("The archive should not contain files outside of the plugin folder.");
+
+            var name = relative[..separator];
+            if (!names.Contains(name, StringComparer.OrdinalIgnoreCase))
+                names.Add(name);
+        }
+
+        return names;
+    }
+
+    private static bool IsValidFolderName(string name)
+    {
+        if (string.IsNullOrWhiteSpace(name) || name is "." or "..")
+            return false;
+        if (name.IndexOfAny(Path.GetInvalidFileNameChars()) >= 0)
+            return false;
+        return !IsReservedFolder(name);
+    }
+
+    private static bool IsReservedFolder(string name) =>
+        string.Equals(name, BinFolderName, StringComparison.OrdinalIgnoreCase) ||
+        string.Equals(name, CommonPath.TmpUploadPath, StringComparison.OrdinalIgnoreCase);
+
+    private static PluginManifest ReadSingleManifest(string folder)
+    {
+        var manifests = new List<PluginManifest>();
+        foreach (var dll in Directory.GetFiles(folder, "*.dll", SearchOption.TopDirectoryOnly))
+        {
+            PluginManifest manifest;
+            try
+            {
+                manifest = PluginManifestReader.Read(dll);
+            }
+            catch (Exception ex) when (ex is IOException or BadImageFormatException or UnauthorizedAccessException)
+            {
+                throw new GrandException($"The file '{Path.GetFileName(dll)}' could not be read as an assembly.");
+            }
+
+            if (manifest != null)
+                manifests.Add(manifest);
+        }
+
+        return manifests.Count switch {
+            0 => throw new GrandException(
+                "No plugin info is found. The plugin assembly must be in the root of the plugin folder."),
+            1 => manifests[0] is { SystemName: { Length: > 0 } }
+                ? manifests[0]
+                : throw new GrandException("The plugin info does not define a system name."),
+            _ => throw new GrandException("The plugin folder contains more than one plugin assembly.")
+        };
+    }
+
+    private bool IsSystemNameUsedByAnotherFolder(string systemName, string folderName)
+    {
+        if (!Directory.Exists(pluginsPath))
+            return false;
+
+        foreach (var directory in Directory.GetDirectories(pluginsPath))
+        {
+            var name = Path.GetFileName(directory);
+            if (IsReservedFolder(name) || string.Equals(name, folderName, StringComparison.OrdinalIgnoreCase))
+                continue;
+
+            foreach (var dll in Directory.GetFiles(directory, "*.dll", SearchOption.TopDirectoryOnly))
+            {
+                try
+                {
+                    var existing = PluginManifestReader.Read(dll);
+                    if (existing != null && string.Equals(existing.SystemName, systemName,
+                            StringComparison.OrdinalIgnoreCase))
+                        return true;
+                }
+                catch (Exception ex) when (ex is IOException or BadImageFormatException
+                                               or UnauthorizedAccessException)
+                {
+                    //an unreadable file in another plugin folder is not the uploaded plugin's concern
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    ///     Moves the existing folder aside, moves the new one in, and moves the old one back if that fails.
+    ///     A locked file makes the first move fail, before anything has changed.
+    /// </summary>
+    private static void Replace(string source, string target, string previous)
+    {
+        var hadPrevious = Directory.Exists(target);
+        if (hadPrevious)
+        {
+            try
+            {
+                Directory.Move(target, previous);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                throw new GrandException(
+                    "The installed version of the plugin is in use and cannot be replaced. Stop the application and try again.");
+            }
+        }
+
+        try
+        {
+            Directory.Move(source, target);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            if (hadPrevious)
+            {
+                if (Directory.Exists(target))
+                    Directory.Delete(target, true);
+                Directory.Move(previous, target);
+            }
+
+            throw new GrandException("The plugin could not be installed.");
+        }
+    }
+
+    private void DeleteTempRoot(string tempRoot)
+    {
+        try
+        {
+            if (Directory.Exists(tempRoot))
+                Directory.Delete(tempRoot, true);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            //the previous plugin version moved here can hold an assembly this process has loaded;
+            //it is not loaded from here on the next start and the next upload removes it
+            logger.LogWarning(ex, "The temporary upload folder {TempDirectory} could not be deleted", tempRoot);
+        }
+    }
+}
+
+public sealed record PluginArchiveResult(string FolderName, PluginManifest Manifest);
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
new file mode 100644
index 0000000000..9c35fdfd88
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
@@ -0,0 +1,248 @@
+using System.IO.Compression;
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Grand.SharedKernel;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginArchiveInstallerTests
+{
+    private static readonly string CoreAssemblyPath = typeof(PluginInfoAttribute).Assembly.Location;
+
+    private string _root;
+    private string _plugins;
+    private string _build;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _root = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
+        _plugins = Path.Combine(_root, "Plugins");
+        _build = Path.Combine(_root, "build");
+        Directory.CreateDirectory(_plugins);
+        Directory.CreateDirectory(_build);
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        if (Directory.Exists(_root))
+            Directory.Delete(_root, true);
+    }
+
+    private PluginArchiveInstaller CreateInstaller() => new(_plugins, NullLogger.Instance);
+
+    private static string Source(string systemName, string attributeExtra = "") => $$"""
+        using Grand.Infrastructure.Plugins;
+        [assembly: PluginInfo(SystemName = "{{systemName}}", FriendlyName = "Test"{{attributeExtra}})]
+        """;
+
+    /// <summary>Compiles a plugin into a fresh folder named <paramref name="folderName" /> and returns that folder.</summary>
+    private string BuildPluginFolder(string folderName, string systemName, string attributeExtra = "")
+    {
+        var folder = Path.Combine(_build, Guid.NewGuid().ToString("N"), folderName);
+        TestPluginBuilder.Compile(folder, systemName, Source(systemName, attributeExtra), null, CoreAssemblyPath);
+        return folder;
+    }
+
+    private string ZipFolder(string folder, bool includeBaseDirectory = true)
+    {
+        var zip = Path.Combine(_build, Guid.NewGuid().ToString("N") + ".zip");
+        ZipFile.CreateFromDirectory(folder, zip, CompressionLevel.Optimal, includeBaseDirectory);
+        return zip;
+    }
+
+    private string ZipEntries(params (string Name, byte[] Content)[] entries)
+    {
+        var zip = Path.Combine(_build, Guid.NewGuid().ToString("N") + ".zip");
+        using var archive = ZipFile.Open(zip, ZipArchiveMode.Create);
+        foreach (var (name, content) in entries)
+        {
+            var entry = archive.CreateEntry(name);
+            using var stream = entry.Open();
+            stream.Write(content);
+        }
+
+        return zip;
+    }
+
+    private static string Hash(string folder) => string.Join("|", Directory
+        .GetFiles(folder, "*", SearchOption.AllDirectories).Order(StringComparer.Ordinal)
+        .Select(x => Path.GetRelativePath(folder, x) + ":" + Convert.ToHexString(
+            System.Security.Cryptography.SHA256.HashData(File.ReadAllBytes(x)))));
+
+    [TestMethod]
+    public void Install_StandardPluginWithoutDeclaredVersion_Installs()
+    {
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var zip = ZipFolder(folder);
+
+        var result = CreateInstaller().Install(zip);
+
+        Assert.AreEqual("Tax.FixedRate", result.FolderName);
+        Assert.AreEqual("Tax.FixedRate", result.Manifest.SystemName);
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Tax.FixedRate.dll")));
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "TempUploads")) &&
+                       Directory.EnumerateFileSystemEntries(Path.Combine(_plugins, "TempUploads")).Any());
+    }
+
+    [TestMethod]
+    public void Install_ArchiveWithoutDirectoryEntries_Installs()
+    {
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var zip = ZipEntries(("Tax.FixedRate/Tax.FixedRate.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.FixedRate.dll"))));
+
+        CreateInstaller().Install(zip);
+
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Tax.FixedRate.dll")));
+    }
+
+    [TestMethod]
+    public void Install_BackslashEntryNames_Installs()
+    {
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var zip = ZipEntries(
+            ("Tax.FixedRate\\Tax.FixedRate.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.FixedRate.dll"))),
+            ("Tax.FixedRate\\Views\\a.txt", [1, 2, 3]));
+
+        CreateInstaller().Install(zip);
+
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Tax.FixedRate.dll")));
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Views", "a.txt")));
+    }
+
+    [TestMethod]
+    public void Install_ArchiveWrappedInPluginsFolder_Installs()
+    {
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var zip = ZipEntries(("Plugins/Tax.FixedRate/Tax.FixedRate.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.FixedRate.dll"))));
+
+        var result = CreateInstaller().Install(zip);
+
+        Assert.AreEqual("Tax.FixedRate", result.FolderName);
+        Assert.IsTrue(File.Exists(Path.Combine(_plugins, "Tax.FixedRate", "Tax.FixedRate.dll")));
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Plugins")));
+    }
+
+    [TestMethod]
+    public void Install_TwoRootFolders_IsRejected()
+    {
+        var a = BuildPluginFolder("Tax.A", "Tax.A");
+        var b = BuildPluginFolder("Tax.B", "Tax.B");
+        var zip = ZipEntries(
+            ("Tax.A/Tax.A.dll", File.ReadAllBytes(Path.Combine(a, "Tax.A.dll"))),
+            ("Tax.B/Tax.B.dll", File.ReadAllBytes(Path.Combine(b, "Tax.B.dll"))));
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.A")));
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.B")));
+    }
+
+    [TestMethod]
+    public void Install_DllInSubfolderOfRoot_DoesNotTouchOtherPlugin()
+    {
+        var existing = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        File.Copy(Path.Combine(existing, "Tax.FixedRate.dll"), Path.Combine(target, "Tax.FixedRate.dll"));
+        var before = Hash(target);
+
+        var inner = BuildPluginFolder("Inner", "X");
+        var zip = ZipEntries(("Tax.FixedRate/Inner/X.dll", File.ReadAllBytes(Path.Combine(inner, "X.dll"))));
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.AreEqual(before, Hash(target));
+    }
+
+    [TestMethod]
+    public void Install_OtherVersion_IsRejected()
+    {
+        var folder = BuildPluginFolder("Tax.Old", "Tax.Old", ", SupportedVersion = \"1.0\"");
+        var zip = ZipFolder(folder);
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.Old")));
+    }
+
+    [TestMethod]
+    public void Install_SystemNameUsedByAnotherFolder_IsRejected()
+    {
+        var existing = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        File.Copy(Path.Combine(existing, "Tax.FixedRate.dll"), Path.Combine(target, "Tax.FixedRate.dll"));
+
+        var copy = BuildPluginFolder("Tax.FixedRateCopy", "tax.fixedrate");
+        var zip = ZipFolder(copy);
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.FixedRateCopy")));
+    }
+
+    [TestMethod]
+    public void Install_TooManyEntries_IsRejected()
+    {
+        var entries = Enumerable.Range(0, PluginArchiveInstaller.MaxEntries + 1)
+            .Select(x => ($"Tax.Big/f{x}.txt", Array.Empty<byte>())).ToArray();
+        var zip = ZipEntries(entries);
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.Big")));
+    }
+
+    [TestMethod]
+    public void Install_ReplacesExistingVersion()
+    {
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        File.WriteAllText(Path.Combine(target, "old.txt"), "old");
+
+        var folder = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        CreateInstaller().Install(ZipFolder(folder));
+
+        Assert.IsFalse(File.Exists(Path.Combine(target, "old.txt")));
+        Assert.IsTrue(File.Exists(Path.Combine(target, "Tax.FixedRate.dll")));
+    }
+
+    [TestMethod]
+    [OSCondition(OperatingSystems.Windows)]
+    public void Install_TargetFileLocked_LeavesPreviousVersion()
+    {
+        var old = BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate");
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        var oldDll = Path.Combine(target, "Tax.FixedRate.dll");
+        File.Copy(Path.Combine(old, "Tax.FixedRate.dll"), oldDll);
+        File.WriteAllText(Path.Combine(target, "other.txt"), "keep");
+        var before = Hash(target);
+
+        var zip = ZipFolder(BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate"));
+
+        using (new FileStream(oldDll, FileMode.Open, FileAccess.Read, FileShare.None))
+        {
+            Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+        }
+
+        Assert.AreEqual(before, Hash(target));
+    }
+
+    [TestMethod]
+    [DataRow("bin")]
+    [DataRow("TempUploads")]
+    [DataRow("..")]
+    public void Install_ReservedFolderName_IsRejected(string name)
+    {
+        var folder = BuildPluginFolder(name, "Tax.Reserved");
+        var zip = ZipEntries(($"{name}/Tax.Reserved.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.Reserved.dll"))));
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+    }
+}
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index 737acfc8aa..0d681cdc5e 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -12,8 +12,6 @@
 using Grand.Web.Common.Localization;
 using Grand.Web.Common.Security.Authorization;
 using Microsoft.AspNetCore.Mvc;
-using System.IO.Compression;
-using System.Reflection;
 
 namespace Grand.Web.Admin.Controllers;
 
@@ -71,18 +69,6 @@ protected void DeleteDirectory(string path)
 
     }
 
-    protected static byte[] ToByteArray(Stream stream)
-    {
-        using (stream)
-        {
-            using (var memStream = new MemoryStream())
-            {
-                stream.CopyTo(memStream);
-                return memStream.ToArray();
-            }
-        }
-    }
-
     #endregion
 
     #region Methods
@@ -284,8 +270,9 @@ public async Task<IActionResult> UploadPlugin(IFormFile zippedFile)
                 zippedFile.CopyTo(fileStream);
             }
 
-            Upload(zipFilePath);
-            await auditEventRecorder.Plugin(zippedFile.FileName, "uploaded");
+            var installer = new PluginArchiveInstaller(PluginsPath, logger);
+            var result = installer.Install(zipFilePath);
+            await auditEventRecorder.Plugin(result.Manifest.SystemName, "uploaded");
 
             var message = translationService.GetResource("Admin.Plugins.Uploaded");
             Success(message);
@@ -324,103 +311,5 @@ private void DeleteTempDirectory(string tempDirectory)
         }
     }
 
-    private void Upload(string archivePath)
-    {
-        var pluginsPath = Path.Combine(webHostEnvironment.ContentRootPath, CommonPath.Plugins);
-        var uploadedItemDirectoryName = "";
-        PluginInfo _pluginInfo = null;
-        using (var archive = ZipFile.Open(archivePath, ZipArchiveMode.Update))
-        {
-            var rootDirectories = archive.Entries.Where(entry =>
-                entry.FullName.Count(ch => ch == '/') == 1 && entry.FullName.EndsWith("/")).ToList();
-            if (rootDirectories.Count != 1)
-                throw new Exception(
-                    "The archive should contain only one root plugin. For example, Payments.StripeCheckout.");
-
-            //get directory name (remove the ending /)
-            uploadedItemDirectoryName = rootDirectories.First().FullName.TrimEnd('/');
-
-            var supportedVersion = false;
-            var _fpath = "";
-            foreach (var entry in archive.Entries.Where(x => x.FullName.Contains(".dll")))
-            {
-                using var unzippedEntryStream = entry.Open();
-                try
-                {
-                    var assembly = Assembly.Load(ToByteArray(unzippedEntryStream));
-                    var pluginInfo = assembly.GetCustomAttribute<PluginInfoAttribute>();
-                    if (pluginInfo != null && pluginInfo.SupportedVersion == GrandVersion.SupportedPluginVersion)
-                    {
-                        supportedVersion = true;
-                        _fpath = entry.FullName[..entry.FullName.LastIndexOf("/", StringComparison.Ordinal)];
-                        archive.Entries.Where(x => !x.FullName.Contains(_fpath)).ToList()
-                            .ForEach(y => { archive.GetEntry(y.FullName)!.Delete(); });
-
-                        _pluginInfo = new PluginInfo();
-                        break;
-                    }
-                }
-                catch (Exception ex)
-                {
-                    logger.LogError(ex, ex.Message);
-                }
-            }
-
-            if (!supportedVersion)
-                throw new Exception(
-                    $"This plugin doesn't support the current version - {GrandVersion.SupportedPluginVersion}");
-
-            var pluginname = _fpath[(_fpath.LastIndexOf('/') + 1)..];
-            var _path = "";
-
-            var entries = archive.Entries.ToArray();
-            foreach (var y in entries)
-            {
-                _path = y.Name.Length > 0
-                    ? y.FullName.Replace(y.Name, "").Replace(_fpath, pluginname).TrimEnd('/')
-                    : y.FullName.Replace(_fpath, pluginname);
-
-                var entry = archive.CreateEntry($"{_path}/{y.Name}");
-                using (var a = y.Open())
-                using (var b = entry.Open())
-                {
-                    a.CopyTo(b);
-                }
-
-                archive.GetEntry(y.FullName).Delete();
-            }
-        }
-
-        if (_pluginInfo == null)
-            throw new Exception("No info file is found.");
-
-        if (string.IsNullOrEmpty(uploadedItemDirectoryName))
-            throw new Exception("Cannot get the plugin directory name");
-
-        var pathToUpload = Path.Combine(pluginsPath, uploadedItemDirectoryName);
-
-        if (!Directory.Exists(pathToUpload))
-        {
-            ZipFile.ExtractToDirectory(archivePath, pluginsPath);
-            return;
-        }
-
-        //move the previous version into the temp upload folder instead of deleting it in place:
-        //a locked assembly fails the move before anything is changed, and a failed extraction puts it back
-        var previousVersionPath = Path.Combine(Path.GetDirectoryName(archivePath)!, Guid.NewGuid().ToString());
-        Directory.Move(pathToUpload, previousVersionPath);
-        try
-        {
-            ZipFile.ExtractToDirectory(archivePath, pluginsPath);
-        }
-        catch
-        {
-            if (Directory.Exists(pathToUpload))
-                DeleteDirectory(pathToUpload);
-            Directory.Move(previousVersionPath, pathToUpload);
-            throw;
-        }
-    }
-
     #endregion
 }
\ No newline at end of file

From b60e0d9de766f234dcf1f0a933c842b298ed8b2e Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Tue, 3 Nov 2026 19:05:48 +0100
Subject: [PATCH 05/30] Bound plugin archive extraction by real size and keep
 the previous plugin when rollback fails

---
 .../Grand.Infrastructure.csproj               |   3 +
 .../Plugins/PluginArchiveInstaller.cs         | 109 ++++++++++++------
 .../Plugins/PluginArchiveInstallerTests.cs    |  53 +++++++++
 3 files changed, 128 insertions(+), 37 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj b/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
index f33293af12..9b99c8a636 100644
--- a/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
+++ b/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
@@ -22,4 +22,7 @@
     <ProjectReference Include="..\Grand.Mapping\Grand.Mapping.csproj" />
     <ProjectReference Include="..\Grand.Mediator\Grand.Mediator.csproj" />
   </ItemGroup>
+  <ItemGroup>
+    <InternalsVisibleTo Include="Grand.Infrastructure.Tests" />
+  </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
index 6869e23e81..8c78325749 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
@@ -15,6 +15,12 @@ public sealed class PluginArchiveInstaller(string pluginsPath, ILogger logger)
     public const int MaxEntries = 5000;
     public const long MaxUncompressedBytes = 200L * 1024 * 1024;
 
+    /// <summary>Limit applied to the real bytes written while extracting; lowered by tests only.</summary>
+    internal long UncompressedBytesLimit { get; init; } = MaxUncompressedBytes;
+
+    /// <summary>Directory move; replaced by tests to simulate failures.</summary>
+    internal Action<string, string> MoveDirectory { get; init; } = Directory.Move;
+
     private const string PluginsFolderName = "Plugins";
     private const string BinFolderName = "bin";
     private const string ExtractedFolderName = "x";
@@ -28,13 +34,13 @@ public sealed class PluginArchiveInstaller(string pluginsPath, ILogger logger)
     public PluginArchiveResult Install(string archivePath)
     {
         var tempRoot = Path.Combine(pluginsPath, CommonPath.TmpUploadPath, Guid.NewGuid().ToString());
+        var keepPrevious = false;
         try
         {
             CheckArchiveSize(archivePath);
 
             var extracted = Path.Combine(tempRoot, ExtractedFolderName);
             Extract(archivePath, extracted);
-            NormalizeBackslashes(extracted);
 
             var (folderName, sourceFolder) = FindPluginFolder(extracted);
             var manifest = ReadSingleManifest(sourceFolder);
@@ -50,13 +56,19 @@ public PluginArchiveResult Install(string archivePath)
             Replace(sourceFolder, Path.Combine(pluginsPath, folderName), Path.Combine(tempRoot, PreviousFolderName));
             return new PluginArchiveResult(folderName, manifest);
         }
+        catch (RollbackFailedException)
+        {
+            keepPrevious = true;
+            throw;
+        }
         finally
         {
-            DeleteTempRoot(tempRoot);
+            //after a failed rollback the previous version is only in the temp folder: leave it there
+            DeleteTempRoot(keepPrevious ? Path.Combine(tempRoot, ExtractedFolderName) : tempRoot);
         }
     }
 
-    private static void CheckArchiveSize(string archivePath)
+    private void CheckArchiveSize(string archivePath)
     {
         try
         {
@@ -68,9 +80,9 @@ private static void CheckArchiveSize(string archivePath)
             foreach (var entry in archive.Entries)
             {
                 total += entry.Length;
-                if (total > MaxUncompressedBytes)
+                if (total > UncompressedBytesLimit)
                     throw new GrandException(
-                        $"The archive is too large when unpacked (the limit is {MaxUncompressedBytes / 1024 / 1024} MB).");
+                        $"The archive is too large when unpacked (the limit is {UncompressedBytesLimit / 1024 / 1024} MB).");
             }
         }
         catch (InvalidDataException)
@@ -79,13 +91,46 @@ private static void CheckArchiveSize(string archivePath)
         }
     }
 
-    private static void Extract(string archivePath, string destination)
+    /// <summary>
+    ///     Extracts entry by entry so the real number of bytes written is bounded, whatever the headers claim,
+    ///     and so every destination is checked against the extraction root. Backslashes in entry names are
+    ///     path separators on every platform.
+    /// </summary>
+    private void Extract(string archivePath, string destination)
     {
         Directory.CreateDirectory(destination);
+        var root = Path.GetFullPath(destination) + Path.DirectorySeparatorChar;
+        long written = 0;
         try
         {
-            //refuses entries that would land outside the destination
-            ZipFile.ExtractToDirectory(archivePath, destination);
+            using var archive = ZipFile.OpenRead(archivePath);
+            foreach (var entry in archive.Entries)
+            {
+                var name = entry.FullName.Replace('\\', '/');
+                var full = Path.GetFullPath(Path.Combine(destination, name));
+                if (!full.StartsWith(root, StringComparison.Ordinal))
+                    throw new GrandException("The archive contains a path outside of the plugin folder.");
+
+                if (name.EndsWith('/'))
+                {
+                    Directory.CreateDirectory(full);
+                    continue;
+                }
+
+                Directory.CreateDirectory(Path.GetDirectoryName(full)!);
+                using var input = entry.Open();
+                using var output = new FileStream(full, FileMode.Create, FileAccess.Write, FileShare.None);
+                var buffer = new byte[81920];
+                int read;
+                while ((read = input.Read(buffer, 0, buffer.Length)) > 0)
+                {
+                    written += read;
+                    if (written > UncompressedBytesLimit)
+                        throw new GrandException(
+                            $"The archive is too large when unpacked (the limit is {UncompressedBytesLimit / 1024 / 1024} MB).");
+                    output.Write(buffer, 0, read);
+                }
+            }
         }
         catch (Exception ex) when (ex is IOException or InvalidDataException or UnauthorizedAccessException)
         {
@@ -93,29 +138,6 @@ private static void Extract(string archivePath, string destination)
         }
     }
 
-    /// <summary>
-    ///     Where '\' is not the directory separator, an entry written with backslashes is extracted as one
-    ///     file with backslashes in its name; move it to the path it stands for.
-    /// </summary>
-    private static void NormalizeBackslashes(string root)
-    {
-        if (Path.DirectorySeparatorChar == '\\')
-            return;
-
-        var rootFull = Path.GetFullPath(root) + Path.DirectorySeparatorChar;
-        foreach (var file in Directory.GetFiles(root, "*", SearchOption.AllDirectories)
-                     .Where(x => Path.GetFileName(x).Contains('\\')).ToList())
-        {
-            var relative = Path.GetRelativePath(root, file).Replace('\\', Path.DirectorySeparatorChar);
-            var destination = Path.GetFullPath(Path.Combine(root, relative));
-            if (!destination.StartsWith(rootFull, StringComparison.Ordinal))
-                throw new GrandException("The archive contains a path outside of the plugin folder.");
-
-            Directory.CreateDirectory(Path.GetDirectoryName(destination)!);
-            File.Move(file, destination, true);
-        }
-    }
-
     /// <summary>
     ///     The plugin folder is the one top-level folder holding the files; an archive that wraps it in a
     ///     <c>Plugins</c> folder is unwrapped first. The folder is derived from the files, not from directory entries.
@@ -241,14 +263,14 @@ private bool IsSystemNameUsedByAnotherFolder(string systemName, string folderNam
     ///     Moves the existing folder aside, moves the new one in, and moves the old one back if that fails.
     ///     A locked file makes the first move fail, before anything has changed.
     /// </summary>
-    private static void Replace(string source, string target, string previous)
+    private void Replace(string source, string target, string previous)
     {
         var hadPrevious = Directory.Exists(target);
         if (hadPrevious)
         {
             try
             {
-                Directory.Move(target, previous);
+                MoveDirectory(target, previous);
             }
             catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
             {
@@ -259,21 +281,34 @@ private static void Replace(string source, string target, string previous)
 
         try
         {
-            Directory.Move(source, target);
+            MoveDirectory(source, target);
         }
         catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
         {
             if (hadPrevious)
             {
-                if (Directory.Exists(target))
-                    Directory.Delete(target, true);
-                Directory.Move(previous, target);
+                try
+                {
+                    if (Directory.Exists(target))
+                        Directory.Delete(target, true);
+                    MoveDirectory(previous, target);
+                }
+                catch (Exception rollback)
+                {
+                    logger.LogError(rollback,
+                        "The plugin could not be installed and the previous version could not be restored; it is kept in {PreviousPath}",
+                        previous);
+                    throw new RollbackFailedException(
+                        $"The plugin could not be installed and the previous version could not be restored. The previous version is preserved at '{previous}'.");
+                }
             }
 
             throw new GrandException("The plugin could not be installed.");
         }
     }
 
+    private sealed class RollbackFailedException(string message) : GrandException(message);
+
     private void DeleteTempRoot(string tempRoot)
     {
         try
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
index 9c35fdfd88..92d415cc41 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
@@ -245,4 +245,57 @@ public void Install_ReservedFolderName_IsRejected(string name)
 
         Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
     }
+
+    [TestMethod]
+    public void Install_RealSizeExceedsLimitDespiteForgedHeader_IsRejected()
+    {
+        var content = System.Security.Cryptography.RandomNumberGenerator.GetBytes(20_000);
+        var zip = ZipEntries(("Tax.Big/big.bin", content));
+        //understate the uncompressed size in the central directory header
+        var bytes = File.ReadAllBytes(zip);
+        var signature = new byte[] { 0x50, 0x4B, 0x01, 0x02 };
+        var at = bytes.AsSpan().LastIndexOf(signature);
+        BitConverter.GetBytes(1).CopyTo(bytes, at + 24);
+        File.WriteAllBytes(zip, bytes);
+        var installer = new PluginArchiveInstaller(_plugins, NullLogger.Instance) { UncompressedBytesLimit = 1000 };
+
+        Assert.ThrowsExactly<GrandException>(() => installer.Install(zip));
+
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.Big")));
+    }
+
+    [TestMethod]
+    public void Install_ZipSlipEntry_IsRejected()
+    {
+        var folder = BuildPluginFolder("Tax.Slip", "Tax.Slip");
+        var zip = ZipEntries(("../x.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.Slip.dll"))));
+
+        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+
+        Assert.IsFalse(File.Exists(Path.Combine(_root, "x.dll")));
+    }
+
+    [TestMethod]
+    public void Install_RollbackFails_KeepsPreviousVersion()
+    {
+        var target = Path.Combine(_plugins, "Tax.FixedRate");
+        Directory.CreateDirectory(target);
+        File.WriteAllText(Path.Combine(target, "old.txt"), "old");
+        var zip = ZipFolder(BuildPluginFolder("Tax.FixedRate", "Tax.FixedRate"));
+        var calls = 0;
+        var installer = new PluginArchiveInstaller(_plugins, NullLogger.Instance) {
+            MoveDirectory = (from, to) => {
+                //the move aside succeeds; moving the new folder in and the rollback both fail
+                if (calls++ == 0) Directory.Move(from, to);
+                else throw new IOException("simulated");
+            }
+        };
+
+        var ex = Assert.Throws<GrandException>(() => installer.Install(zip));
+
+        StringAssert.Contains(ex.Message, "preserved");
+        var kept = Directory.GetFiles(_plugins, "old.txt", SearchOption.AllDirectories);
+        Assert.AreEqual(1, kept.Length);
+        Assert.AreEqual("old", File.ReadAllText(kept[0]));
+    }
 }

From d4132a4da88d9fe4015f89bb6bcf8b039dcb7245 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Tue, 3 Nov 2026 19:21:27 +0100
Subject: [PATCH 06/30] Let the upload controller delete only its own archive
 and prove the zip-slip check

---
 .../Plugins/PluginArchiveInstaller.cs         | 23 +++++++++++-
 .../Plugins/PluginArchiveInstallerTests.cs    | 35 ++++++++++++++++---
 .../Controllers/PluginController.cs           | 18 ++--------
 3 files changed, 55 insertions(+), 21 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
index 8c78325749..cba1b32091 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
@@ -21,6 +21,8 @@ public sealed class PluginArchiveInstaller(string pluginsPath, ILogger logger)
     /// <summary>Directory move; replaced by tests to simulate failures.</summary>
     internal Action<string, string> MoveDirectory { get; init; } = Directory.Move;
 
+    internal const string PathOutsideMessage = "The archive contains a path outside of the plugin folder.";
+
     private const string PluginsFolderName = "Plugins";
     private const string BinFolderName = "bin";
     private const string ExtractedFolderName = "x";
@@ -68,6 +70,25 @@ public PluginArchiveResult Install(string archivePath)
         }
     }
 
+    /// <summary>
+    ///     Deletes the uploaded archive file only. Per-install temporary folders belong to <see cref="Install" />,
+    ///     which keeps the previous plugin version in one of them when a rollback fails.
+    ///     A failure is logged, not thrown.
+    /// </summary>
+    public static void DeleteArchive(string archivePath, ILogger logger)
+    {
+        if (string.IsNullOrEmpty(archivePath))
+            return;
+        try
+        {
+            File.Delete(archivePath);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            logger.LogWarning(ex, "The uploaded plugin archive {ArchivePath} could not be deleted", archivePath);
+        }
+    }
+
     private void CheckArchiveSize(string archivePath)
     {
         try
@@ -109,7 +130,7 @@ private void Extract(string archivePath, string destination)
                 var name = entry.FullName.Replace('\\', '/');
                 var full = Path.GetFullPath(Path.Combine(destination, name));
                 if (!full.StartsWith(root, StringComparison.Ordinal))
-                    throw new GrandException("The archive contains a path outside of the plugin folder.");
+                    throw new GrandException(PathOutsideMessage);
 
                 if (name.EndsWith('/'))
                 {
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
index 92d415cc41..acf043f1e3 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
@@ -265,14 +265,41 @@ public void Install_RealSizeExceedsLimitDespiteForgedHeader_IsRejected()
     }
 
     [TestMethod]
-    public void Install_ZipSlipEntry_IsRejected()
+    [DataRow("../x.dll")]
+    [DataRow("../../x.dll")]
+    [DataRow("..\\..\\x.dll")]
+    public void Install_ZipSlipEntry_IsRejected(string entryName)
     {
-        var folder = BuildPluginFolder("Tax.Slip", "Tax.Slip");
-        var zip = ZipEntries(("../x.dll", File.ReadAllBytes(Path.Combine(folder, "Tax.Slip.dll"))));
+        var existing = Path.Combine(_plugins, "Tax.Existing");
+        Directory.CreateDirectory(existing);
+        File.WriteAllText(Path.Combine(existing, "keep.txt"), "keep");
+        var before = Hash(_plugins);
+        var zip = ZipEntries((entryName, [1, 2, 3]));
 
-        Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
+        var ex = Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(zip));
 
+        Assert.AreEqual(PluginArchiveInstaller.PathOutsideMessage, ex.Message);
+        Assert.AreEqual(before, Hash(_plugins));
         Assert.IsFalse(File.Exists(Path.Combine(_root, "x.dll")));
+        Assert.IsFalse(File.Exists(Path.Combine(_plugins, "x.dll")));
+        var temp = Path.Combine(_plugins, "TempUploads");
+        Assert.IsTrue(!Directory.Exists(temp) || !Directory.EnumerateFileSystemEntries(temp).Any());
+    }
+
+    [TestMethod]
+    public void DeleteArchive_RemovesOnlyTheArchive()
+    {
+        var temp = Path.Combine(_plugins, "TempUploads");
+        var other = Path.Combine(temp, Guid.NewGuid().ToString(), "previous");
+        Directory.CreateDirectory(other);
+        File.WriteAllText(Path.Combine(other, "old.txt"), "old");
+        var archive = Path.Combine(temp, Guid.NewGuid() + ".zip");
+        File.WriteAllText(archive, "zip");
+
+        PluginArchiveInstaller.DeleteArchive(archive, NullLogger.Instance);
+
+        Assert.IsFalse(File.Exists(archive));
+        Assert.AreEqual(1, Directory.GetFiles(temp, "old.txt", SearchOption.AllDirectories).Length);
     }
 
     [TestMethod]
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index 0d681cdc5e..0bac4c4066 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -284,8 +284,8 @@ public async Task<IActionResult> UploadPlugin(IFormFile zippedFile)
         }
         finally
         {
-            // Delete temporary file
-            DeleteTempDirectory(tempDirectory);
+            //only the uploaded file is ours; the installer owns (and may keep) its per-install folders
+            PluginArchiveInstaller.DeleteArchive(zipFilePath, logger);
         }
 
         logger.LogInformation("The plugin has been uploaded by the user {CurrentCustomerEmail}",
@@ -297,19 +297,5 @@ public async Task<IActionResult> UploadPlugin(IFormFile zippedFile)
         return RedirectToAction("List");
     }
 
-    private void DeleteTempDirectory(string tempDirectory)
-    {
-        try
-        {
-            DeleteDirectory(tempDirectory);
-        }
-        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
-        {
-            //the previous plugin version moved here can hold an assembly this process has loaded;
-            //it is not loaded from here on the next start and the next upload removes it
-            logger.LogWarning(ex, "The temporary upload folder {TempDirectory} could not be deleted", tempDirectory);
-        }
-    }
-
     #endregion
 }
\ No newline at end of file

From ad8dd7f1c9e3f28f91732eb602f2c85f1d0654c2 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Tue, 3 Nov 2026 19:25:15 +0100
Subject: [PATCH 07/30] Write the installed-plugins file atomically and keep
 plugin activation errors

---
 .../Plugins/PluginExtensions.cs               | 98 +++++++++++--------
 .../Plugins/PluginInfo.cs                     |  7 +-
 .../Plugins/PluginExtensionsTests.cs          | 41 ++++++++
 .../Plugins/PluginInfoTests.cs                | 43 ++++++++
 4 files changed, 148 insertions(+), 41 deletions(-)
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs b/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
index 7e5e723d32..245d208cb0 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
@@ -1,3 +1,4 @@
+using Grand.SharedKernel;
 using System.Reflection;
 using System.Text.Json;
 
@@ -57,71 +58,90 @@ public static bool OnlyInstalledPlugins(Assembly assembly)
         return owners is not { Count: > 0 } || owners.Any(x => x.IsActive);
     }
 
+    private static readonly SemaphoreSlim InstalledPluginsFileLock = new(1, 1);
+
+    /// <summary>
+    ///     Reads the list of installed plugin system names. A file that is not valid throws instead of
+    ///     yielding an empty list, because an empty list would silently deactivate every plugin.
+    /// </summary>
     public static IList<string> ParseInstalledPluginsFile(string filePath)
     {
         if (!File.Exists(filePath))
             return new List<string>();
 
         var text = File.ReadAllText(filePath);
-        return string.IsNullOrEmpty(text) ? new List<string>() : JsonSerializer.Deserialize<List<string>>(text);
+        if (string.IsNullOrWhiteSpace(text))
+            return new List<string>();
+
+        try
+        {
+            return JsonSerializer.Deserialize<List<string>>(text) ?? new List<string>();
+        }
+        catch (JsonException e)
+        {
+            throw new GrandException($"{filePath} is not a valid installed-plugins file: {e.Message}", e);
+        }
     }
+
     private static async Task SaveInstalledPluginsFile(IList<string> pluginSystemNames, string filePath)
     {
-        //serialize
         var result = JsonSerializer.Serialize(pluginSystemNames, new JsonSerializerOptions { WriteIndented = true });
-        //save
-        await File.WriteAllTextAsync(filePath, result);
-        await Task.CompletedTask;
+
+        var directory = Path.GetDirectoryName(filePath);
+        if (!string.IsNullOrEmpty(directory))
+            Directory.CreateDirectory(directory);
+
+        //write beside the target and move over it, so a crash never leaves a half-written list
+        var tempPath = filePath + ".tmp";
+        await File.WriteAllTextAsync(tempPath, result);
+        File.Move(tempPath, filePath, true);
+    }
+
+    private static async Task UpdateInstalledPluginsFile(Action<IList<string>> update)
+    {
+        var filePath = PluginPaths.Instance.InstalledPluginsFile;
+
+        await InstalledPluginsFileLock.WaitAsync();
+        try
+        {
+            var installedPluginSystemNames = ParseInstalledPluginsFile(filePath);
+            update(installedPluginSystemNames);
+            await SaveInstalledPluginsFile(installedPluginSystemNames, filePath);
+        }
+        finally
+        {
+            InstalledPluginsFileLock.Release();
+        }
     }
 
     /// <summary>
     ///     Mark plugin as installed
     /// </summary>
     /// <param name="systemName">Plugin system name</param>
-    public static async Task MarkPluginAsInstalled(string systemName)
+    public static Task MarkPluginAsInstalled(string systemName)
     {
         ArgumentNullException.ThrowIfNullOrEmpty(systemName);
 
-        var filePath = PluginPaths.Instance.InstalledPluginsFile;
-        if (!File.Exists(filePath))
-            await using (File.Create(filePath))
-            {
-                //we use 'using' to close the file after it's created
-            }
-
-        var installedPluginSystemNames = ParseInstalledPluginsFile(filePath);
-
-        var alreadyMarkedAsInstalled =
-            installedPluginSystemNames.FirstOrDefault(x => x.Equals(systemName, StringComparison.OrdinalIgnoreCase)) !=
-            null;
-        if (!alreadyMarkedAsInstalled)
-            installedPluginSystemNames.Add(systemName);
-
-        await SaveInstalledPluginsFile(installedPluginSystemNames, filePath);
+        return UpdateInstalledPluginsFile(names =>
+        {
+            if (!names.Any(x => x.Equals(systemName, StringComparison.OrdinalIgnoreCase)))
+                names.Add(systemName);
+        });
     }
 
     /// <summary>
     ///     Mark plugin as uninstalled
     /// </summary>
     /// <param name="systemName">Plugin system name</param>
-    public static async Task MarkPluginAsUninstalled(string systemName)
+    public static Task MarkPluginAsUninstalled(string systemName)
     {
         ArgumentNullException.ThrowIfNullOrEmpty(systemName);
 
-        var filePath = PluginPaths.Instance.InstalledPluginsFile;
-        if (!File.Exists(filePath))
-            await using (File.Create(filePath))
-            {
-                //we use 'using' to close the file after it's created
-            }
-
-        var installedPluginSystemNames = ParseInstalledPluginsFile(filePath);
-        var alreadyMarkedAsInstalled =
-            installedPluginSystemNames.FirstOrDefault(x => x.Equals(systemName, StringComparison.OrdinalIgnoreCase)) !=
-            null;
-        if (alreadyMarkedAsInstalled)
-            installedPluginSystemNames.Remove(systemName);
-
-        await SaveInstalledPluginsFile(installedPluginSystemNames, filePath);
+        return UpdateInstalledPluginsFile(names =>
+        {
+            for (var i = names.Count - 1; i >= 0; i--)
+                if (names[i].Equals(systemName, StringComparison.OrdinalIgnoreCase))
+                    names.RemoveAt(i);
+        });
     }
-}
\ No newline at end of file
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
index f835088e0d..a3bc634790 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
@@ -103,15 +103,18 @@ public PluginInfo()
 
     public T Instance<T>(IServiceProvider serviceProvider) where T : class, IPlugin
     {
+        if (PluginType == null)
+            throw new GrandException($"Plugin {SystemName} has no IPlugin class");
+
         object instance;
         try
         {
             instance = serviceProvider.GetRequiredService(PluginType);
         }
-        catch
+        catch (Exception e)
         {
             throw new GrandException(
-                $"Plugin has not been registered getRequiredService - dependency - {PluginType.FullName}");
+                $"Plugin {SystemName} ({PluginType.FullName}) could not be created: {e.Message}", e);
         }
 
         var typedInstance = instance as T;
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
index b43f9eb9b0..2876132c50 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
@@ -49,6 +49,47 @@ public async Task MarkPluginAsUninstalled()
         Assert.HasCount(1, plugins);
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task MarkPluginAsUninstalled_DifferentCase_Removes()
+    {
+        await PluginExtensions.MarkPluginAsInstalled("Plugin1");
+        await PluginExtensions.MarkPluginAsUninstalled("plugin1");
+        var plugins = PluginExtensions.ParseInstalledPluginsFile(PluginPaths.Instance.InstalledPluginsFile);
+        Assert.IsEmpty(plugins);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task MarkPluginAsInstalled_Concurrent_KeepsBoth()
+    {
+        var names = Enumerable.Range(0, 20).Select(i => $"plugin{i}").ToList();
+        await Task.WhenAll(names.Select(n => Task.Run(() => PluginExtensions.MarkPluginAsInstalled(n))));
+        var plugins = PluginExtensions.ParseInstalledPluginsFile(PluginPaths.Instance.InstalledPluginsFile);
+        Assert.HasCount(20, plugins);
+        CollectionAssert.AreEquivalent(names, plugins.ToList());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void ParseInstalledPluginsFile_InvalidJson_ThrowsWithPath()
+    {
+        var path = PluginPaths.Instance.InstalledPluginsFile;
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+        File.WriteAllText(path, "{ not json");
+        try
+        {
+            var ex = Assert.Throws<Grand.SharedKernel.GrandException>(() =>
+                PluginExtensions.ParseInstalledPluginsFile(path));
+            StringAssert.Contains(ex.Message, path);
+            StringAssert.Contains(ex.Message, "is not a valid installed-plugins file");
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
     [TestMethod]
     [DoNotParallelize]
     public void OnlyInstalledPlugins_Assembly_NotAPlugin_ReturnsTrue()
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs
new file mode 100644
index 0000000000..af7fd0b8dc
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs
@@ -0,0 +1,43 @@
+using Grand.Infrastructure.Plugins;
+using Grand.SharedKernel;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginInfoTests
+{
+    public interface IMissingDependency;
+
+    public class NeedyPlugin(IMissingDependency dependency) : BasePlugin
+    {
+        public IMissingDependency Dependency { get; } = dependency;
+    }
+
+    [TestMethod]
+    public void Instance_DependencyMissing_KeepsInnerException()
+    {
+        var services = new ServiceCollection();
+        services.AddTransient<NeedyPlugin>();
+        using var provider = services.BuildServiceProvider();
+        var info = new PluginInfo { SystemName = "Needy", PluginType = typeof(NeedyPlugin) };
+
+        var ex = Assert.Throws<GrandException>(() => info.Instance(provider));
+
+        Assert.IsNotNull(ex.InnerException);
+        Assert.IsInstanceOfType<InvalidOperationException>(ex.InnerException);
+        StringAssert.Contains(ex.Message, "Needy");
+    }
+
+    [TestMethod]
+    public void Instance_NoPluginType_ThrowsGrandException()
+    {
+        using var provider = new ServiceCollection().BuildServiceProvider();
+        var info = new PluginInfo { SystemName = "Empty" };
+
+        var ex = Assert.Throws<GrandException>(() => info.Instance(provider));
+
+        Assert.AreEqual("Plugin Empty has no IPlugin class", ex.Message);
+    }
+}

From e1aa75e3cb6890ee47a82d508780b88563121309 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Tue, 3 Nov 2026 19:55:44 +0100
Subject: [PATCH 08/30] Make the plugin list reload a POST action and guard
 plugin removal

---
 .../Plugins/PluginFolderScanner.cs            |  15 +-
 .../Plugins/PluginLoadSnapshot.cs             | 213 ++++++++++++++++++
 .../Plugins/PluginManager.cs                  |  18 ++
 .../Plugins/PluginPendingChange.cs            |  20 ++
 .../Plugins/PluginPendingChangesTests.cs      | 159 +++++++++++++
 .../PluginRestartNoticeViewComponentTests.cs  |  36 +++
 .../Controllers/PluginControllerTests.cs      | 183 +++++++++++++++
 .../Areas/Admin/Views/Plugin/List.cshtml      |  19 +-
 .../PluginRestartNotice/Default.cshtml        |  24 ++
 .../Admin/Views/Shared/_AdminLayout.cshtml    |  21 ++
 .../PluginRestartNoticeViewComponent.cs       |  33 +++
 .../Controllers/PluginController.cs           |  67 ++++--
 .../App_Data/Resources/DefaultLanguage.xml    | Bin 1649066 -> 1652414 bytes
 .../App_Data/Resources/Upgrade/en_250.xml     |  42 ++++
 14 files changed, 818 insertions(+), 32 deletions(-)
 create mode 100644 src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs
 create mode 100644 src/Core/Grand.Infrastructure/Plugins/PluginPendingChange.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs
 create mode 100644 src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs
 create mode 100644 src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
 create mode 100644 src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml
 create mode 100644 src/Web/Grand.Web.Admin/Components/PluginRestartNoticeViewComponent.cs

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
index 22eaace1ad..4a83a0c1bc 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
@@ -67,7 +67,7 @@ public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPatt
         try
         {
             folders = pluginsFolder.GetDirectories()
-                .Where(x => !IgnoredFolders.Contains(x.Name, StringComparer.OrdinalIgnoreCase))
+                .Where(x => !IsIgnoredFolder(x.Name))
                 .OrderBy(x => x.Name, StringComparer.Ordinal)
                 .ToArray();
         }
@@ -142,7 +142,7 @@ private static List<ScannedFile> ScanFolder(DirectoryInfo folder, string skipPat
         var result = new List<ScannedFile>();
         foreach (var file in dlls.OrderBy(x => x.Name, StringComparer.Ordinal))
         {
-            if (!string.IsNullOrEmpty(skipPattern) && Matches(file.Name, skipPattern))
+            if (IsSkipped(file.Name, skipPattern))
                 continue;
 
             try
@@ -189,9 +189,18 @@ private static ScannedFile ScanFile(DirectoryInfo folder, FileInfo file, ISet<st
             ParseFileVersion(file.FullName), PluginManifestReader.Read(file.FullName));
     }
 
-    private static bool IsReadFailure(Exception ex) =>
+    /// <summary>
+    ///     The shadow copy and upload folders inside Plugins, which are never plugin folders
+    /// </summary>
+    internal static bool IsIgnoredFolder(string name) =>
+        IgnoredFolders.Contains(name, StringComparer.OrdinalIgnoreCase);
+
+    internal static bool IsReadFailure(Exception ex) =>
         ex is IOException or UnauthorizedAccessException or BadImageFormatException;
 
+    internal static bool IsSkipped(string fileName, string skipPattern) =>
+        !string.IsNullOrEmpty(skipPattern) && Matches(fileName, skipPattern);
+
     /// <summary>
     ///     When two plugins ship the same dependency only the higher version is loaded, so one load
     ///     context never sees two copies of it. A plugin's own main assembly is never dropped. A plugin
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs
new file mode 100644
index 0000000000..ee85def7db
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs
@@ -0,0 +1,213 @@
+using Grand.SharedKernel;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     The plugin state this process loaded, kept to tell which changes on disk wait for a restart. Comparing
+///     runs on every admin page view, so it reads file attributes, the installed-plugins file once, and the
+///     manifests of folders that did not exist at load time - never an assembly into the process.
+/// </summary>
+internal sealed class PluginLoadSnapshot
+{
+    /// <summary>
+    ///     A plugin folder as it was loaded. A folder that could not be loaded has no main assembly; its
+    ///     plugin assemblies as a whole are compared instead.
+    /// </summary>
+    private sealed record LoadedFolder(string SystemName, string MainAssemblyPath, FileStamp Stamp);
+
+    private sealed record FileStamp(long Length, DateTime LastWriteTimeUtc, int Count);
+
+    private readonly string _pluginsFolder;
+    private readonly string _installedPluginsFile;
+    private readonly string _skipPattern;
+    private readonly HashSet<string> _installed;
+    private readonly HashSet<string> _knownFolders;
+    private readonly Dictionary<string, LoadedFolder> _plugins;
+
+    private PluginLoadSnapshot(string pluginsFolder, string installedPluginsFile, string skipPattern,
+        HashSet<string> installed, HashSet<string> knownFolders, Dictionary<string, LoadedFolder> plugins)
+    {
+        _pluginsFolder = pluginsFolder;
+        _installedPluginsFile = installedPluginsFile;
+        _skipPattern = skipPattern;
+        _installed = installed;
+        _knownFolders = knownFolders;
+        _plugins = plugins;
+    }
+
+    /// <summary>
+    ///     Records what a load saw
+    /// </summary>
+    /// <param name="installedPluginsFile">
+    ///     The file the installed list was read from; null when it came from configuration, which a running
+    ///     process cannot change
+    /// </param>
+    internal static PluginLoadSnapshot Capture(DirectoryInfo pluginsFolder, PluginScanResult scan,
+        IEnumerable<string> installedSystemNames, string installedPluginsFile, string skipPattern)
+    {
+        var plugins = new Dictionary<string, LoadedFolder>(StringComparer.OrdinalIgnoreCase);
+        foreach (var candidate in scan.Plugins)
+            plugins[candidate.Folder.Name] = new LoadedFolder(candidate.Manifest.SystemName,
+                candidate.MainAssemblyPath, StampOf(candidate.MainAssemblyPath));
+
+        var knownFolders = (Folders(pluginsFolder.FullName) ?? []).ToHashSet(StringComparer.OrdinalIgnoreCase);
+        //a problem names its folder, or the Plugins folder itself when that could not be listed
+        foreach (var problem in scan.Problems.Where(x =>
+                     knownFolders.Contains(x.Folder) && !plugins.ContainsKey(x.Folder)))
+            plugins[problem.Folder] = new LoadedFolder(problem.SystemNames.FirstOrDefault() ?? problem.Folder, null,
+                StampOfAssemblies(Path.Combine(pluginsFolder.FullName, problem.Folder)));
+
+        return new PluginLoadSnapshot(pluginsFolder.FullName, installedPluginsFile, skipPattern,
+            installedSystemNames.ToHashSet(StringComparer.OrdinalIgnoreCase), knownFolders, plugins);
+    }
+
+    /// <summary>
+    ///     What differs now from the load. Never throws because of one unreadable file or folder: what
+    ///     cannot be read is not reported.
+    /// </summary>
+    internal IReadOnlyList<PluginPendingChange> Compare()
+    {
+        var changes = new List<PluginPendingChange>();
+        CompareInstalled(changes);
+        CompareFolders(changes);
+        return changes;
+    }
+
+    private void CompareInstalled(List<PluginPendingChange> changes)
+    {
+        if (_installedPluginsFile == null)
+            return;
+
+        HashSet<string> installed;
+        try
+        {
+            installed = PluginExtensions.ParseInstalledPluginsFile(_installedPluginsFile)
+                .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        }
+        catch (Exception ex) when (ex is GrandException || PluginFolderScanner.IsReadFailure(ex))
+        {
+            return;
+        }
+
+        changes.AddRange(installed.Where(x => !_installed.Contains(x)).Order(StringComparer.OrdinalIgnoreCase)
+            .Select(x => new PluginPendingChange(x, FolderOf(x), PluginPendingChangeKind.Installed)));
+        changes.AddRange(_installed.Where(x => !installed.Contains(x)).Order(StringComparer.OrdinalIgnoreCase)
+            .Select(x => new PluginPendingChange(x, FolderOf(x), PluginPendingChangeKind.Uninstalled)));
+    }
+
+    private void CompareFolders(List<PluginPendingChange> changes)
+    {
+        //a Plugins folder that cannot be listed now is not reported as every plugin removed
+        var folders = Folders(_pluginsFolder)?.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        if (folders == null)
+            return;
+
+        foreach (var (folder, loaded) in _plugins.OrderBy(x => x.Key, StringComparer.Ordinal))
+        {
+            if (!folders.Contains(folder))
+                changes.Add(new PluginPendingChange(loaded.SystemName, folder, PluginPendingChangeKind.Removed));
+            else if (loaded.Stamp != CurrentStamp(folder, loaded))
+                changes.Add(new PluginPendingChange(loaded.SystemName, folder, PluginPendingChangeKind.Updated));
+        }
+
+        foreach (var folder in folders.Where(x => !_knownFolders.Contains(x)).Order(StringComparer.Ordinal))
+        {
+            var manifest = ReadManifest(Path.Combine(_pluginsFolder, folder));
+            if (manifest != null)
+                changes.Add(new PluginPendingChange(
+                    string.IsNullOrWhiteSpace(manifest.SystemName) ? folder : manifest.SystemName, folder,
+                    PluginPendingChangeKind.Added));
+        }
+    }
+
+    private FileStamp CurrentStamp(string folder, LoadedFolder loaded)
+    {
+        return loaded.MainAssemblyPath != null
+            ? StampOf(loaded.MainAssemblyPath)
+            : StampOfAssemblies(Path.Combine(_pluginsFolder, folder));
+    }
+
+    private string FolderOf(string systemName)
+    {
+        return _plugins.FirstOrDefault(x => string.Equals(x.Value.SystemName, systemName,
+            StringComparison.OrdinalIgnoreCase)).Key;
+    }
+
+    /// <summary>
+    ///     The first plugin manifest among the folder's top-level assemblies, read from metadata
+    /// </summary>
+    private PluginManifest ReadManifest(string folder)
+    {
+        foreach (var file in Files(folder))
+        {
+            try
+            {
+                if (PluginFolderScanner.IsSkipped(file.Name, _skipPattern))
+                    continue;
+
+                var manifest = PluginManifestReader.Read(file.FullName);
+                if (manifest != null)
+                    return manifest;
+            }
+            catch (Exception)
+            {
+                //any file dropped into Plugins can land here, and an admin page must still render; a file
+                //still being written is read again on the next page view, a broken one fails at the restart
+            }
+        }
+
+        return null;
+    }
+
+    private static FileStamp StampOf(string path)
+    {
+        try
+        {
+            var file = new FileInfo(path);
+            return file.Exists ? new FileStamp(file.Length, file.LastWriteTimeUtc, 1) : null;
+        }
+        catch (Exception ex) when (PluginFolderScanner.IsReadFailure(ex))
+        {
+            return null;
+        }
+    }
+
+    private static FileStamp StampOfAssemblies(string folder)
+    {
+        var files = Files(folder);
+        return new FileStamp(files.Sum(x => x.Length),
+            files.Count == 0 ? DateTime.MinValue : files.Max(x => x.LastWriteTimeUtc), files.Count);
+    }
+
+    private static List<FileInfo> Files(string folder)
+    {
+        try
+        {
+            return new DirectoryInfo(folder).GetFiles("*.dll", SearchOption.TopDirectoryOnly)
+                .OrderBy(x => x.Name, StringComparer.Ordinal)
+                .ToList();
+        }
+        catch (Exception ex) when (PluginFolderScanner.IsReadFailure(ex))
+        {
+            return [];
+        }
+    }
+
+    /// <summary>
+    ///     The plugin folder names; null when the Plugins folder cannot be listed
+    /// </summary>
+    private static List<string> Folders(string pluginsFolder)
+    {
+        try
+        {
+            return new DirectoryInfo(pluginsFolder).GetDirectories()
+                .Select(x => x.Name)
+                .Where(x => !PluginFolderScanner.IsIgnoredFolder(x))
+                .ToList();
+        }
+        catch (Exception ex) when (PluginFolderScanner.IsReadFailure(ex))
+        {
+            return null;
+        }
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index bb21bccc15..fe166929aa 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -42,6 +42,19 @@ public static class PluginManager
     /// </summary>
     public static IEnumerable<PluginInfo> ReferencedPlugins { get; set; }
 
+    /// <summary>
+    ///     What <see cref="Load" /> saw on disk; null until plugins are loaded
+    /// </summary>
+    internal static PluginLoadSnapshot LoadSnapshot { get; set; }
+
+    /// <summary>
+    ///     Plugin changes made on disk since this process loaded its plugins; they take effect after a restart.
+    ///     Reads the installed-plugins file and the plugin folders' metadata, never loads an assembly.
+    /// </summary>
+    public static IReadOnlyList<PluginPendingChange> GetPendingChanges()
+    {
+        return LoadSnapshot?.Compare() ?? [];
+    }
 
     /// <summary>
     ///     Load plugins
@@ -96,6 +109,11 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
             foreach (var warning in scan.Warnings)
                 _logger.LogWarning("{PluginWarning}", warning);
 
+            //before anything is loaded or shadow copied: the plugin folders as found
+            LoadSnapshot = PluginLoadSnapshot.Capture(_pluginFolder, scan, installedPluginSystemNames,
+                string.IsNullOrEmpty(_config.InstalledPlugins) ? PluginPaths.Instance.InstalledPluginsFile : null,
+                _config.PluginSkipLoadingPattern);
+
             var referencedPlugins = new List<PluginInfo>();
 
             //a dependency can be asked for twice (resolved for one plugin, then loaded by the one shipping it);
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginPendingChange.cs b/src/Core/Grand.Infrastructure/Plugins/PluginPendingChange.cs
new file mode 100644
index 0000000000..64807d64e5
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginPendingChange.cs
@@ -0,0 +1,20 @@
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     What changed on disk since this process loaded its plugins
+/// </summary>
+public enum PluginPendingChangeKind
+{
+    Installed,
+    Uninstalled,
+    Added,
+    Removed,
+    Updated
+}
+
+/// <summary>
+///     A plugin change that takes effect after the application restarts
+/// </summary>
+/// <param name="SystemName">The plugin's system name; the folder name when the system name is not known</param>
+/// <param name="FolderName">The plugin folder; null when the plugin has no folder this process knows</param>
+public sealed record PluginPendingChange(string SystemName, string FolderName, PluginPendingChangeKind Kind);
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs
new file mode 100644
index 0000000000..7e23e80043
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs
@@ -0,0 +1,159 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using System.Text.Json;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+public class PluginPendingChangesTests
+{
+    private PluginFolderFixture _fixture;
+    private string _installedFile;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+        _installedFile = Path.Combine(Path.GetDirectoryName(_fixture.PluginsFolder)!, "App_Data",
+            "InstalledPlugins.cfg");
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_NothingChanged_IsEmpty()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        _fixture.AddPlugin("B", "Pending.B", "Pending.B");
+        WriteInstalled("Pending.A");
+
+        var changes = PendingAfter(() => { });
+
+        Assert.IsEmpty(changes);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_MarkedInstalledAfterLoad_ReportsInstalled()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled();
+
+        var changes = PendingAfter(() => WriteInstalled("Pending.A"));
+
+        Assert.AreEqual(new PluginPendingChange("Pending.A", "A", PluginPendingChangeKind.Installed),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_MarkedUninstalledAfterLoad_ReportsUninstalled()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled("Pending.A");
+
+        var changes = PendingAfter(() => WriteInstalled());
+
+        Assert.AreEqual(new PluginPendingChange("Pending.A", "A", PluginPendingChangeKind.Uninstalled),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_NewPluginFolder_ReportsAdded()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled();
+
+        var changes = PendingAfter(() =>
+        {
+            _fixture.AddPlugin("B", "Pending.B", "Pending.B");
+            //a folder without a plugin assembly is not a plugin
+            Directory.CreateDirectory(_fixture.Folder("NotAPlugin"));
+        });
+
+        Assert.AreEqual(new PluginPendingChange("Pending.B", "B", PluginPendingChangeKind.Added), changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_NewFolderWithoutPluginAssembly_IsNotReported()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled();
+
+        var changes = PendingAfter(() =>
+        {
+            Directory.CreateDirectory(_fixture.Folder("Native"));
+            File.WriteAllBytes(Path.Combine(_fixture.Folder("Native"), "native.dll"), [0x4D, 0x5A, 1, 2, 3]);
+            TestPluginBuilder.Compile(_fixture.Folder("Library"), "Pending.Library", "public class Library { }");
+        });
+
+        Assert.IsEmpty(changes);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_LoadedFolderDeleted_ReportsRemoved()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        _fixture.AddPlugin("B", "Pending.B", "Pending.B");
+        WriteInstalled();
+
+        var changes = PendingAfter(() => Directory.Delete(_fixture.Folder("B"), true));
+
+        Assert.AreEqual(new PluginPendingChange("Pending.B", "B", PluginPendingChangeKind.Removed),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_MainDllReplaced_ReportsUpdated()
+    {
+        var main = _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        WriteInstalled("Pending.A");
+        var loadedLength = new FileInfo(main).Length;
+
+        var changes = PendingAfter(() =>
+        {
+            _fixture.AddPlugin("A", "Pending.A", "Pending.A", "public class AddedInTheNewVersion { }");
+            Assert.AreNotEqual(loadedLength, new FileInfo(main).Length);
+        });
+
+        Assert.AreEqual(new PluginPendingChange("Pending.A", "A", PluginPendingChangeKind.Updated),
+            changes.Single());
+    }
+
+    /// <summary>
+    ///     Records the state as <see cref="PluginManager.Load" /> does, applies the change and compares
+    /// </summary>
+    private IReadOnlyList<PluginPendingChange> PendingAfter(Action change)
+    {
+        var loadSnapshot = PluginManager.LoadSnapshot;
+        try
+        {
+            PluginManager.LoadSnapshot = PluginLoadSnapshot.Capture(new DirectoryInfo(_fixture.PluginsFolder),
+                _fixture.Scan(), PluginExtensions.ParseInstalledPluginsFile(_installedFile), _installedFile, null);
+
+            change();
+
+            return PluginManager.GetPendingChanges();
+        }
+        finally
+        {
+            PluginManager.LoadSnapshot = loadSnapshot;
+        }
+    }
+
+    private void WriteInstalled(params string[] systemNames)
+    {
+        Directory.CreateDirectory(Path.GetDirectoryName(_installedFile)!);
+        File.WriteAllText(_installedFile, JsonSerializer.Serialize(systemNames));
+    }
+}
diff --git a/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs b/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs
new file mode 100644
index 0000000000..2a93ed10e3
--- /dev/null
+++ b/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs
@@ -0,0 +1,36 @@
+using Grand.Domain.Permissions;
+using Grand.Web.Admin.Components;
+using Grand.Web.Common.Security.Authorization;
+using Microsoft.AspNetCore.Mvc.ViewComponents;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Web.Admin.Tests.Components;
+
+[TestClass]
+public class PluginRestartNoticeViewComponentTests
+{
+    [TestMethod]
+    public async Task InvokeAsync_WithoutPluginsPermission_RendersNothing()
+    {
+        var permissionService = new Mock<IRequestPermissionService>();
+        permissionService.Setup(x => x.Authorize(StandardPermission.ManagePlugins)).ReturnsAsync(false);
+
+        var result = await new PluginRestartNoticeViewComponent(permissionService.Object).InvokeAsync();
+
+        Assert.IsInstanceOfType(result, typeof(ContentViewComponentResult));
+    }
+
+    [TestMethod]
+    public async Task InvokeAsync_NoPendingChanges_RendersNothing()
+    {
+        //plugins are never loaded in this test process, so nothing is pending
+        var permissionService = new Mock<IRequestPermissionService>();
+        permissionService.Setup(x => x.Authorize(StandardPermission.ManagePlugins)).ReturnsAsync(true);
+
+        var result = await new PluginRestartNoticeViewComponent(permissionService.Object).InvokeAsync();
+
+        Assert.IsInstanceOfType(result, typeof(ContentViewComponentResult));
+        permissionService.Verify(x => x.Authorize(StandardPermission.ManagePlugins), Times.Once);
+    }
+}
diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
new file mode 100644
index 0000000000..bdd31072ff
--- /dev/null
+++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
@@ -0,0 +1,183 @@
+using Grand.Domain.Customers;
+using Grand.Infrastructure;
+using Grand.Infrastructure.Configuration;
+using Grand.Infrastructure.Plugins;
+using Grand.Web.Admin.Controllers;
+using Grand.Web.Common.Audit;
+using Grand.Web.Common.Localization;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using System.Reflection;
+
+namespace Grand.Web.Admin.Tests.Controllers;
+
+[TestClass]
+public class PluginControllerTests
+{
+    private const string SystemName = "Tests.Plugin";
+
+    private string _contentRoot;
+    private ExtensionsConfig _extConfig;
+    private Mock<IHostApplicationLifetime> _applicationLifetime;
+    private Mock<IAuditEventRecorder> _auditEventRecorder;
+    private Mock<IPlugin> _plugin;
+    private Mock<IServiceProvider> _serviceProvider;
+    private PluginController _controller;
+
+    [TestInitialize]
+    public void Setup()
+    {
+        _contentRoot = Path.Combine(Path.GetTempPath(), "grand-plugin-controller-tests", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_contentRoot);
+
+        _extConfig = new ExtensionsConfig();
+        _applicationLifetime = new Mock<IHostApplicationLifetime>();
+        _auditEventRecorder = new Mock<IAuditEventRecorder>();
+        _plugin = new Mock<IPlugin>();
+        _serviceProvider = new Mock<IServiceProvider>();
+        _serviceProvider.Setup(x => x.GetService(typeof(IPlugin))).Returns(_plugin.Object);
+
+        var translationService = new Mock<IRequestTranslationService>();
+        translationService.Setup(x => x.GetResource(It.IsAny<string>())).Returns((string key) => key);
+
+        var workContext = new Mock<IWorkContext>();
+        workContext.Setup(x => x.CurrentCustomer).Returns(new Customer { Email = "admin@example.com" });
+        var contextAccessor = new Mock<IContextAccessor>();
+        contextAccessor.Setup(x => x.WorkContext).Returns(workContext.Object);
+
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(_contentRoot);
+
+        _controller = new PluginController(
+            translationService.Object,
+            new Mock<ILogger<PluginController>>().Object,
+            _applicationLifetime.Object,
+            contextAccessor.Object,
+            _serviceProvider.Object,
+            new Mock<IEnumTranslationService>().Object,
+            hostEnvironment.Object,
+            _extConfig,
+            _auditEventRecorder.Object);
+
+        var httpContext = new DefaultHttpContext();
+        _controller.ControllerContext = new ControllerContext { HttpContext = httpContext };
+        _controller.TempData = new TempDataDictionary(httpContext, new Mock<ITempDataProvider>().Object);
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        Directory.Delete(_contentRoot, true);
+    }
+
+    [TestMethod]
+    public void ReloadList_IsPostOnly()
+    {
+        var method = typeof(PluginController).GetMethod(nameof(PluginController.ReloadList));
+        Assert.IsNotNull(method);
+        Assert.IsNotNull(method.GetCustomAttribute<HttpPostAttribute>());
+        Assert.IsNull(method.GetCustomAttribute<HttpGetAttribute>());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_DoesNotStopApplication()
+    {
+        await WithPlugins(async () =>
+        {
+            await _controller.Install(SystemName);
+
+            _plugin.Verify(x => x.Install(), Times.Once);
+            _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+        }, Plugin(false));
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Uninstall_DoesNotStopApplication()
+    {
+        await WithPlugins(async () =>
+        {
+            await _controller.Uninstall(SystemName);
+
+            _plugin.Verify(x => x.Uninstall(), Times.Once);
+            _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+        }, Plugin(true));
+    }
+
+    [TestMethod]
+    public async Task ReloadList_StopsApplicationAndAudits()
+    {
+        await _controller.ReloadList();
+
+        _auditEventRecorder.Verify(x => x.Plugin("*", "restarted"), Times.Once);
+        _applicationLifetime.Verify(x => x.StopApplication(), Times.Once);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Remove_InstalledPlugin_DoesNotDeleteFolder()
+    {
+        var folder = Path.Combine(_contentRoot, "Plugins", "Tests.Plugin");
+        Directory.CreateDirectory(folder);
+        var mainAssembly = Path.Combine(folder, "Tests.Plugin.dll");
+        await File.WriteAllTextAsync(mainAssembly, "");
+        var plugin = new PluginInfo(new FileInfo(mainAssembly), null, typeof(IPlugin)) {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion,
+            Installed = true
+        };
+
+        await WithPlugins(async () =>
+        {
+            await _controller.Remove(SystemName);
+
+            Assert.IsTrue(Directory.Exists(folder));
+            _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+        }, plugin);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_WhenInstalledPluginsConfigured_DoesNotInstall()
+    {
+        _extConfig.InstalledPlugins = "Other.Plugin";
+
+        await WithPlugins(async () =>
+        {
+            await _controller.Install(SystemName);
+
+            _plugin.Verify(x => x.Install(), Times.Never);
+        }, Plugin(false));
+    }
+
+    private static PluginInfo Plugin(bool installed)
+    {
+        return new PluginInfo {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion,
+            PluginType = typeof(IPlugin),
+            Installed = installed
+        };
+    }
+
+    private static async Task WithPlugins(Func<Task> test, params PluginInfo[] plugins)
+    {
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = plugins;
+            await test();
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+}
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
index 6c2798e0f0..1b8862cd42 100644
--- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
@@ -8,14 +8,16 @@
     var remove = Url.Action("Remove", "Plugin", new { area = Constants.AreaAdmin });
 }
 <form asp-area="@Constants.AreaAdmin" asp-controller="Plugin" asp-action="List" method="post" id="plugins-form">
-    @* the reload link stays inside the form: its handler below is delegated from #plugins-form. Upload
-       is the one primary action; the load-mode filter only toggles a class on the table, so its
+    @* the reload button restarts the application with a script POST (the [data-plugin-restart] handler in
+       _AdminLayout, shared with the restart notice), so it is a plain button and no form nests in this one.
+       Upload is the one primary action; the load-mode filter only toggles a class on the table, so its
        button is a plain button, not a submit *@
     <admin-page title="@Loc["Admin.Plugins.Local"]" icon="bi-plug">
         <page-actions>
-            <a href="@Url.Action("ReloadList", new { area = Constants.AreaAdmin })" class="btn btn-outline-secondary" id="reload-plugin-list">
+            <button type="button" class="btn btn-outline-secondary" id="reload-plugin-list" data-plugin-restart
+                    data-url="@Url.Action("ReloadList", "Plugin", new { area = Constants.AreaAdmin })">
                 <i class="bi bi-arrow-clockwise"></i> @Loc["Admin.Plugins.ReloadList"]
-            </a>
+            </button>
             <button type="button" id="importfile" class="btn btn-primary">
                 <i class="bi bi-upload"></i> @Loc["Admin.Plugins.Upload"]
             </button>
@@ -78,15 +80,6 @@
                 $("html, body").animate({ scrollTop: 0 }, 400);
                 return true;
             });
-            $("#plugins-form").on("click", "#reload-plugin-list", function (e) {
-                event.preventDefault();
-                showThrobber('@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Plugins.Fields.Reload.List"]))')
-                $("html, body").animate({ scrollTop: 0 }, 400);
-                $.get($(this).attr("href"), function (data) { });
-                setTimeout(function () {
-                    location.reload();
-                }, 10000);
-            });
         });
 
         function additionalData() {
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml
new file mode 100644
index 0000000000..2a28223223
--- /dev/null
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml
@@ -0,0 +1,24 @@
+@using Grand.Infrastructure.Plugins
+@model IReadOnlyList<PluginPendingChange>
+@* the restart button is handled in _AdminLayout ([data-plugin-restart]), like the header's restart link *@
+<div class="alert alert-warning" role="status" id="plugin-restart-notice">
+    <div class="d-flex flex-wrap align-items-center gap-2">
+        <strong class="me-auto">
+            <i class="bi bi-exclamation-triangle" aria-hidden="true"></i> @Loc["Admin.Plugins.RestartRequired"]
+        </strong>
+        <button type="button" class="btn btn-outline-secondary btn-sm" data-plugin-restart
+                data-url="@Url.Action("ReloadList", "Plugin", new { area = Constants.AreaAdmin })">
+            <i class="bi bi-arrow-clockwise" aria-hidden="true"></i> @Loc["Admin.Plugins.RestartNow"]
+        </button>
+    </div>
+    <ul class="mb-0 mt-2">
+        @foreach (var change in Model)
+        {
+            <li><strong>@change.SystemName</strong> - @Loc[$"Admin.Plugins.RestartRequired.{change.Kind}"]</li>
+        }
+    </ul>
+    @if (Model.Any(x => x.Kind == PluginPendingChangeKind.Uninstalled))
+    {
+        <p class="mb-0 mt-2">@Loc["Admin.Plugins.RestartRequired.UninstallWarning"]</p>
+    }
+</div>
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml
index 78ddcf1d89..cc4e269b5c 100644
--- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml
@@ -247,6 +247,10 @@
         }
 
         <div class="right_col" role="main">
+            @if (!IsSectionDefined("popupwindow"))
+            {
+                @await Component.InvokeAsync("PluginRestartNotice")
+            }
             <partial name="Partials/Notifications"/>
             @RenderBody()
         </div>
@@ -287,6 +291,23 @@
                     }, 10000);
                 });
             });
+            //the plugin restart: the notice above every page and the plugin list's reload button
+            $(document).on("click", "[data-plugin-restart]", function (e) {
+                e.preventDefault();
+                var url = $(this).data("url");
+                GrandAdmin.modal.confirm('@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Common.AreYouSure"]))', {
+                    title: '@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Plugins.RestartNow"]))',
+                    confirmText: '@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Common.Yes"]))',
+                    cancelText: '@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Common.No"]))'
+                }).then(function (confirmed) {
+                    if (!confirmed) return;
+                    showThrobber('@Html.Raw(JavaScriptEncoder.Default.Encode(Loc["Admin.Header.RestartApplication.Progress"]))');
+                    $.post(url, addAntiForgeryToken({}));
+                    setTimeout(function () {
+                        location.reload();
+                    }, 10000);
+                });
+            });
         });
     </script>
 </body>
diff --git a/src/Web/Grand.Web.Admin/Components/PluginRestartNoticeViewComponent.cs b/src/Web/Grand.Web.Admin/Components/PluginRestartNoticeViewComponent.cs
new file mode 100644
index 0000000000..4485ecb08e
--- /dev/null
+++ b/src/Web/Grand.Web.Admin/Components/PluginRestartNoticeViewComponent.cs
@@ -0,0 +1,33 @@
+using Grand.Domain.Permissions;
+using Grand.Infrastructure.Plugins;
+using Grand.Web.Common.Components;
+using Grand.Web.Common.Security.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Grand.Web.Admin.Components;
+
+/// <summary>
+///     Lists the plugin changes waiting for a restart. Computed on every request, not cached: the notice goes
+///     away right after the restart and shows changes another administrator made.
+/// </summary>
+public class PluginRestartNoticeViewComponent : BaseAdminViewComponent
+{
+    private readonly IRequestPermissionService _permissionService;
+
+    public PluginRestartNoticeViewComponent(IRequestPermissionService permissionService)
+    {
+        _permissionService = permissionService;
+    }
+
+    public async Task<IViewComponentResult> InvokeAsync()
+    {
+        if (!await _permissionService.Authorize(StandardPermission.ManagePlugins))
+            return Content("");
+
+        var changes = PluginManager.GetPendingChanges();
+        if (changes.Count == 0)
+            return Content("");
+
+        return View(changes);
+    }
+}
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index 0bac4c4066..13adc43516 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -69,6 +69,35 @@ protected void DeleteDirectory(string path)
 
     }
 
+    /// <summary>
+    ///     Whether the plugin is installed now: an install or uninstall since the last restart already counts,
+    ///     although the plugin list still shows the state the application was started with
+    /// </summary>
+    private static bool IsInstalled(PluginInfo pluginInfo)
+    {
+        var pending = PluginManager.GetPendingChanges()
+            .LastOrDefault(x => string.Equals(x.SystemName, pluginInfo.SystemName, StringComparison.OrdinalIgnoreCase)
+                                && x.Kind is PluginPendingChangeKind.Installed or PluginPendingChangeKind.Uninstalled);
+
+        return pending?.Kind switch {
+            PluginPendingChangeKind.Installed => true,
+            PluginPendingChangeKind.Uninstalled => false,
+            _ => pluginInfo.Installed
+        };
+    }
+
+    /// <summary>
+    ///     The installed plugins are set in configuration (Extensions:InstalledPlugins), not by the admin panel
+    /// </summary>
+    private bool InstalledPluginsManagedByConfiguration()
+    {
+        if (string.IsNullOrEmpty(extConfig.InstalledPlugins))
+            return false;
+
+        Error(translationService.GetResource("Admin.Plugins.ManagedByConfiguration"));
+        return true;
+    }
+
     #endregion
 
     #region Methods
@@ -116,6 +145,9 @@ public IActionResult ListSelect(DataSourceRequest command, PluginListModel model
     [HttpPost]
     public async Task<IActionResult> Install(string systemName)
     {
+        if (InstalledPluginsManagedByConfiguration())
+            return RedirectToAction("List");
+
         try
         {
             var pluginInfo = PluginManager.ReferencedPlugins.FirstOrDefault(x => x.SystemName == systemName);
@@ -130,7 +162,7 @@ public async Task<IActionResult> Install(string systemName)
             }
 
             //check whether plugin is not installed
-            if (pluginInfo.Installed)
+            if (IsInstalled(pluginInfo))
                 return RedirectToAction("List");
 
             //install plugin
@@ -142,9 +174,6 @@ public async Task<IActionResult> Install(string systemName)
 
             logger.LogInformation("The plugin has been installed by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
-
-            //stop application
-            applicationLifetime.StopApplication();
         }
         catch (Exception exc)
         {
@@ -157,6 +186,9 @@ public async Task<IActionResult> Install(string systemName)
     [HttpPost]
     public async Task<IActionResult> Uninstall(string systemName)
     {
+        if (InstalledPluginsManagedByConfiguration())
+            return RedirectToAction("List");
+
         try
         {
             var pluginInfo = PluginManager.ReferencedPlugins.FirstOrDefault(x => x.SystemName == systemName);
@@ -165,7 +197,7 @@ public async Task<IActionResult> Uninstall(string systemName)
                 return RedirectToAction("List");
 
             //check whether plugin is installed
-            if (!pluginInfo.Installed)
+            if (!IsInstalled(pluginInfo))
                 return RedirectToAction("List");
 
             //uninstall plugin
@@ -177,9 +209,6 @@ public async Task<IActionResult> Uninstall(string systemName)
 
             logger.LogInformation("The plugin has been uninstalled by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
-
-            //stop application
-            applicationLifetime.StopApplication();
         }
         catch (Exception exc)
         {
@@ -205,17 +234,20 @@ public async Task<IActionResult> Remove(string systemName)
                 //No plugin found with the specified id
                 return RedirectToAction("List");
 
+            //an installed plugin keeps its settings and data; it is uninstalled first
+            if (IsInstalled(pluginInfo))
+            {
+                Error(translationService.GetResource("Admin.Plugins.Remove.UninstallFirst"));
+                return RedirectToAction("List");
+            }
+
             DeleteDirectory(pluginInfo.OriginalAssemblyFile.DirectoryName);
             await auditEventRecorder.Plugin(systemName, "removed");
 
-            //uninstall plugin
             Success(translationService.GetResource("Admin.Plugins.Removed"));
 
             logger.LogInformation("The plugin has been removed by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
-
-            //stop application
-            applicationLifetime.StopApplication();
         }
         catch (Exception exc)
         {
@@ -225,10 +257,16 @@ public async Task<IActionResult> Remove(string systemName)
         return RedirectToAction("List");
     }
 
-    public IActionResult ReloadList()
+    /// <summary>
+    ///     Restarts the application, which applies the plugin changes made since the last start. Under the
+    ///     Plugins permission, so applying them does not take the System permission a general restart needs.
+    /// </summary>
+    [HttpPost]
+    public async Task<IActionResult> ReloadList()
     {
         logger.LogInformation("Reload list of plugins by the user {CurrentCustomerEmail}",
             contextAccessor.WorkContext.CurrentCustomer.Email);
+        await auditEventRecorder.Plugin("*", "restarted");
 
         //stop application
         applicationLifetime.StopApplication();
@@ -291,9 +329,6 @@ public async Task<IActionResult> UploadPlugin(IFormFile zippedFile)
         logger.LogInformation("The plugin has been uploaded by the user {CurrentCustomerEmail}",
             contextAccessor.WorkContext.CurrentCustomer.Email);
 
-        //stop application
-        applicationLifetime.StopApplication();
-
         return RedirectToAction("List");
     }
 
diff --git a/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml b/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml
index 1a0074eda066f90394efc1c724488feae31822a5..fad94391dba0c8444c088f34093bc04419e69b7d 100644
GIT binary patch
delta 1162
zcmb_bT}TvB6u!GV&d$!v9mknnXWdnsO_D7nDuN&oR#A$GuqApagfZ83OUG@0L?42T
zsW2o8weu1__TWSG5G;tOy+jWROTC3J6<7p?Ap}KK=gyV|)<YPV?{e=s=bn4d`Mx{*
ztassE?`6m1cpaa^IaLnt_#MFsIHDst@<V#sfX6eE0wYHhIcAXyBt`PX#JLYgiku?_
z+*!CT;4TL*E~!mY&J8M{IS2bqT7-!(6-vtnO?qnv(P|^o7}HC7$S7C`s-jRn<U0u2
zMMZ@73Kih)YgvKSV`2nmpM=fnDNco@4Nf-Vq?3%eSK0WC3>m^)d2$%W7BoH9MFvO_
z6K7oGZqkA;%VUU%2m0~4(aDRl0aF&QNhX?e=qM5!+6<~gGAN&i^#~2Z&Io-AR~m4o
zE$b0TZ202vMW+hPzmaQqnD}H?J3F4j1Z*C}-LQLW8Wux!X_hBBxil`qo>#I6dkq?N
zTT+Qj!J`>T-&Q~GL@5`@V^!E-Qh?jG+6swch=cM~QGlnm+UJ(y{}BQwZ-knlZ18b7
z5z%UQG5*+D#^paU$!`8Vtq$$?JPEkf=HX$zLE=D&QG08UX7NWi*&W{M@A+EY0ZSic
z8O}y&cB>!hI1btADz3srmq9t0U(}LNmT3JS!-Md0+}G}DgAWZf>dNVi=@y(KSy#Y0
z#yt)umUKl4*pv)P=%-vN<Ziavm6L^jCZ-`*X#E(Q!F?XSo$`mkUgd=V`vy#*d03ec
zqmXE=;o#b5x%)3q^{#n3VBbwafr01#Zg{XJtEJ^AZTD{b*NwsbxTZ4wHkTF}X^Z!l
zA{*;zI52=kSoj71gC4<b!v7KO462a*#5Z4`i&2Dvs79!W8ia<>5kW)<QHwAT;nG~J
HZr%SKgV{g@

delta 186
zcmdn@Hf7c2l!g|@7N!>F7M2#)7Pc1l7LFFq7OocV7M?A<VdB$gsPX1acQ_-&vE4?3
zH;8F^fei1v>Fbnv&87#4@$yaI#VwFCeZw;zf$dM!d7YRb%J*sW@@yB-=1pP(D`GBX
zD44!?s$l%|22Ea>=>mp8eL6uR0@EM7W>afFr^gG#d_c?(!~#Gp2*g4_EDXdVKr9Nx
RVn8eo#1h-j=}CTI2LMJ7K{x;a

diff --git a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
index b82f1fa1ee..c1d24bbd31 100644
--- a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
+++ b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
@@ -849,4 +849,46 @@
 	<Resource Name="Admin.Plugins.LoadError" Area="Admin">
 		<Value>Load error</Value>
 	</Resource>
+	<Resource Name="Admin.Plugins.ManagedByConfiguration" Area="Admin">
+		<Value>Installed plugins are set in the application configuration (Extensions:InstalledPlugins), so they cannot be installed or uninstalled here.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Remove.UninstallFirst" Area="Admin">
+		<Value>Uninstall the plugin before removing it.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartNow" Area="Admin">
+		<Value>Restart now</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired" Area="Admin">
+		<Value>Plugin changes take effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Added" Area="Admin">
+		<Value>Added</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Installed" Area="Admin">
+		<Value>Installed</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Removed" Area="Admin">
+		<Value>Removed</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.UninstallWarning" Area="Admin">
+		<Value>An uninstalled plugin keeps running until the restart, although its settings and texts are already removed.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Uninstalled" Area="Admin">
+		<Value>Uninstalled</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.RestartRequired.Updated" Area="Admin">
+		<Value>Updated</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Installed" Area="Admin">
+		<Value>The plugin has been installed. The change takes effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Removed" Area="Admin">
+		<Value>The plugin has been removed. The change takes effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Uninstalled" Area="Admin">
+		<Value>The plugin has been uninstalled. The change takes effect after the application restarts.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Uploaded" Area="Admin">
+		<Value>The plugin has been uploaded. The change takes effect after the application restarts.</Value>
+	</Resource>
 </Language>

From 516f41e66c08426683f1cf0862a159101ccbfa83 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Tue, 3 Nov 2026 20:06:10 +0100
Subject: [PATCH 09/30] Let a broken plugin be uninstalled and deliver the
 restart texts to existing stores

---
 .../Controllers/PluginControllerTests.cs      | 108 +++++++++++++++++-
 .../Controllers/PluginController.cs           |  29 +++--
 .../App_Data/Resources/DefaultLanguage.xml    | Bin 1652414 -> 1653872 bytes
 .../App_Data/Resources/Upgrade/en_250.xml     |  11 +-
 4 files changed, 135 insertions(+), 13 deletions(-)

diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
index bdd31072ff..ce4b165a44 100644
--- a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
+++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
@@ -8,7 +8,9 @@
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Routing;
 using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
@@ -65,7 +67,15 @@ public void Setup()
             _extConfig,
             _auditEventRecorder.Object);
 
-        var httpContext = new DefaultHttpContext();
+        //RedirectToAction builds its URL helper, and an error notification logs, through the request services
+        var urlHelperFactory = new Mock<IUrlHelperFactory>();
+        urlHelperFactory.Setup(x => x.GetUrlHelper(It.IsAny<ActionContext>())).Returns(new Mock<IUrlHelper>().Object);
+        var httpContext = new DefaultHttpContext {
+            RequestServices = new ServiceCollection()
+                .AddLogging()
+                .AddSingleton(urlHelperFactory.Object)
+                .BuildServiceProvider()
+        };
         _controller.ControllerContext = new ControllerContext { HttpContext = httpContext };
         _controller.TempData = new TempDataDictionary(httpContext, new Mock<ITempDataProvider>().Object);
     }
@@ -157,6 +167,102 @@ await WithPlugins(async () =>
         }, Plugin(false));
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_ShowsTheAfterRestartText()
+    {
+        await WithPlugins(async () =>
+        {
+            await _controller.Install(SystemName);
+
+            CollectionAssert.Contains(Notifications("Success"), "Admin.Plugins.Installed.AfterRestart");
+        }, Plugin(false));
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Uninstall_PluginWithLoadError_MarksUninstalledWithoutInstance()
+    {
+        var plugin = BrokenPlugin(null);
+
+        await WithInstalledFile(async installedFile =>
+        {
+            await WithPlugins(async () =>
+            {
+                await _controller.Uninstall(SystemName);
+
+                CollectionAssert.DoesNotContain(PluginExtensions.ParseInstalledPluginsFile(installedFile).ToList(),
+                    SystemName);
+                _serviceProvider.Verify(x => x.GetService(It.IsAny<Type>()), Times.Never);
+                _plugin.Verify(x => x.Uninstall(), Times.Never);
+                _auditEventRecorder.Verify(x => x.Plugin(SystemName, "uninstalled"), Times.Once);
+                CollectionAssert.Contains(Notifications("Warning"), "Admin.Plugins.Uninstalled.NotCleanedUp");
+                _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+            }, plugin);
+        });
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Remove_AfterUninstallOfBrokenPlugin_DeletesFolder()
+    {
+        var folder = Path.Combine(_contentRoot, "Plugins", "Tests.Plugin");
+        Directory.CreateDirectory(folder);
+        var mainAssembly = Path.Combine(folder, "Tests.Plugin.dll");
+        await File.WriteAllTextAsync(mainAssembly, "");
+        var plugin = BrokenPlugin(new FileInfo(mainAssembly));
+
+        await WithInstalledFile(async _ =>
+        {
+            await WithPlugins(async () =>
+            {
+                await _controller.Uninstall(SystemName);
+                await _controller.Remove(SystemName);
+
+                Assert.IsFalse(Directory.Exists(folder));
+                _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
+            }, plugin);
+        });
+    }
+
+    private List<string> Notifications(string type)
+    {
+        return _controller.TempData[$"grand.notifications.{type}"] as List<string> ?? [];
+    }
+
+    /// <summary>
+    ///     An installed plugin as loading leaves one that failed: without a plugin type, so no instance can be
+    ///     created (LoadError itself can only be set by the loader)
+    /// </summary>
+    private static PluginInfo BrokenPlugin(FileInfo mainAssembly)
+    {
+        return new PluginInfo(mainAssembly, null, null) {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion,
+            Installed = true
+        };
+    }
+
+    /// <summary>
+    ///     Runs with the plugin listed in the installed-plugins file, which is removed afterwards
+    /// </summary>
+    private async Task WithInstalledFile(Func<string, Task> test)
+    {
+        //initialized once per process; a later call keeps the first path
+        PluginPaths.Initialize(Path.Combine(_contentRoot, "App_Data", "InstalledPlugins.cfg"));
+        var installedFile = PluginPaths.Instance.InstalledPluginsFile;
+        Directory.CreateDirectory(Path.GetDirectoryName(installedFile)!);
+        await File.WriteAllTextAsync(installedFile, $"[\"{SystemName}\"]");
+        try
+        {
+            await test(installedFile);
+        }
+        finally
+        {
+            File.Delete(installedFile);
+        }
+    }
+
     private static PluginInfo Plugin(bool installed)
     {
         return new PluginInfo {
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index 13adc43516..64c5e24d66 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -170,7 +170,7 @@ public async Task<IActionResult> Install(string systemName)
             await plugin.Install();
             await auditEventRecorder.Plugin(systemName, "installed");
 
-            Success(translationService.GetResource("Admin.Plugins.Installed"));
+            Success(translationService.GetResource("Admin.Plugins.Installed.AfterRestart"));
 
             logger.LogInformation("The plugin has been installed by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
@@ -200,12 +200,25 @@ public async Task<IActionResult> Uninstall(string systemName)
             if (!IsInstalled(pluginInfo))
                 return RedirectToAction("List");
 
-            //uninstall plugin
-            var plugin = pluginInfo.Instance<IPlugin>(serviceProvider);
-            await plugin.Uninstall();
-            await auditEventRecorder.Plugin(systemName, "uninstalled");
+            //a plugin that failed to load has no instance to clean up after itself: it is only marked
+            //uninstalled, so it can be removed
+            if (pluginInfo.LoadError != null || pluginInfo.PluginType == null)
+            {
+                await Grand.Infrastructure.Plugins.PluginExtensions.MarkPluginAsUninstalled(pluginInfo.SystemName);
+                //it never ran: the list shows it uninstalled, and removable, right away
+                pluginInfo.Installed = false;
+                await auditEventRecorder.Plugin(systemName, "uninstalled");
+
+                Warning(translationService.GetResource("Admin.Plugins.Uninstalled.NotCleanedUp"));
+            }
+            else
+            {
+                var plugin = pluginInfo.Instance<IPlugin>(serviceProvider);
+                await plugin.Uninstall();
+                await auditEventRecorder.Plugin(systemName, "uninstalled");
 
-            Success(translationService.GetResource("Admin.Plugins.Uninstalled"));
+                Success(translationService.GetResource("Admin.Plugins.Uninstalled.AfterRestart"));
+            }
 
             logger.LogInformation("The plugin has been uninstalled by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
@@ -244,7 +257,7 @@ public async Task<IActionResult> Remove(string systemName)
             DeleteDirectory(pluginInfo.OriginalAssemblyFile.DirectoryName);
             await auditEventRecorder.Plugin(systemName, "removed");
 
-            Success(translationService.GetResource("Admin.Plugins.Removed"));
+            Success(translationService.GetResource("Admin.Plugins.Removed.AfterRestart"));
 
             logger.LogInformation("The plugin has been removed by the user {CurrentCustomerEmail}",
                 contextAccessor.WorkContext.CurrentCustomer.Email);
@@ -312,7 +325,7 @@ public async Task<IActionResult> UploadPlugin(IFormFile zippedFile)
             var result = installer.Install(zipFilePath);
             await auditEventRecorder.Plugin(result.Manifest.SystemName, "uploaded");
 
-            var message = translationService.GetResource("Admin.Plugins.Uploaded");
+            var message = translationService.GetResource("Admin.Plugins.Uploaded.AfterRestart");
             Success(message);
         }
         catch (Exception exc)
diff --git a/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml b/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml
index fad94391dba0c8444c088f34093bc04419e69b7d..95738c2876de7e6eaef184509c8aa6b0aec24baf 100644
GIT binary patch
delta 473
zcmaiwy-Nad7{?!9x;*u{?mRt}Qm#d`LuqM<8d}>NqAkkO8uF#|vbG$4&_9qo4Iu;#
zjSay;(8~}_{RsuNv;~chJ)Y52#E%a=uir1v@Ajko*)Mm5M|g!#_{E5j#Ha`eSp-E$
zgs*TpPA3_x(_<JFD#lULO0WqwRG`VP0xhuVY(|}<%QR-`xFkjBJ&mul@DvF+^9i&i
zDjK|c9a5{bHi6Mp4I0qq%`z0=cP)pt+M%KEX$}qjufd_IGKGEW<uDp6K%K>H*nlb<
zlsID>n!J-{-AS#+wI*!4<|fB2dKt&0TmTamd96jeTZ&HAXDMh6E<702xVO*o;8ycn
z-gL8{JLoNI==6|6gU-8JhAvjLCF<lbP4^ZC9o52hulotUJ=md}uC_YtPUlhi=QQ)s
f<3H-<kx`g2MrAZ6!stwti7^HfXA({?pETt!3i5;?

delta 122
zcmezHBW2&)l!g|@7N!>F7M2#)7Pc1l7LFFq7OocV7M?A<VdC2pBzU9Pw=YoOE#saJ
zWZ&C<MxQs2X*y6qW4b~;BTIXLF)tAF0Wm)i3jnbo5DNjZFc6CXu_zFW0kJp`OKcA?
ImQ>&b0Pd(I>;M1&

diff --git a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
index c1d24bbd31..7f9664c385 100644
--- a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
+++ b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
@@ -879,16 +879,19 @@
 	<Resource Name="Admin.Plugins.RestartRequired.Updated" Area="Admin">
 		<Value>Updated</Value>
 	</Resource>
-	<Resource Name="Admin.Plugins.Installed" Area="Admin">
+	<Resource Name="Admin.Plugins.Installed.AfterRestart" Area="Admin">
 		<Value>The plugin has been installed. The change takes effect after the application restarts.</Value>
 	</Resource>
-	<Resource Name="Admin.Plugins.Removed" Area="Admin">
+	<Resource Name="Admin.Plugins.Removed.AfterRestart" Area="Admin">
 		<Value>The plugin has been removed. The change takes effect after the application restarts.</Value>
 	</Resource>
-	<Resource Name="Admin.Plugins.Uninstalled" Area="Admin">
+	<Resource Name="Admin.Plugins.Uninstalled.AfterRestart" Area="Admin">
 		<Value>The plugin has been uninstalled. The change takes effect after the application restarts.</Value>
 	</Resource>
-	<Resource Name="Admin.Plugins.Uploaded" Area="Admin">
+	<Resource Name="Admin.Plugins.Uninstalled.NotCleanedUp" Area="Admin">
+		<Value>The plugin has been marked as uninstalled. Its settings and texts were not removed because the plugin could not be loaded.</Value>
+	</Resource>
+	<Resource Name="Admin.Plugins.Uploaded.AfterRestart" Area="Admin">
 		<Value>The plugin has been uploaded. The change takes effect after the application restarts.</Value>
 	</Resource>
 </Language>

From cd8d54caad403124445b7c7e3684c08fb1e10688 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Tue, 3 Nov 2026 20:17:35 +0100
Subject: [PATCH 10/30] Ask for a restart before installing or uninstalling a
 plugin whose files changed

---
 .../Grand.Infrastructure.csproj               |   1 +
 .../Controllers/PluginControllerTests.cs      |  93 +++++++++++++++++-
 .../Controllers/PluginController.cs           |  48 +++++++--
 .../App_Data/Resources/DefaultLanguage.xml    | Bin 1653872 -> 1654320 bytes
 .../App_Data/Resources/Upgrade/en_250.xml     |   3 +
 5 files changed, 134 insertions(+), 11 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj b/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
index 9b99c8a636..6a17cb52b0 100644
--- a/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
+++ b/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
@@ -24,5 +24,6 @@
   </ItemGroup>
   <ItemGroup>
     <InternalsVisibleTo Include="Grand.Infrastructure.Tests" />
+    <InternalsVisibleTo Include="Grand.Web.Admin.Tests" />
   </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
index ce4b165a44..5105308350 100644
--- a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
+++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
@@ -225,6 +225,91 @@ await WithPlugins(async () =>
         });
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_AfterRemoveBeforeRestart_Refuses()
+    {
+        await WithLoadedFolder(false, folder => Directory.Delete(folder, true), async installedFile =>
+        {
+            await _controller.Install(SystemName);
+
+            _plugin.Verify(x => x.Install(), Times.Never);
+            Assert.IsEmpty(PluginExtensions.ParseInstalledPluginsFile(installedFile));
+            CollectionAssert.Contains(Notifications("Error"), "Admin.Plugins.RestartFirst");
+        });
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Install_AfterUpdateBeforeRestart_Refuses()
+    {
+        await WithLoadedFolder(false, ReplaceMainAssembly, async installedFile =>
+        {
+            await _controller.Install(SystemName);
+
+            _plugin.Verify(x => x.Install(), Times.Never);
+            Assert.IsEmpty(PluginExtensions.ParseInstalledPluginsFile(installedFile));
+            CollectionAssert.Contains(Notifications("Error"), "Admin.Plugins.RestartFirst");
+        });
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Uninstall_AfterUpdateBeforeRestart_Refuses()
+    {
+        await WithLoadedFolder(true, ReplaceMainAssembly, async installedFile =>
+        {
+            await _controller.Uninstall(SystemName);
+
+            _plugin.Verify(x => x.Uninstall(), Times.Never);
+            CollectionAssert.Contains(PluginExtensions.ParseInstalledPluginsFile(installedFile).ToList(), SystemName);
+            CollectionAssert.Contains(Notifications("Error"), "Admin.Plugins.RestartFirst");
+        });
+    }
+
+    /// <summary>
+    ///     Runs with the plugin loaded from its folder as PluginManager.Load records it, after
+    ///     <paramref name="changeOnDisk" /> changed that folder
+    /// </summary>
+    private async Task WithLoadedFolder(bool installed, Action<string> changeOnDisk, Func<string, Task> test)
+    {
+        var pluginsFolder = new DirectoryInfo(Path.Combine(_contentRoot, "Plugins"));
+        var folder = Directory.CreateDirectory(Path.Combine(pluginsFolder.FullName, "Tests.Plugin"));
+        var mainAssembly = Path.Combine(folder.FullName, "Tests.Plugin.dll");
+        await File.WriteAllTextAsync(mainAssembly, "version 1");
+        var manifest = new PluginManifest(SystemName, SystemName, "Misc", "Tests", "1.0",
+            GrandVersion.SupportedPluginVersion);
+        var scan = new PluginScanResult(
+            [new PluginCandidate(folder, mainAssembly, manifest, [mainAssembly], [SystemName])], [], []);
+        var plugin = new PluginInfo(new FileInfo(mainAssembly), null, typeof(IPlugin)) {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion,
+            Installed = installed
+        };
+
+        await WithInstalledFile(async installedFile =>
+        {
+            var loadSnapshot = PluginManager.LoadSnapshot;
+            try
+            {
+                PluginManager.LoadSnapshot = PluginLoadSnapshot.Capture(pluginsFolder, scan,
+                    PluginExtensions.ParseInstalledPluginsFile(installedFile), installedFile, null);
+                changeOnDisk(folder.FullName);
+
+                await WithPlugins(() => test(installedFile), plugin);
+            }
+            finally
+            {
+                PluginManager.LoadSnapshot = loadSnapshot;
+            }
+        }, installed ? [SystemName] : []);
+    }
+
+    private static void ReplaceMainAssembly(string folder)
+    {
+        File.WriteAllText(Path.Combine(folder, "Tests.Plugin.dll"), "version 2, a different build");
+    }
+
     private List<string> Notifications(string type)
     {
         return _controller.TempData[$"grand.notifications.{type}"] as List<string> ?? [];
@@ -244,15 +329,17 @@ private static PluginInfo BrokenPlugin(FileInfo mainAssembly)
     }
 
     /// <summary>
-    ///     Runs with the plugin listed in the installed-plugins file, which is removed afterwards
+    ///     Runs with the installed-plugins file listing <paramref name="installed" /> (by default the plugin),
+    ///     and removes it afterwards
     /// </summary>
-    private async Task WithInstalledFile(Func<string, Task> test)
+    private async Task WithInstalledFile(Func<string, Task> test, string[] installed = null)
     {
         //initialized once per process; a later call keeps the first path
         PluginPaths.Initialize(Path.Combine(_contentRoot, "App_Data", "InstalledPlugins.cfg"));
         var installedFile = PluginPaths.Instance.InstalledPluginsFile;
         Directory.CreateDirectory(Path.GetDirectoryName(installedFile)!);
-        await File.WriteAllTextAsync(installedFile, $"[\"{SystemName}\"]");
+        await File.WriteAllTextAsync(installedFile,
+            System.Text.Json.JsonSerializer.Serialize(installed ?? [SystemName]));
         try
         {
             await test(installedFile);
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index 64c5e24d66..f9826dc583 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -69,23 +69,47 @@ protected void DeleteDirectory(string path)
 
     }
 
+    /// <summary>
+    ///     The plugin's changes waiting for the restart, matched by system name and by folder
+    /// </summary>
+    private static List<PluginPendingChange> PendingChangesOf(PluginInfo pluginInfo)
+    {
+        var folder = pluginInfo.OriginalAssemblyFile?.Directory?.Name;
+        return PluginManager.GetPendingChanges()
+            .Where(x => string.Equals(x.SystemName, pluginInfo.SystemName, StringComparison.OrdinalIgnoreCase)
+                        || (folder != null && string.Equals(x.FolderName, folder, StringComparison.OrdinalIgnoreCase)))
+            .ToList();
+    }
+
     /// <summary>
     ///     Whether the plugin is installed now: an install or uninstall since the last restart already counts,
     ///     although the plugin list still shows the state the application was started with
     /// </summary>
-    private static bool IsInstalled(PluginInfo pluginInfo)
+    private static bool IsInstalled(PluginInfo pluginInfo, IEnumerable<PluginPendingChange> pending)
     {
-        var pending = PluginManager.GetPendingChanges()
-            .LastOrDefault(x => string.Equals(x.SystemName, pluginInfo.SystemName, StringComparison.OrdinalIgnoreCase)
-                                && x.Kind is PluginPendingChangeKind.Installed or PluginPendingChangeKind.Uninstalled);
+        var change = pending.LastOrDefault(x =>
+            x.Kind is PluginPendingChangeKind.Installed or PluginPendingChangeKind.Uninstalled);
 
-        return pending?.Kind switch {
+        return change?.Kind switch {
             PluginPendingChangeKind.Installed => true,
             PluginPendingChangeKind.Uninstalled => false,
             _ => pluginInfo.Installed
         };
     }
 
+    /// <summary>
+    ///     The running code is not what is on disk any more (the folder was removed or replaced): installing or
+    ///     uninstalling it would run the old plugin's code for the new one, or for one that is gone
+    /// </summary>
+    private bool RestartRequiredFirst(IEnumerable<PluginPendingChange> pending)
+    {
+        if (!pending.Any(x => x.Kind is PluginPendingChangeKind.Removed or PluginPendingChangeKind.Updated))
+            return false;
+
+        Error(translationService.GetResource("Admin.Plugins.RestartFirst"));
+        return true;
+    }
+
     /// <summary>
     ///     The installed plugins are set in configuration (Extensions:InstalledPlugins), not by the admin panel
     /// </summary>
@@ -161,8 +185,12 @@ public async Task<IActionResult> Install(string systemName)
                 return RedirectToAction("List");
             }
 
+            var pending = PendingChangesOf(pluginInfo);
+            if (RestartRequiredFirst(pending))
+                return RedirectToAction("List");
+
             //check whether plugin is not installed
-            if (IsInstalled(pluginInfo))
+            if (IsInstalled(pluginInfo, pending))
                 return RedirectToAction("List");
 
             //install plugin
@@ -196,8 +224,12 @@ public async Task<IActionResult> Uninstall(string systemName)
                 //No plugin found with the specified id
                 return RedirectToAction("List");
 
+            var pending = PendingChangesOf(pluginInfo);
+            if (RestartRequiredFirst(pending))
+                return RedirectToAction("List");
+
             //check whether plugin is installed
-            if (!IsInstalled(pluginInfo))
+            if (!IsInstalled(pluginInfo, pending))
                 return RedirectToAction("List");
 
             //a plugin that failed to load has no instance to clean up after itself: it is only marked
@@ -248,7 +280,7 @@ public async Task<IActionResult> Remove(string systemName)
                 return RedirectToAction("List");
 
             //an installed plugin keeps its settings and data; it is uninstalled first
-            if (IsInstalled(pluginInfo))
+            if (IsInstalled(pluginInfo, PendingChangesOf(pluginInfo)))
             {
                 Error(translationService.GetResource("Admin.Plugins.Remove.UninstallFirst"));
                 return RedirectToAction("List");
diff --git a/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml b/src/Web/Grand.Web/App_Data/Resources/DefaultLanguage.xml
index 95738c2876de7e6eaef184509c8aa6b0aec24baf..3f59300ebcd846a6f8e8ca11fb7dc0076a6fbc71 100644
GIT binary patch
delta 233
zcmezHBW1&%l!g|@7N!>F7M2#)7Pc1l7LFFq7OocV7M?A<M-*Ap7%~}(rUw=?Sx#S|
zz$>N;;^#1=G88i?Fk~<!GL!+?3Jl3$b{<1Ike34F7Xwx0F(gl4D9<K5-9d&|XnNNV
z9zIq*pj6QG_yz&}>2uyP@d<+z6*H6ojmZH*5HEfDLm6IaelQcLxCCf!CPVS`+0S|E
vrw6F<^0gmP<OO07%@4!^Kr9HvLO?7G#3Dc}3dCYSEDppH+m9$pu8{%&Pm@Hi

delta 89
zcmWN=w+Vm%07XH}IcGa@H3zYH;4&5#f(tm1rG<t6;Er#3-etwW#KOkG#lt5cBqBbO
ad)k;2O*PY83oW(MS{rS()Ba)}_VEX(dmcmp

diff --git a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
index 7f9664c385..254b8d19c7 100644
--- a/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
+++ b/src/Web/Grand.Web/App_Data/Resources/Upgrade/en_250.xml
@@ -894,4 +894,7 @@
 	<Resource Name="Admin.Plugins.Uploaded.AfterRestart" Area="Admin">
 		<Value>The plugin has been uploaded. The change takes effect after the application restarts.</Value>
 	</Resource>
+	<Resource Name="Admin.Plugins.RestartFirst" Area="Admin">
+		<Value>The plugin files have changed since the application started. Restart the application before installing or uninstalling this plugin.</Value>
+	</Resource>
 </Language>

From 9870cbf7b7cdb089ceb124b0db671dc1b50dcc96 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 06:32:23 +0100
Subject: [PATCH 11/30] Cache assembly types between type scans

---
 .../TypeSearch/TypeSearcher.cs                | 36 +++++++-
 .../TypeSearcher/TypeSearcherTests.cs         | 88 ++++++++++++++++++-
 2 files changed, 121 insertions(+), 3 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs b/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
index cc0924e30e..d0faac108e 100644
--- a/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
+++ b/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
@@ -1,5 +1,7 @@
 using Grand.Infrastructure.Plugins;
 using Grand.Infrastructure.Roslyn;
+using System.Collections.Concurrent;
+using System.Collections.ObjectModel;
 using System.Diagnostics;
 using System.Reflection;
 
@@ -13,6 +15,36 @@ public class TypeSearcher : ITypeSearcher
 {
     #region Utilities
 
+    //Shared by every instance, because TypeSearcher is created in many places during startup.
+    //Loaded assemblies are never unloaded, so their types are read once.
+    private static readonly ConcurrentDictionary<Assembly, Type[]> TypesByAssembly = new();
+
+    private sealed record AssemblySnapshot(
+        int AppDomainAssemblyCount,
+        IEnumerable<PluginInfo> ReferencedPlugins,
+        IEnumerable<ResultCompiler> ReferencedScripts,
+        IList<Assembly> Assemblies);
+
+    //Replaced as a whole, never mutated. A race only costs one redundant recomputation.
+    private static volatile AssemblySnapshot _snapshot;
+
+    private static IList<Assembly> CachedAssemblies()
+    {
+        var count = AppDomain.CurrentDomain.GetAssemblies().Length;
+        var plugins = PluginManager.ReferencedPlugins;
+        var scripts = RoslynCompiler.ReferencedScripts;
+
+        var snapshot = _snapshot;
+        if (snapshot != null && snapshot.AppDomainAssemblyCount == count &&
+            ReferenceEquals(snapshot.ReferencedPlugins, plugins) &&
+            ReferenceEquals(snapshot.ReferencedScripts, scripts))
+            return snapshot.Assemblies;
+
+        var assemblies = new ReadOnlyCollection<Assembly>(AssembliesInAppDomain());
+        _snapshot = new AssemblySnapshot(count, plugins, scripts, assemblies);
+        return assemblies;
+    }
+
     private static IList<Assembly> AssembliesInAppDomain()
     {
         var addedAssemblyNames = new List<string>();
@@ -65,7 +97,7 @@ public IEnumerable<Type> ClassesOfType(Type assignTypeFrom, IEnumerable<Assembly
         {
             foreach (var assembly in assemblies)
             {
-                var types = assembly.GetTypes()
+                var types = TypesByAssembly.GetOrAdd(assembly, static a => a.GetTypes())
                     .Where(type =>
                         (assignTypeFrom.IsAssignableFrom(type) ||
                          (assignTypeFrom.IsGenericTypeDefinition && DoesTypeImplementOpenGeneric(type, assignTypeFrom))) &&
@@ -115,7 +147,7 @@ select genericTypeDefinition.IsAssignableFrom(implementedInterface.GetGenericTyp
     /// <returns>A list of assemblies that should be loaded by the Grand factory.</returns>
     public virtual IList<Assembly> GetAssemblies()
     {
-        return AssembliesInAppDomain();
+        return CachedAssemblies();
     }
 
     #endregion
diff --git a/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs b/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
index 16c4e37cf3..0f8452a4d9 100644
--- a/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
@@ -1,7 +1,13 @@
-using Grand.Infrastructure.Caching;
+using Grand.Domain.Configuration;
+using Grand.Infrastructure.Caching;
+using Grand.Infrastructure.Mapper;
 using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Startup;
 using Grand.Infrastructure.Tests.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
+using System.Reflection;
+using System.Runtime.Loader;
 
 namespace Grand.Infrastructure.Tests.TypeSearcher;
 
@@ -65,6 +71,86 @@ public void GetAssemblies_KeepsInstalledPluginAssembly()
         }
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetAssemblies_NothingChanged_ReturnsTheSameList()
+    {
+        var first = _typeSearcher.GetAssemblies();
+
+        Assert.AreSame(first, new TypeSearch.TypeSearcher().GetAssemblies());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetAssemblies_AfterAssemblyLoaded_IncludesIt()
+    {
+        const string name = "Grand.Infrastructure.Tests.LateLoaded";
+        var dir = Path.Combine(Path.GetTempPath(), "grand-typesearcher-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var path = TestPluginBuilder.Compile(dir, name, """
+                [assembly: System.Reflection.AssemblyProduct("grandnode")]
+                public class LateLoadedMarker { }
+                """);
+
+            Assert.DoesNotContain(x => x.GetName().Name == name, _typeSearcher.GetAssemblies());
+
+            // The type cache keeps the assembly reachable, so the context is never unloaded; the
+            // fixture holds one inert class and implements nothing a scan looks for.
+            var context = new AssemblyLoadContext("late-loaded", true);
+            using var stream = new MemoryStream(File.ReadAllBytes(path));
+            var loaded = context.LoadFromStream(stream);
+
+            Assert.Contains(loaded, _typeSearcher.GetAssemblies());
+        }
+        finally
+        {
+            Directory.Delete(dir, true);
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetAssemblies_AfterReferencedPluginsReplaced_Recomputes()
+    {
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [SamplePluginInfo(true)];
+            Assert.Contains(typeof(SampleBasePlugin).Assembly, _typeSearcher.GetAssemblies());
+
+            PluginManager.ReferencedPlugins = [SamplePluginInfo(false)];
+            Assert.DoesNotContain(typeof(SampleBasePlugin).Assembly, _typeSearcher.GetAssemblies());
+
+            PluginManager.ReferencedPlugins = [SamplePluginInfo(true)];
+            Assert.Contains(typeof(SampleBasePlugin).Assembly, _typeSearcher.GetAssemblies());
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void ClassesOfType_SameResultAsUncachedScan()
+    {
+        foreach (var type in new[] { typeof(IStartupApplication), typeof(ISettings), typeof(IAutoMapperProfile) })
+        {
+            var expected = UncachedScan(type, _typeSearcher.GetAssemblies());
+
+            CollectionAssert.AreEquivalent(expected, _typeSearcher.ClassesOfType(type).ToList());
+            CollectionAssert.AreEquivalent(expected, _typeSearcher.ClassesOfType(type).ToList());
+        }
+    }
+
+    private static List<Type> UncachedScan(Type assignTypeFrom, IEnumerable<Assembly> assemblies)
+    {
+        return assemblies.SelectMany(a => a.GetTypes())
+            .Where(t => assignTypeFrom.IsAssignableFrom(t) && !t.IsInterface && t.IsClass && !t.IsAbstract)
+            .ToList();
+    }
+
     private static PluginInfo SamplePluginInfo(bool installed)
     {
         return new PluginInfo(null, typeof(SampleBasePlugin).Assembly, typeof(SampleBasePlugin)) {

From f18133e04b6ff228ecea6b4ff48f905aa07f430f Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 06:57:57 +0100
Subject: [PATCH 12/30] Load a plugin's assemblies only once it is installed

---
 .../Plugins/PluginInfo.cs                     |  36 ++-
 .../Plugins/PluginManager.cs                  | 112 +++++++++-
 .../Startup/StartupApplication.cs             |  11 +-
 .../Plugins/PluginManagerTests.cs             | 208 ++++++++++++++++++
 .../Startup/StartupApplicationTests.cs        |   6 +-
 .../Controllers/PluginControllerTests.cs      |   7 +-
 .../Controllers/PluginController.cs           |  11 +-
 7 files changed, 359 insertions(+), 32 deletions(-)
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
index a3bc634790..ea28329571 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
@@ -6,6 +6,8 @@ namespace Grand.Infrastructure.Plugins;
 
 public sealed class PluginInfo
 {
+    private Assembly _referencedAssembly;
+
     public PluginInfo(
         FileInfo originalAssemblyFile,
         Assembly referencedAssembly,
@@ -35,9 +37,23 @@ public PluginInfo()
     public Type PluginType { get; set; }
 
     /// <summary>
-    ///     The assembly that has been shadow copied that is active in the application
+    ///     The plugin's main assembly once it is loaded: at startup for an installed plugin, on demand
+    ///     (<see cref="PluginManager.LoadForInstall" />) for one being installed; null until then
     /// </summary>
-    public Assembly ReferencedAssembly { get; internal set; }
+    /// <remarks>
+    ///     Set last when a plugin loads on demand, so a request that sees it also sees <see cref="PluginType" />
+    /// </remarks>
+    public Assembly ReferencedAssembly
+    {
+        get => Volatile.Read(ref _referencedAssembly);
+        internal set => Volatile.Write(ref _referencedAssembly, value);
+    }
+
+    /// <summary>
+    ///     The scanned folder <see cref="PluginManager.LoadForInstall" /> loads; null when there is nothing to load
+    ///     on demand (the plugin loaded at startup, is built for another version, or was not found by a scan)
+    /// </summary>
+    internal PluginCandidate Candidate { get; set; }
 
     /// <summary>
     ///     The original assembly file that a shadow copy was made from it
@@ -101,15 +117,27 @@ public PluginInfo()
     /// </summary>
     public bool IsActive => Installed && LoadError == null;
 
+    /// <summary>
+    ///     Creates the plugin, loading it first when it was listed without being loaded (an uninstalled plugin).
+    ///     An installed plugin is resolved from DI; one loaded on demand is not registered there until the restart,
+    ///     so it is created with its constructor dependencies taken from <paramref name="serviceProvider" />.
+    /// </summary>
+    /// <exception cref="GrandException">The plugin cannot be loaded or created</exception>
     public T Instance<T>(IServiceProvider serviceProvider) where T : class, IPlugin
     {
+        if (ReferencedAssembly == null && LoadError == null)
+            PluginManager.LoadForInstall(this);
+
         if (PluginType == null)
-            throw new GrandException($"Plugin {SystemName} has no IPlugin class");
+            throw new GrandException(LoadError != null
+                ? $"Plugin {SystemName} could not be loaded: {LoadError}"
+                : $"Plugin {SystemName} has no IPlugin class");
 
         object instance;
         try
         {
-            instance = serviceProvider.GetRequiredService(PluginType);
+            instance = serviceProvider.GetService(PluginType)
+                       ?? ActivatorUtilities.CreateInstance(serviceProvider, PluginType);
         }
         catch (Exception e)
         {
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index fe166929aa..4a0d531c1d 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -1,4 +1,7 @@
-using Grand.Infrastructure.Configuration;
+using Grand.Data.LiteDb;
+using Grand.Domain;
+using Grand.Infrastructure.Configuration;
+using Grand.Infrastructure.TypeSearch;
 using Grand.SharedKernel.Extensions;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.ApplicationParts;
@@ -32,6 +35,12 @@ public static class PluginManager
     private static ExtensionsConfig _config;
     private static ILogger _logger;
     private static Func<AssemblyLoadContext, AssemblyName, Assembly> _resolveDependency;
+    private static AssemblyLoadContext _resolveDependencyContext;
+
+    //what LoadForInstall needs to load a plugin as Load would have
+    private static AssemblyLoadContext _loadContext;
+    private static Func<FileInfo, FileInfo> _prepareFile;
+    private static bool _useLiteDb;
 
     #endregion
 
@@ -61,9 +70,18 @@ public static IReadOnlyList<PluginPendingChange> GetPendingChanges()
     /// </summary>
     [MethodImpl(MethodImplOptions.NoInlining)]
     public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration, IWebHostEnvironment hostEnvironment)
+    {
+        Load(mvcCoreBuilder, configuration, hostEnvironment, AssemblyLoadContext.Default);
+    }
+
+    /// <param name="loadContext">The context plugin assemblies are loaded into; tests pass a collectible one</param>
+    internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration,
+        IWebHostEnvironment hostEnvironment, AssemblyLoadContext loadContext)
     {
         _config = new ExtensionsConfig();
         configuration.GetSection("Extensions").Bind(_config);
+        var dbConfig = new DatabaseConfig();
+        configuration.GetSection("Database").Bind(dbConfig);
 
         lock (_synLock)
         {
@@ -127,7 +145,10 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
             var compatible = scan.Plugins
                 .Where(x => x.Manifest.SupportedVersion == GrandVersion.SupportedPluginVersion)
                 .ToList();
-            ResolveDependenciesFrom(compatible, prepareFile);
+            ResolveDependenciesFrom(compatible, loadContext, prepareFile);
+            _loadContext = loadContext;
+            _prepareFile = prepareFile;
+            _useLiteDb = dbConfig.UseLiteDb;
 
             foreach (var candidate in scan.Plugins)
             {
@@ -144,11 +165,20 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
 
                 var installed = installedPluginSystemNames.Contains(candidate.Manifest.SystemName,
                     StringComparer.OrdinalIgnoreCase);
-                var plugin = PluginLoader.Load(candidate, installed, AssemblyLoadContext.Default, prepareFile);
+                if (!installed)
+                {
+                    //listed from its manifest; nothing of it is loaded until it is installed (LoadForInstall)
+                    var listed = PluginLoader.Describe(candidate, false);
+                    listed.Candidate = candidate;
+                    referencedPlugins.Add(listed);
+                    continue;
+                }
+
+                var plugin = PluginLoader.Load(candidate, true, loadContext, prepareFile);
                 referencedPlugins.Add(plugin);
 
                 //controllers and views only for an installed plugin - an uninstalled one must not be routable
-                if (plugin.LoadError == null && plugin.Installed)
+                if (plugin.LoadError == null)
                 {
                     var error = AddApplicationPart(mvcCoreBuilder, plugin);
                     if (error != null)
@@ -166,9 +196,8 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
                     continue;
                 }
 
-                //register the plugin class - also when not installed, Install resolves it from DI
-                if (plugin.PluginType != null)
-                    mvcCoreBuilder.Services.AddScoped(plugin.PluginType);
+                //register the plugin class; one loaded later to be installed is created without DI
+                mvcCoreBuilder.Services.AddScoped(plugin.PluginType);
             }
 
             //after the loaded plugins: a lookup by a system name a second folder duplicates finds the working one
@@ -185,6 +214,48 @@ public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configura
         }
     }
 
+    /// <summary>
+    ///     Loads a plugin that was listed without being loaded (an uninstalled one), so it can be installed by the
+    ///     running process: into the context <see cref="Load" /> uses, with its LiteDB mappers built. Its startup
+    ///     classes, handlers and controllers are registered by the restart that follows the install, and until then
+    ///     it stays not installed, so it contributes no types to any scan.
+    ///     Does nothing for a plugin already loaded, failed or with nothing to load; safe from concurrent requests.
+    ///     Never throws because of the plugin: its fault becomes <see cref="PluginInfo.LoadError" />.
+    /// </summary>
+    public static PluginInfo LoadForInstall(PluginInfo plugin)
+    {
+        ArgumentNullException.ThrowIfNull(plugin);
+
+        lock (_synLock)
+        {
+            var candidate = plugin.Candidate;
+            if (plugin.ReferencedAssembly != null || plugin.LoadError != null || candidate == null ||
+                _loadContext == null)
+                return plugin;
+
+            _logger?.LogInformation("Loading plugin {PluginSystemName} to install it", plugin.SystemName);
+            var loaded = PluginLoader.Load(candidate, plugin.Installed, _loadContext, _prepareFile);
+            if (loaded.LoadError == null && _useLiteDb)
+                loaded.LoadError = WarmLiteDbMappers(loaded);
+
+            plugin.PluginFileName = loaded.PluginFileName;
+            plugin.AssemblyNames = loaded.AssemblyNames;
+            plugin.LoadError = loaded.LoadError;
+            plugin.Candidate = null;
+            if (loaded.LoadError != null)
+            {
+                _logger?.LogError("Plugin {PluginSystemName} could not be loaded: {LoadError}", plugin.SystemName,
+                    loaded.LoadError);
+                return plugin;
+            }
+
+            plugin.PluginType = loaded.PluginType;
+            //last: a request that sees the assembly skips the lock and reads the type
+            plugin.ReferencedAssembly = loaded.ReferencedAssembly;
+            return plugin;
+        }
+    }
+
     /// <summary>
     ///     Find a plugin by some type which is located into the same assembly plugin
     /// </summary>
@@ -242,7 +313,7 @@ private static HashSet<string> HostAssemblyNames()
     ///     When two plugins ship the same dependency only one copy is loaded (see <see cref="PluginFolderScanner" />).
     ///     The plugin whose copy was dropped finds the kept one here, also before the plugin shipping it is loaded.
     /// </summary>
-    private static void ResolveDependenciesFrom(IEnumerable<PluginCandidate> plugins,
+    private static void ResolveDependenciesFrom(IEnumerable<PluginCandidate> plugins, AssemblyLoadContext loadContext,
         Func<FileInfo, FileInfo> prepareFile)
     {
         var paths = plugins
@@ -251,13 +322,34 @@ private static void ResolveDependenciesFrom(IEnumerable<PluginCandidate> plugins
             .ToDictionary(x => x.Key, x => x.First(), StringComparer.OrdinalIgnoreCase);
 
         if (_resolveDependency != null)
-            AssemblyLoadContext.Default.Resolving -= _resolveDependency;
+            _resolveDependencyContext.Resolving -= _resolveDependency;
 
         _resolveDependency = (context, name) =>
             name.Name != null && paths.TryGetValue(name.Name, out var path)
                 ? context.LoadFromAssemblyPath(prepareFile(new FileInfo(path)).FullName)
                 : null;
-        AssemblyLoadContext.Default.Resolving += _resolveDependency;
+        _resolveDependencyContext = loadContext;
+        loadContext.Resolving += _resolveDependency;
+    }
+
+    /// <summary>
+    ///     LiteDB mappers are not safe to build while requests read them (see <see cref="LiteDBMapperWarmup" />);
+    ///     the plugin's entities are built before it is installed and used. Returns the error, if any.
+    /// </summary>
+    private static string WarmLiteDbMappers(PluginInfo plugin)
+    {
+        try
+        {
+            var assemblies = _loadContext.Assemblies
+                .Where(x => plugin.AssemblyNames.Contains(x.GetName().Name, StringComparer.OrdinalIgnoreCase))
+                .ToList();
+            LiteDBMapperWarmup.Warm(new TypeSearcher().ClassesOfType(typeof(BaseEntity), assemblies));
+            return null;
+        }
+        catch (Exception ex)
+        {
+            return ex.Message;
+        }
     }
 
     private static void DeleteDepsFiles(DirectoryInfo folder)
diff --git a/src/Core/Grand.Infrastructure/Startup/StartupApplication.cs b/src/Core/Grand.Infrastructure/Startup/StartupApplication.cs
index 277f1e0cc8..2a7d2351aa 100644
--- a/src/Core/Grand.Infrastructure/Startup/StartupApplication.cs
+++ b/src/Core/Grand.Infrastructure/Startup/StartupApplication.cs
@@ -5,7 +5,6 @@
 using Grand.Domain;
 using Grand.Infrastructure.Audit;
 using Grand.Infrastructure.Configuration;
-using Grand.Infrastructure.Plugins;
 using Grand.Infrastructure.TypeSearch;
 using LiteDB;
 using Microsoft.AspNetCore.Builder;
@@ -87,13 +86,9 @@ private void RegisterDataLayer(IServiceCollection serviceCollection, IConfigurat
         }
         else
         {
-            //the mappers are not safe to build concurrently - startup is still single-threaded here
-            var typeSearcher = new TypeSearcher();
-            //an uninstalled plugin counts too: installing it uses its entities on the running site
-            var plugins = PluginManager.ReferencedPlugins?.Where(x => x.PluginType != null)
-                .Select(x => x.ReferencedAssembly) ?? [];
-            LiteDBMapperWarmup.Warm(
-                typeSearcher.ClassesOfType(typeof(BaseEntity), typeSearcher.GetAssemblies().Union(plugins)));
+            //the mappers are not safe to build concurrently - startup is still single-threaded here; a plugin
+            //loaded later to be installed builds its own (PluginManager.LoadForInstall)
+            LiteDBMapperWarmup.Warm(new TypeSearcher().ClassesOfType(typeof(BaseEntity)));
             //database context
             serviceCollection.AddScoped<IDatabaseContext, LiteDBContext>();
             //store files context - grid fs
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
new file mode 100644
index 0000000000..aaa1047a7e
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
@@ -0,0 +1,208 @@
+using Grand.Domain;
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Grand.SharedKernel;
+using LiteDB;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using System.Collections;
+using System.Reflection;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+[DoNotParallelize]
+public class PluginManagerTests
+{
+    private static readonly string DomainAssemblyPath = typeof(BaseEntity).Assembly.Location;
+
+    private PluginFolderFixture _fixture;
+    private IEnumerable<PluginInfo> _referencedPlugins;
+    private PluginLoadSnapshot _loadSnapshot;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+        _referencedPlugins = PluginManager.ReferencedPlugins;
+        _loadSnapshot = PluginManager.LoadSnapshot;
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        PluginManager.ReferencedPlugins = _referencedPlugins;
+        PluginManager.LoadSnapshot = _loadSnapshot;
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    public void Load_UninstalledPlugin_IsListedButNotLoaded()
+    {
+        var main = _fixture.AddPlugin("Uninstalled", "Manager.Uninstalled", "Manager.Uninstalled",
+            "public class UninstalledPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(_fixture.Folder("Uninstalled"), "Manager.Uninstalled.Core", "public class Core { }");
+
+        Load();
+
+        var plugin = Plugin("Manager.Uninstalled");
+        Assert.IsFalse(plugin.Installed);
+        Assert.IsNull(plugin.LoadError);
+        Assert.IsNull(plugin.ReferencedAssembly);
+        Assert.IsNull(plugin.PluginType);
+        //the list and the logo come from the scan
+        Assert.AreEqual(main, plugin.OriginalAssemblyFile.FullName);
+        Assert.Contains("Manager.Uninstalled.Core", plugin.AssemblyNames);
+        Assert.IsFalse(IsLoaded("Manager.Uninstalled"));
+        Assert.IsFalse(IsLoaded("Manager.Uninstalled.Core"));
+    }
+
+    [TestMethod]
+    public void Load_InstalledPlugin_IsLoaded()
+    {
+        _fixture.AddPlugin("Installed", "Manager.Installed", "Manager.Installed",
+            "public class InstalledPlugin : BasePlugin { }");
+
+        Load("Manager.Installed");
+
+        var plugin = Plugin("Manager.Installed");
+        Assert.IsTrue(plugin.IsActive);
+        Assert.AreEqual("InstalledPlugin", plugin.PluginType.Name);
+        Assert.AreSame(_fixture.Loaded("Manager.Installed"), plugin.ReferencedAssembly);
+    }
+
+    [TestMethod]
+    public void Load_IncompatiblePlugin_IsListedButNotLoaded()
+    {
+        TestPluginBuilder.Compile(_fixture.Folder("Old"), "Manager.Old", """
+            using Grand.Infrastructure.Plugins;
+            [assembly: PluginInfo(SystemName = "Manager.Old", SupportedVersion = "1.0")]
+            public class OldPlugin : BasePlugin { }
+            """, null, PluginFolderFixture.CoreAssemblyPath);
+
+        Load("Manager.Old");
+
+        var plugin = Plugin("Manager.Old");
+        Assert.IsFalse(plugin.Installed);
+        Assert.IsNull(plugin.ReferencedAssembly);
+        Assert.IsNull(plugin.PluginType);
+        Assert.IsNotNull(plugin.OriginalAssemblyFile);
+        //nor on demand: a plugin built for another version is never installed
+        using var provider = new ServiceCollection().BuildServiceProvider();
+        Assert.ThrowsExactly<GrandException>(() => plugin.Instance<IPlugin>(provider));
+        Assert.IsFalse(IsLoaded("Manager.Old"));
+    }
+
+    [TestMethod]
+    public void Instance_UninstalledPlugin_LoadsOnDemandAndActivates()
+    {
+        _fixture.AddPlugin("OnDemand", "Manager.OnDemand", "Manager.OnDemand", """
+            public class OnDemandPlugin(System.IServiceProvider services) : BasePlugin
+            {
+                public System.IServiceProvider Services { get; } = services;
+            }
+            """);
+        Load();
+        var plugin = Plugin("Manager.OnDemand");
+
+        //an uninstalled plugin is not registered in DI
+        using var provider = new ServiceCollection().BuildServiceProvider();
+        var instance = plugin.Instance<IPlugin>(provider);
+
+        Assert.AreEqual("OnDemandPlugin", instance.GetType().Name);
+        Assert.AreSame(plugin, instance.PluginInfo);
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreSame(_fixture.Loaded("Manager.OnDemand"), plugin.ReferencedAssembly);
+        Assert.AreSame(instance.GetType(), plugin.PluginType);
+        //installed only after the restart: until then it contributes no types to any scan
+        Assert.IsFalse(plugin.Installed);
+        Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(plugin.ReferencedAssembly));
+    }
+
+    [TestMethod]
+    public void Instance_ConcurrentCalls_LoadThePluginOnce()
+    {
+        _fixture.AddPlugin("Concurrent", "Manager.Concurrent", "Manager.Concurrent",
+            "public class ConcurrentPlugin : BasePlugin { }");
+        Load();
+        var plugin = Plugin("Manager.Concurrent");
+        using var provider = new ServiceCollection().BuildServiceProvider();
+
+        var types = new Type[8];
+        Parallel.For(0, types.Length, i => types[i] = plugin.Instance<IPlugin>(provider).GetType());
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreEqual(1, types.Distinct().Count());
+        Assert.HasCount(1, _fixture.Context.Assemblies.Where(x => x.GetName().Name == "Manager.Concurrent"));
+    }
+
+    [TestMethod]
+    public void Instance_UninstalledPluginThatCannotLoad_KeepsLoadErrorAndThrows()
+    {
+        var missing = _fixture.CompileElsewhere("Manager.MissingDep", "namespace Missing { public class Base { } }");
+        _fixture.AddPlugin("Broken", "Manager.Broken", "Manager.Broken", """
+            public class Derived : Missing.Base { }
+            public class BrokenPlugin : BasePlugin { }
+            """, missing);
+        Load();
+        var plugin = Plugin("Manager.Broken");
+        using var provider = new ServiceCollection().BuildServiceProvider();
+
+        var ex = Assert.ThrowsExactly<GrandException>(() => plugin.Instance<IPlugin>(provider));
+
+        Assert.IsNotNull(plugin.LoadError);
+        Assert.Contains("Manager.MissingDep", plugin.LoadError);
+        Assert.Contains(plugin.LoadError, ex.Message);
+        Assert.IsNull(plugin.PluginType);
+        Assert.IsNull(plugin.ReferencedAssembly);
+    }
+
+    [TestMethod]
+    public void Instance_OnLiteDb_BuildsTheMappersOfThePluginLoadedOnDemand()
+    {
+        //installing a plugin uses its entities on the running site, among requests reading the same mappers
+        _fixture.AddPlugin("Lite", "Manager.Lite", "Manager.Lite", """
+            public class LitePluginEntity : Grand.Domain.BaseEntity { }
+            public class LitePlugin : BasePlugin { }
+            """, DomainAssemblyPath);
+        Load(useLiteDb: true);
+        var plugin = Plugin("Manager.Lite");
+        Assert.DoesNotContain("LitePluginEntity", MappedTypeNames());
+        using var provider = new ServiceCollection().BuildServiceProvider();
+
+        plugin.Instance<IPlugin>(provider);
+
+        Assert.Contains("LitePluginEntity", MappedTypeNames());
+    }
+
+    private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = false)
+    {
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string> {
+                ["Extensions:InstalledPlugins"] = installed,
+                ["Database:UseLiteDb"] = useLiteDb.ToString()
+            })
+            .Build();
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(Path.GetDirectoryName(_fixture.PluginsFolder)!);
+        var mvcCoreBuilder = new ServiceCollection().AddLogging().AddMvcCore();
+
+        PluginManager.Load(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.Context);
+    }
+
+    private static PluginInfo Plugin(string systemName) =>
+        PluginManager.ReferencedPlugins.Single(x => x.SystemName == systemName);
+
+    private static bool IsLoaded(string assemblyName) =>
+        AssemblyLoadContext.All.SelectMany(x => x.Assemblies).Any(x => x.GetName().Name == assemblyName);
+
+    private static List<string> MappedTypeNames()
+    {
+        var entities = typeof(BsonMapper).GetField("_entities", BindingFlags.NonPublic | BindingFlags.Instance)!;
+        return ((IDictionary)entities.GetValue(BsonMapper.Global)!).Keys.Cast<Type>().Select(x => x.Name).ToList();
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Startup/StartupApplicationTests.cs b/src/Tests/Grand.Infrastructure.Tests/Startup/StartupApplicationTests.cs
index 9cae2e28b9..7971d2a6e7 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Startup/StartupApplicationTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Startup/StartupApplicationTests.cs
@@ -17,9 +17,9 @@ public class StartupApplicationTests
 {
     [TestMethod]
     [DoNotParallelize]
-    public void ConfigureServices_OnLiteDb_BuildsTheMappersOfAnUninstalledPlugin()
+    public void ConfigureServices_OnLiteDb_BuildsTheMappersOfAnInstalledPlugin()
     {
-        //installing a plugin uses its entities on the running site, among requests reading the same mappers
+        //an uninstalled plugin is not loaded at startup; LoadForInstall builds its mappers (PluginManagerTests)
         DataSettingsManager.Initialize(Path.Combine(Path.GetTempPath(), $"{Guid.NewGuid()}.cfg"));
         var referencedPlugins = PluginManager.ReferencedPlugins;
         try
@@ -27,7 +27,7 @@ public void ConfigureServices_OnLiteDb_BuildsTheMappersOfAnUninstalledPlugin()
             PluginManager.ReferencedPlugins = [
                 new PluginInfo(null, typeof(SampleBasePlugin).Assembly, typeof(SampleBasePlugin)) {
                     SystemName = "SamplePlugin",
-                    Installed = false
+                    Installed = true
                 }
             ];
             var configuration = new ConfigurationBuilder()
diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
index 5105308350..1e82278ccf 100644
--- a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
+++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
@@ -316,15 +316,16 @@ private List<string> Notifications(string type)
     }
 
     /// <summary>
-    ///     An installed plugin as loading leaves one that failed: without a plugin type, so no instance can be
-    ///     created (LoadError itself can only be set by the loader)
+    ///     An installed plugin as loading leaves one that failed: with its load error and without a plugin type,
+    ///     so no instance can be created
     /// </summary>
     private static PluginInfo BrokenPlugin(FileInfo mainAssembly)
     {
         return new PluginInfo(mainAssembly, null, null) {
             SystemName = SystemName,
             SupportedVersion = GrandVersion.SupportedPluginVersion,
-            Installed = true
+            Installed = true,
+            LoadError = "Could not load file or assembly 'Tests.Plugin.Dependency'."
         };
     }
 
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index f9826dc583..6183f16ec9 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -39,7 +39,8 @@ protected virtual PluginModel PreparePluginModel(PluginInfo PluginInfo)
         //logo
         pluginModel.LogoUrl = PluginInfo.GetLogoUrl(Request.PathBase);
 
-        //configuration URLs - a plugin that failed to load has no instance, its LoadError is shown instead
+        //configuration URLs only for an active plugin, which was loaded at startup: listing never loads one,
+        //and a plugin that failed to load has no instance - its LoadError is shown instead
         if (PluginInfo.IsActive)
         {
             var pluginInstance = PluginInfo.Instance(serviceProvider);
@@ -232,9 +233,11 @@ public async Task<IActionResult> Uninstall(string systemName)
             if (!IsInstalled(pluginInfo, pending))
                 return RedirectToAction("List");
 
-            //a plugin that failed to load has no instance to clean up after itself: it is only marked
-            //uninstalled, so it can be removed
-            if (pluginInfo.LoadError != null || pluginInfo.PluginType == null)
+            //a plugin that cannot be loaded has no instance to clean up after itself: it is only marked
+            //uninstalled, so it can be removed. An installed plugin was loaded at startup, one installed since
+            //then by its install; loading here only covers one that is still listed without being loaded
+            PluginManager.LoadForInstall(pluginInfo);
+            if (pluginInfo.LoadError != null)
             {
                 await Grand.Infrastructure.Plugins.PluginExtensions.MarkPluginAsUninstalled(pluginInfo.SystemName);
                 //it never ran: the list shows it uninstalled, and removable, right away

From def6af519524262a547a35527ae6aba4368f55f0 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 07:06:47 +0100
Subject: [PATCH 13/30] State the LiteDB mapper race accepted when a plugin is
 installed without a restart

---
 src/Core/Grand.Infrastructure/Plugins/PluginManager.cs | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index 4a0d531c1d..ed507046bb 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -235,6 +235,10 @@ public static PluginInfo LoadForInstall(PluginInfo plugin)
 
             _logger?.LogInformation("Loading plugin {PluginSystemName} to install it", plugin.SystemName);
             var loaded = PluginLoader.Load(candidate, plugin.Installed, _loadContext, _prepareFile);
+            //warming here races with concurrent LiteDB reads: every entity mapper lives in one shared
+            //BsonMapper.Global dictionary, read without a lock, so a request reading any type while these few
+            //inserts run can fail. Accepted: the window is a few inserts during an admin-initiated install, and
+            //the alternative is a restart before Install. On MongoDB none of this applies.
             if (loaded.LoadError == null && _useLiteDb)
                 loaded.LoadError = WarmLiteDbMappers(loaded);
 
@@ -333,8 +337,9 @@ private static void ResolveDependenciesFrom(IEnumerable<PluginCandidate> plugins
     }
 
     /// <summary>
-    ///     LiteDB mappers are not safe to build while requests read them (see <see cref="LiteDBMapperWarmup" />);
-    ///     the plugin's entities are built before it is installed and used. Returns the error, if any.
+    ///     Builds the mappers of the plugin's entities before its install uses them. LiteDB mappers are not safe to
+    ///     build while requests read them (see <see cref="LiteDBMapperWarmup" />), and requests are running here:
+    ///     see the accepted race at the call site. Returns the error, if any.
     /// </summary>
     private static string WarmLiteDbMappers(PluginInfo plugin)
     {

From 969aa0084a0a883ec7a566bb157d421d4b6704e8 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 07:38:37 +0100
Subject: [PATCH 14/30] Load each plugin into its own context with its own
 dependencies

---
 src/Build/Grand.Plugin.props                  |   4 +-
 .../Configuration/ExtensionsConfig.cs         |   3 +-
 .../Grand.Infrastructure.csproj               |   1 +
 .../Plugins/IsolatedLoadContext.cs            |  69 ++++++
 .../Plugins/PluginExtensions.cs               |  12 +-
 .../Plugins/PluginFolderScanner.cs            |  72 +-----
 .../Plugins/PluginInfo.cs                     |   7 +
 .../Plugins/PluginLoader.cs                   |  59 +++--
 .../Plugins/PluginManager.cs                  | 229 ++++++++----------
 .../Plugins/Fixtures/PluginFolderFixture.cs   |  53 +++-
 .../Plugins/IsolatedLoadContextTests.cs       | 200 +++++++++++++++
 .../Plugins/PluginExtensionsTests.cs          |  30 ++-
 .../Plugins/PluginFolderScannerTests.cs       |  10 +-
 .../Plugins/PluginManagerTests.cs             |  89 ++++++-
 .../PluginLoadContextApplicationPartsTests.cs |  63 +++++
 15 files changed, 657 insertions(+), 244 deletions(-)
 create mode 100644 src/Core/Grand.Infrastructure/Plugins/IsolatedLoadContext.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs
 create mode 100644 src/Tests/Grand.Web.Common.Tests/Infrastructure/PluginLoadContextApplicationPartsTests.cs

diff --git a/src/Build/Grand.Plugin.props b/src/Build/Grand.Plugin.props
index 9e69bf410a..52740231eb 100644
--- a/src/Build/Grand.Plugin.props
+++ b/src/Build/Grand.Plugin.props
@@ -18,8 +18,8 @@
     <!--
         The host assemblies every plugin compiles against.
 
-        Private=false keeps them out of the plugin's output folder: the plugin is loaded
-        into the host's AssemblyLoadContext, which already has them, and a second copy of
+        Private=false keeps them out of the plugin's output folder: the plugin's own load
+        context takes them from the host's, which already has them, and a second copy of
         a host assembly beside a plugin is a hazard - if that copy is ever the one loaded,
         its types are not the host's types and DI resolution fails in ways that are hard
         to trace.
diff --git a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
index c4af49daf9..b47bb2d956 100644
--- a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
+++ b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
@@ -11,7 +11,8 @@ public class ExtensionsConfig
     public bool DisableUploadExtensions { get; set; }
 
     /// <summary>
-    ///     Gets or sets a value indicating whether copy dll plugin files to /Plugins/bin on application startup
+    ///     Gets or sets a value indicating whether each installed plugin's folder is copied to /Plugins/bin/{folder}
+    ///     on application startup and loaded from there
     /// </summary>
     public bool PluginShadowCopy { get; set; }
 
diff --git a/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj b/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
index 6a17cb52b0..545bdd1b0b 100644
--- a/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
+++ b/src/Core/Grand.Infrastructure/Grand.Infrastructure.csproj
@@ -25,5 +25,6 @@
   <ItemGroup>
     <InternalsVisibleTo Include="Grand.Infrastructure.Tests" />
     <InternalsVisibleTo Include="Grand.Web.Admin.Tests" />
+    <InternalsVisibleTo Include="Grand.Web.Common.Tests" />
   </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/src/Core/Grand.Infrastructure/Plugins/IsolatedLoadContext.cs b/src/Core/Grand.Infrastructure/Plugins/IsolatedLoadContext.cs
new file mode 100644
index 0000000000..29465594cd
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/Plugins/IsolatedLoadContext.cs
@@ -0,0 +1,69 @@
+using System.Reflection;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Plugins;
+
+/// <summary>
+///     The load context of one extension (a plugin or a module). It resolves the extension's own dependencies
+///     from its deps.json, or from its folder, and takes every assembly the application provides from the
+///     default context, so the extension shares the host's types while its private libraries, in whatever
+///     version it ships them, stay its own.
+/// </summary>
+/// <remarks>Not collectible: an extension stays loaded until the application stops.</remarks>
+public sealed class IsolatedLoadContext : AssemblyLoadContext
+{
+    private readonly AssemblyDependencyResolver _resolver;
+    private readonly string _folder;
+    private readonly ISet<string> _hostAssemblyNames;
+
+    /// <param name="name">The context's name, for diagnostics</param>
+    /// <param name="mainAssemblyPath">The extension's main assembly; its deps.json, if any, sits beside it</param>
+    /// <param name="hostAssemblyNames">Simple names of the assemblies the application provides</param>
+    /// <exception cref="InvalidOperationException">The extension's deps.json cannot be resolved</exception>
+    public IsolatedLoadContext(string name, string mainAssemblyPath, ISet<string> hostAssemblyNames)
+        : this(name, mainAssemblyPath, hostAssemblyNames, false)
+    {
+    }
+
+    /// <param name="isCollectible">Tests only: lets a test unload what it loaded</param>
+    internal IsolatedLoadContext(string name, string mainAssemblyPath, ISet<string> hostAssemblyNames,
+        bool isCollectible) : base(name, isCollectible)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(mainAssemblyPath);
+        ArgumentNullException.ThrowIfNull(hostAssemblyNames);
+
+        _resolver = new AssemblyDependencyResolver(mainAssemblyPath);
+        _folder = Path.GetDirectoryName(Path.GetFullPath(mainAssemblyPath));
+        _hostAssemblyNames = hostAssemblyNames;
+    }
+
+    /// <summary>
+    ///     Null hands the name to the default context: an assembly the application provides, or one it has
+    ///     already loaded, is never loaded a second time.
+    /// </summary>
+    protected override Assembly Load(AssemblyName assemblyName)
+    {
+        var name = assemblyName.Name;
+        if (string.IsNullOrEmpty(name) || _hostAssemblyNames.Contains(name) || IsLoadedInDefault(name))
+            return null;
+
+        var path = _resolver.ResolveAssemblyToPath(assemblyName);
+        if (path != null)
+            return LoadFromAssemblyPath(path);
+
+        //a dll that sits in the folder without being listed in deps.json (or there is no deps.json)
+        var local = Path.Combine(_folder, name + ".dll");
+        return File.Exists(local) ? LoadFromAssemblyPath(local) : null;
+    }
+
+    protected override IntPtr LoadUnmanagedDll(string unmanagedDllName)
+    {
+        var path = _resolver.ResolveUnmanagedDllToPath(unmanagedDllName);
+        return path != null ? LoadUnmanagedDllFromPath(path) : IntPtr.Zero;
+    }
+
+    private static bool IsLoadedInDefault(string name)
+    {
+        return Default.Assemblies.Any(x => string.Equals(x.GetName().Name, name, StringComparison.OrdinalIgnoreCase));
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs b/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
index 245d208cb0..c984e14044 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginExtensions.cs
@@ -43,15 +43,21 @@ public static bool OnlyInstalledPlugins(Type type)
     /// <summary>
     ///     Whether the assembly may contribute types: true unless it belongs only to plugins that are not
     ///     active (not installed, or failed to load). Any assembly of a plugin counts, not only the one
-    ///     carrying <see cref="PluginInfoAttribute" />; a dependency several plugins ship counts while one
-    ///     of them is active.
+    ///     carrying <see cref="PluginInfoAttribute" />. An assembly in a plugin's own load context belongs to that
+    ///     plugin alone; one outside every plugin's context, matched by name, counts while any plugin shipping
+    ///     that name is active.
     /// </summary>
     public static bool OnlyInstalledPlugins(Assembly assembly)
     {
         ArgumentNullException.ThrowIfNull(assembly);
 
+        var plugins = PluginManager.ReferencedPlugins?.ToList();
+        var owner = PluginManager.OwnerOf(assembly, plugins);
+        if (owner != null)
+            return owner.IsActive;
+
         var name = assembly.GetName().Name;
-        var owners = PluginManager.ReferencedPlugins?
+        var owners = plugins?
             .Where(x => x.AssemblyNames.Contains(name, StringComparer.OrdinalIgnoreCase))
             .ToList();
 
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
index 4a83a0c1bc..b0000a8ec4 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
@@ -1,4 +1,3 @@
-using System.Diagnostics;
 using System.Reflection;
 using System.Text.RegularExpressions;
 
@@ -8,11 +7,11 @@ namespace Grand.Infrastructure.Plugins;
 ///     A plugin folder that can be loaded.
 /// </summary>
 /// <param name="MainAssemblyPath">The assembly carrying <see cref="PluginInfoAttribute" /></param>
-/// <param name="AssemblyPaths">The files to load, after the higher-version dependency rule was applied</param>
-/// <param name="AssemblyNames">
-///     Simple names of every managed, non-host dll in the folder, including a dependency whose copy was
-///     dropped in favour of another folder's higher version
+/// <param name="AssemblyPaths">
+///     Every managed, non-host dll at the top of the folder; the plugin loads them, in its own context, whatever
+///     other plugins ship
 /// </param>
+/// <param name="AssemblyNames">Simple names of the assemblies in <paramref name="AssemblyPaths" /></param>
 public sealed record PluginCandidate(
     DirectoryInfo Folder,
     string MainAssemblyPath,
@@ -47,8 +46,7 @@ public static class PluginFolderScanner
 {
     private static readonly string[] IgnoredFolders = ["bin", "TempUploads"];
 
-    private sealed record ScannedFile(string Path, string Name, Version AssemblyVersion, Version FileVersion,
-        PluginManifest Manifest);
+    private sealed record ScannedFile(string Path, string Name, PluginManifest Manifest);
 
     /// <summary>
     ///     Never throws because of one folder or file: what cannot be read becomes a problem of its folder.
@@ -57,7 +55,7 @@ public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPatt
     {
         var problems = new List<PluginLoadProblem>();
         var warnings = new List<string>();
-        var plugins = new List<(PluginCandidate Candidate, List<ScannedFile> Files)>();
+        var plugins = new List<PluginCandidate>();
         var systemNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
 
         if (!pluginsFolder.Exists)
@@ -112,13 +110,12 @@ public static PluginScanResult Scan(DirectoryInfo pluginsFolder, string skipPatt
                 continue;
             }
 
-            var candidate = new PluginCandidate(folder, main.Path, manifest,
+            plugins.Add(new PluginCandidate(folder, main.Path, manifest,
                 files.Select(x => x.Path).ToList(),
-                new HashSet<string>(files.Select(x => x.Name), StringComparer.OrdinalIgnoreCase));
-            plugins.Add((candidate, files));
+                new HashSet<string>(files.Select(x => x.Name), StringComparer.OrdinalIgnoreCase)));
         }
 
-        return new PluginScanResult(DropLowerVersions(plugins, warnings), problems, warnings);
+        return new PluginScanResult(plugins, problems, warnings);
     }
 
     /// <summary>
@@ -185,8 +182,7 @@ private static ScannedFile ScanFile(DirectoryInfo folder, FileInfo file, ISet<st
             return null;
         }
 
-        return new ScannedFile(file.FullName, assemblyName.Name!, assemblyName.Version ?? new Version(),
-            ParseFileVersion(file.FullName), PluginManifestReader.Read(file.FullName));
+        return new ScannedFile(file.FullName, assemblyName.Name!, PluginManifestReader.Read(file.FullName));
     }
 
     /// <summary>
@@ -201,54 +197,6 @@ internal static bool IsReadFailure(Exception ex) =>
     internal static bool IsSkipped(string fileName, string skipPattern) =>
         !string.IsNullOrEmpty(skipPattern) && Matches(fileName, skipPattern);
 
-    /// <summary>
-    ///     When two plugins ship the same dependency only the higher version is loaded, so one load
-    ///     context never sees two copies of it. A plugin's own main assembly is never dropped. A plugin
-    ///     built for another version is never loaded, so its copies take no part.
-    /// </summary>
-    private static List<PluginCandidate> DropLowerVersions(
-        List<(PluginCandidate Candidate, List<ScannedFile> Files)> plugins, List<string> warnings)
-    {
-        var dropped = new Dictionary<PluginCandidate, HashSet<string>>();
-
-        var groups = plugins
-            .Where(p => p.Candidate.Manifest.SupportedVersion == GrandVersion.SupportedPluginVersion)
-            .SelectMany(p => p.Files.Select(f => (p.Candidate, File: f)))
-            .Where(x => !string.Equals(x.File.Path, x.Candidate.MainAssemblyPath, StringComparison.OrdinalIgnoreCase))
-            .GroupBy(x => x.File.Name, StringComparer.OrdinalIgnoreCase)
-            .Where(g => g.Select(x => x.Candidate).Distinct().Count() > 1);
-
-        foreach (var group in groups)
-        {
-            var winner = group
-                .OrderByDescending(x => x.File.AssemblyVersion)
-                .ThenByDescending(x => x.File.FileVersion)
-                .First();
-
-            foreach (var loser in group.Where(x => x != winner))
-            {
-                if (!dropped.TryGetValue(loser.Candidate, out var paths))
-                    dropped[loser.Candidate] = paths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
-                paths.Add(loser.File.Path);
-
-                warnings.Add(
-                    $"'{group.Key}' is shipped by '{winner.Candidate.Folder.Name}' ({winner.File.AssemblyVersion}) and '{loser.Candidate.Folder.Name}' ({loser.File.AssemblyVersion}); only the higher version is loaded.");
-            }
-        }
-
-        return plugins
-            .Select(p => dropped.TryGetValue(p.Candidate, out var paths)
-                ? p.Candidate with { AssemblyPaths = p.Candidate.AssemblyPaths.Where(x => !paths.Contains(x)).ToList() }
-                : p.Candidate)
-            .ToList();
-    }
-
-    private static Version ParseFileVersion(string path)
-    {
-        var info = FileVersionInfo.GetVersionInfo(path);
-        return new Version(info.FileMajorPart, info.FileMinorPart, info.FileBuildPart, info.FilePrivatePart);
-    }
-
     private static bool Matches(string fileName, string pattern)
     {
         return Regex.IsMatch(fileName, pattern, RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
index ea28329571..b1ba2b62cb 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
@@ -1,6 +1,7 @@
 using Grand.SharedKernel;
 using Microsoft.Extensions.DependencyInjection;
 using System.Reflection;
+using System.Runtime.Loader;
 
 namespace Grand.Infrastructure.Plugins;
 
@@ -55,6 +56,12 @@ public Assembly ReferencedAssembly
     /// </summary>
     internal PluginCandidate Candidate { get; set; }
 
+    /// <summary>
+    ///     The plugin's own load context, once loading it began; it holds the plugin's assemblies, also those of
+    ///     a plugin that failed to load. Null for a plugin that was not loaded.
+    /// </summary>
+    internal AssemblyLoadContext LoadContext { get; set; }
+
     /// <summary>
     ///     The original assembly file that a shadow copy was made from it
     /// </summary>
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
index aecd118e6d..e66d9ecb90 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
@@ -13,36 +13,42 @@ public static class PluginLoader
     public const string NoPluginClassError = "has no IPlugin class";
 
     /// <summary>
-    ///     Loads the candidate's assemblies into <paramref name="context" /> and finds its plugin class.
+    ///     Loads the candidate's assemblies into a load context of its own and finds its plugin class.
     /// </summary>
-    /// <param name="prepareFile">The shadow-copy step; the file to load in place of the given one</param>
+    /// <param name="createContext">
+    ///     Creates the plugin's context for the main assembly at the given path (in the prepared folder)
+    /// </param>
+    /// <param name="prepareFolder">The shadow-copy step; the folder to load the plugin from in place of its own</param>
     /// <returns>
     ///     The plugin. When <see cref="PluginInfo.LoadError" /> is set, <see cref="PluginInfo.PluginType" /> and
     ///     <see cref="PluginInfo.ReferencedAssembly" /> are null.
     /// </returns>
-    public static PluginInfo Load(PluginCandidate candidate, bool installed, AssemblyLoadContext context,
-        Func<FileInfo, FileInfo> prepareFile)
+    public static PluginInfo Load(PluginCandidate candidate, bool installed,
+        Func<string, AssemblyLoadContext> createContext, Func<PluginCandidate, DirectoryInfo> prepareFolder)
     {
         ArgumentNullException.ThrowIfNull(candidate);
-        ArgumentNullException.ThrowIfNull(context);
-        ArgumentNullException.ThrowIfNull(prepareFile);
+        ArgumentNullException.ThrowIfNull(createContext);
+        ArgumentNullException.ThrowIfNull(prepareFolder);
 
         var plugin = Describe(candidate, installed);
         try
         {
-            Assembly main = null;
-            var assemblies = new List<Assembly>();
-            foreach (var path in candidate.AssemblyPaths)
-            {
-                var file = prepareFile(new FileInfo(path));
-                var assembly = LoadFromPath(context, file.FullName);
-                assemblies.Add(assembly);
-                if (!string.Equals(path, candidate.MainAssemblyPath, StringComparison.OrdinalIgnoreCase))
-                    continue;
-
-                main = assembly;
-                plugin.PluginFileName = file.Name;
-            }
+            var folder = prepareFolder(candidate);
+            string Prepared(string path) =>
+                Path.Combine(folder.FullName, Path.GetRelativePath(candidate.Folder.FullName, path));
+
+            var mainPath = Prepared(candidate.MainAssemblyPath);
+            var context = createContext(mainPath);
+            plugin.LoadContext = context;
+
+            var main = context.LoadFromAssemblyPath(mainPath);
+            plugin.PluginFileName = Path.GetFileName(mainPath);
+
+            //the others by name, so the context resolves each as it would for a reference (deps.json first)
+            var assemblies = new List<Assembly> { main };
+            foreach (var path in candidate.AssemblyPaths.Where(x =>
+                         !string.Equals(x, candidate.MainAssemblyPath, StringComparison.OrdinalIgnoreCase)))
+                assemblies.Add(context.LoadFromAssemblyName(AssemblyName.GetAssemblyName(Prepared(path))));
 
             //every assembly is loaded before any type is resolved, so the order of the files does not matter
             Type pluginType = null;
@@ -66,8 +72,8 @@ public static PluginInfo Load(PluginCandidate candidate, bool installed, Assembl
         }
         catch (Exception ex)
         {
-            //FileLoadException, FileNotFoundException, BadImageFormatException and whatever else a plugin's
-            //files can cause; the plugin is reported, the application goes on
+            //FileLoadException, FileNotFoundException, BadImageFormatException, an unresolvable deps.json and
+            //whatever else a plugin's files can cause; the plugin is reported, the application goes on
             return Failed(plugin, ex.Message);
         }
     }
@@ -142,17 +148,6 @@ public static void ThrowOnLoadError(IEnumerable<PluginInfo> plugins, IEnumerable
                 $"The plugin folder '{unidentified.Folder}' could not be loaded: {unidentified.Message}");
     }
 
-    /// <summary>
-    ///     A file already loaded into the context (it resolved as another plugin's dependency) is reused;
-    ///     loading it again would fail with "Assembly with same name is already loaded".
-    /// </summary>
-    private static Assembly LoadFromPath(AssemblyLoadContext context, string path)
-    {
-        var loaded = context.Assemblies.FirstOrDefault(x =>
-            string.Equals(x.Location, path, StringComparison.OrdinalIgnoreCase));
-        return loaded ?? context.LoadFromAssemblyPath(path);
-    }
-
     private static bool IsPluginClass(Type type)
     {
         return typeof(IPlugin).IsAssignableFrom(type) && type.IsClass && !type.IsAbstract;
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index ed507046bb..512326a9c3 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -8,7 +8,6 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
-using System.Collections.Concurrent;
 using System.Reflection;
 using System.Runtime.CompilerServices;
 using System.Runtime.Loader;
@@ -34,12 +33,11 @@ public static class PluginManager
     private static DirectoryInfo _pluginFolder;
     private static ExtensionsConfig _config;
     private static ILogger _logger;
-    private static Func<AssemblyLoadContext, AssemblyName, Assembly> _resolveDependency;
-    private static AssemblyLoadContext _resolveDependencyContext;
 
     //what LoadForInstall needs to load a plugin as Load would have
-    private static AssemblyLoadContext _loadContext;
-    private static Func<FileInfo, FileInfo> _prepareFile;
+    private static Func<string, string, ISet<string>, AssemblyLoadContext> _createContext;
+    private static ISet<string> _hostAssemblyNames;
+    private static Func<PluginCandidate, DirectoryInfo> _prepareFolder;
     private static bool _useLiteDb;
 
     #endregion
@@ -71,12 +69,17 @@ public static IReadOnlyList<PluginPendingChange> GetPendingChanges()
     [MethodImpl(MethodImplOptions.NoInlining)]
     public static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration, IWebHostEnvironment hostEnvironment)
     {
-        Load(mvcCoreBuilder, configuration, hostEnvironment, AssemblyLoadContext.Default);
+        Load(mvcCoreBuilder, configuration, hostEnvironment,
+            (name, mainAssemblyPath, hostAssemblyNames) =>
+                new IsolatedLoadContext(name, mainAssemblyPath, hostAssemblyNames));
     }
 
-    /// <param name="loadContext">The context plugin assemblies are loaded into; tests pass a collectible one</param>
+    /// <param name="createContext">
+    ///     Creates a plugin's own context from its name, main assembly path and the host assembly names; tests
+    ///     create collectible ones
+    /// </param>
     internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration,
-        IWebHostEnvironment hostEnvironment, AssemblyLoadContext loadContext)
+        IWebHostEnvironment hostEnvironment, Func<string, string, ISet<string>, AssemblyLoadContext> createContext)
     {
         _config = new ExtensionsConfig();
         configuration.GetSection("Extensions").Bind(_config);
@@ -102,10 +105,10 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
             _logger.LogInformation("Creating shadow copy folder and querying for dlls");
             Directory.CreateDirectory(_pluginFolder.FullName);
             Directory.CreateDirectory(_copyFolder.FullName);
-            var binFiles = _copyFolder.GetFiles("*", SearchOption.AllDirectories);
             if (_config.PluginShadowCopy)
-                //clear out shadow plugins
-                foreach (var f in binFiles)
+                //clear out the files of the flat layout older versions shadow copied to; each plugin's own
+                //folder below is kept, and its unchanged files are not copied again
+                foreach (var f in _copyFolder.GetFiles("*", SearchOption.TopDirectoryOnly))
                 {
                     _logger.LogInformation("Deleting {FName}", f.Name);
                     try
@@ -123,7 +126,8 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
                 }
 
             //plan from metadata first: nothing is loaded for a folder that cannot be loaded
-            var scan = PluginFolderScanner.Scan(_pluginFolder, _config.PluginSkipLoadingPattern, HostAssemblyNames());
+            var hostAssemblyNames = HostAssemblyNames();
+            var scan = PluginFolderScanner.Scan(_pluginFolder, _config.PluginSkipLoadingPattern, hostAssemblyNames);
             foreach (var warning in scan.Warnings)
                 _logger.LogWarning("{PluginWarning}", warning);
 
@@ -134,20 +138,9 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
 
             var referencedPlugins = new List<PluginInfo>();
 
-            //a dependency can be asked for twice (resolved for one plugin, then loaded by the one shipping it);
-            //it is copied once
-            var shadowCopies = new ConcurrentDictionary<string, FileInfo>(StringComparer.OrdinalIgnoreCase);
-            Func<FileInfo, FileInfo> prepareFile = _config.PluginShadowCopy
-                ? file => shadowCopies.GetOrAdd(file.FullName,
-                    _ => ShadowCopyFile(file, Directory.CreateDirectory(_copyFolder.FullName)))
-                : file => file;
-
-            var compatible = scan.Plugins
-                .Where(x => x.Manifest.SupportedVersion == GrandVersion.SupportedPluginVersion)
-                .ToList();
-            ResolveDependenciesFrom(compatible, loadContext, prepareFile);
-            _loadContext = loadContext;
-            _prepareFile = prepareFile;
+            _createContext = createContext;
+            _hostAssemblyNames = hostAssemblyNames;
+            _prepareFolder = _config.PluginShadowCopy ? ShadowCopyFolder : candidate => candidate.Folder;
             _useLiteDb = dbConfig.UseLiteDb;
 
             foreach (var candidate in scan.Plugins)
@@ -160,9 +153,6 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
                     continue;
                 }
 
-                if (!_config.PluginShadowCopy)
-                    DeleteDepsFiles(candidate.Folder);
-
                 var installed = installedPluginSystemNames.Contains(candidate.Manifest.SystemName,
                     StringComparer.OrdinalIgnoreCase);
                 if (!installed)
@@ -174,7 +164,7 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
                     continue;
                 }
 
-                var plugin = PluginLoader.Load(candidate, true, loadContext, prepareFile);
+                var plugin = PluginLoader.Load(candidate, true, ContextFactory(candidate), _prepareFolder);
                 referencedPlugins.Add(plugin);
 
                 //controllers and views only for an installed plugin - an uninstalled one must not be routable
@@ -216,9 +206,9 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
 
     /// <summary>
     ///     Loads a plugin that was listed without being loaded (an uninstalled one), so it can be installed by the
-    ///     running process: into the context <see cref="Load" /> uses, with its LiteDB mappers built. Its startup
-    ///     classes, handlers and controllers are registered by the restart that follows the install, and until then
-    ///     it stays not installed, so it contributes no types to any scan.
+    ///     running process: into a context of its own, as <see cref="Load" /> would, with its LiteDB mappers built.
+    ///     Its startup classes, handlers and controllers are registered by the restart that follows the install, and
+    ///     until then it stays not installed, so it contributes no types to any scan.
     ///     Does nothing for a plugin already loaded, failed or with nothing to load; safe from concurrent requests.
     ///     Never throws because of the plugin: its fault becomes <see cref="PluginInfo.LoadError" />.
     /// </summary>
@@ -230,11 +220,11 @@ public static PluginInfo LoadForInstall(PluginInfo plugin)
         {
             var candidate = plugin.Candidate;
             if (plugin.ReferencedAssembly != null || plugin.LoadError != null || candidate == null ||
-                _loadContext == null)
+                _createContext == null)
                 return plugin;
 
             _logger?.LogInformation("Loading plugin {PluginSystemName} to install it", plugin.SystemName);
-            var loaded = PluginLoader.Load(candidate, plugin.Installed, _loadContext, _prepareFile);
+            var loaded = PluginLoader.Load(candidate, plugin.Installed, ContextFactory(candidate), _prepareFolder);
             //warming here races with concurrent LiteDB reads: every entity mapper lives in one shared
             //BsonMapper.Global dictionary, read without a lock, so a request reading any type while these few
             //inserts run can fail. Accepted: the window is a few inserts during an admin-initiated install, and
@@ -244,6 +234,7 @@ public static PluginInfo LoadForInstall(PluginInfo plugin)
 
             plugin.PluginFileName = loaded.PluginFileName;
             plugin.AssemblyNames = loaded.AssemblyNames;
+            plugin.LoadContext = loaded.LoadContext;
             plugin.LoadError = loaded.LoadError;
             plugin.Candidate = null;
             if (loaded.LoadError != null)
@@ -273,7 +264,8 @@ public static PluginInfo FindPlugin(Type typeAssembly)
     }
 
     /// <summary>
-    ///     Find the plugin an assembly belongs to
+    ///     Find the plugin an assembly belongs to: the plugin whose load context holds it, or, for an assembly
+    ///     outside every plugin's context, the plugin with that main assembly or shipping an assembly of that name
     /// </summary>
     /// <param name="assembly">Assembly</param>
     /// <returns>Plugin descriptor if exists; otherwise null</returns>
@@ -281,10 +273,30 @@ public static PluginInfo FindPlugin(Assembly assembly)
     {
         ArgumentNullException.ThrowIfNull(assembly);
 
-        return ReferencedPlugins?.FirstOrDefault(plugin => plugin.ReferencedAssembly != null
-                                                           && plugin.ReferencedAssembly.FullName!.Equals(
-                                                               assembly.FullName,
-                                                               StringComparison.OrdinalIgnoreCase));
+        var plugins = ReferencedPlugins?.ToList();
+        if (plugins == null)
+            return null;
+
+        var name = assembly.GetName().Name;
+        return OwnerOf(assembly, plugins)
+               ?? plugins.FirstOrDefault(plugin => plugin.ReferencedAssembly != null
+                                                   && plugin.ReferencedAssembly.FullName!.Equals(assembly.FullName,
+                                                       StringComparison.OrdinalIgnoreCase))
+               ?? plugins.FirstOrDefault(plugin =>
+                   plugin.AssemblyNames.Contains(name, StringComparer.OrdinalIgnoreCase));
+    }
+
+    /// <summary>
+    ///     The plugin whose own load context holds the assembly; null for an assembly of the default context or
+    ///     of a context no plugin owns
+    /// </summary>
+    internal static PluginInfo OwnerOf(Assembly assembly, IEnumerable<PluginInfo> plugins)
+    {
+        var context = AssemblyLoadContext.GetLoadContext(assembly);
+        if (context == null || context == AssemblyLoadContext.Default || plugins == null)
+            return null;
+
+        return plugins.FirstOrDefault(plugin => ReferenceEquals(plugin.LoadContext, context));
     }
 
 
@@ -303,37 +315,29 @@ public static void ClearPlugins()
     #region Utilities
 
     /// <summary>
-    ///     Simple names of the assemblies the application itself provides; a plugin's copy of one is never loaded
+    ///     Simple names of the assemblies the application itself provides (its trusted platform assemblies and
+    ///     whatever the default context has loaded); a plugin's copy of one is never loaded
     /// </summary>
-    private static HashSet<string> HostAssemblyNames()
+    internal static HashSet<string> HostAssemblyNames()
     {
         var trusted = AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES") as string ?? string.Empty;
-        return trusted.Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries)
+        var names = trusted.Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries)
             .Select(Path.GetFileNameWithoutExtension)
             .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        names.UnionWith(AssemblyLoadContext.Default.Assemblies
+            .Select(x => x.GetName().Name)
+            .Where(x => !string.IsNullOrEmpty(x)));
+        return names;
     }
 
     /// <summary>
-    ///     When two plugins ship the same dependency only one copy is loaded (see <see cref="PluginFolderScanner" />).
-    ///     The plugin whose copy was dropped finds the kept one here, also before the plugin shipping it is loaded.
+    ///     Creates the candidate's own context once its folder is prepared and its main assembly path is known
     /// </summary>
-    private static void ResolveDependenciesFrom(IEnumerable<PluginCandidate> plugins, AssemblyLoadContext loadContext,
-        Func<FileInfo, FileInfo> prepareFile)
+    private static Func<string, AssemblyLoadContext> ContextFactory(PluginCandidate candidate)
     {
-        var paths = plugins
-            .SelectMany(x => x.AssemblyPaths)
-            .GroupBy(Path.GetFileNameWithoutExtension, StringComparer.OrdinalIgnoreCase)
-            .ToDictionary(x => x.Key, x => x.First(), StringComparer.OrdinalIgnoreCase);
-
-        if (_resolveDependency != null)
-            _resolveDependencyContext.Resolving -= _resolveDependency;
-
-        _resolveDependency = (context, name) =>
-            name.Name != null && paths.TryGetValue(name.Name, out var path)
-                ? context.LoadFromAssemblyPath(prepareFile(new FileInfo(path)).FullName)
-                : null;
-        _resolveDependencyContext = loadContext;
-        loadContext.Resolving += _resolveDependency;
+        var createContext = _createContext;
+        var hostAssemblyNames = _hostAssemblyNames;
+        return mainAssemblyPath => createContext(candidate.Manifest.SystemName, mainAssemblyPath, hostAssemblyNames);
     }
 
     /// <summary>
@@ -345,7 +349,7 @@ private static string WarmLiteDbMappers(PluginInfo plugin)
     {
         try
         {
-            var assemblies = _loadContext.Assemblies
+            var assemblies = plugin.LoadContext.Assemblies
                 .Where(x => plugin.AssemblyNames.Contains(x.GetName().Name, StringComparer.OrdinalIgnoreCase))
                 .ToList();
             LiteDBMapperWarmup.Warm(new TypeSearcher().ClassesOfType(typeof(BaseEntity), assemblies));
@@ -357,89 +361,60 @@ private static string WarmLiteDbMappers(PluginInfo plugin)
         }
     }
 
-    private static void DeleteDepsFiles(DirectoryInfo folder)
-    {
-        //remove deps.json files
-        try
-        {
-            foreach (var f in folder.GetFiles("*.deps.json", SearchOption.TopDirectoryOnly))
-                try
-                {
-                    File.Delete(f.FullName);
-                }
-                catch (Exception exc)
-                {
-                    _logger.LogError(exc, "PluginManager");
-                }
-        }
-        catch (Exception exc)
-        {
-            _logger.LogError(exc, "PluginManager");
-        }
-    }
-
     /// <summary>
-    ///     Used to initialize plugins when running in Medium Trust
+    ///     Copies the plugin's folder, as a whole, to its own folder under Plugins/bin, so the plugin is loaded from
+    ///     the copy and its own folder can be replaced while the application runs. A file is copied only when its
+    ///     size or last write time differs from the copy's. Only this plugin's copy is touched.
     /// </summary>
-    /// <param name="plug"></param>
-    /// <param name="shadowCopyPlugFolder"></param>
-    /// <returns></returns>
-    private static FileInfo ShadowCopyFile(FileInfo plug, DirectoryInfo shadowCopyPlugFolder)
+    /// <returns>The folder to load the plugin from</returns>
+    private static DirectoryInfo ShadowCopyFolder(PluginCandidate candidate)
     {
-        var shouldCopy = true;
-        var shadowCopiedPlug = new FileInfo(Path.Combine(shadowCopyPlugFolder.FullName, plug.Name));
+        var source = candidate.Folder;
+        var target = new DirectoryInfo(Path.Combine(_copyFolder.FullName, source.Name));
 
-        //check if a shadow copied file already exists and if it does, check if it's updated, if not don't copy
-        if (shadowCopiedPlug.Exists)
+        var copies = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var file in source.GetFiles("*", SearchOption.AllDirectories))
         {
-            //it's better to use LastWriteTimeUTC, but not all file systems have this property
-            //maybe it is better to compare file hash?
-            var areFilesIdentical = shadowCopiedPlug.CreationTimeUtc.Ticks >= plug.CreationTimeUtc.Ticks;
-            if (areFilesIdentical)
-            {
-                _logger.LogInformation("Not copying; files appear identical: {Name}", shadowCopiedPlug.Name);
-                return shadowCopiedPlug;
-            }
+            var copy = new FileInfo(Path.Combine(target.FullName, Path.GetRelativePath(source.FullName, file.FullName)));
+            copies.Add(copy.FullName);
+            if (copy.Exists && copy.Length == file.Length && copy.LastWriteTimeUtc == file.LastWriteTimeUtc)
+                continue;
 
-            //delete an existing file
-            _logger.LogInformation("New plugin found; Deleting the old file: {Name}", shadowCopiedPlug.Name);
+            Directory.CreateDirectory(copy.DirectoryName!);
+            CopyFile(file, copy);
+        }
+
+        //what the plugin no longer ships, so its context cannot resolve it
+        foreach (var stale in target.GetFiles("*", SearchOption.AllDirectories).Where(x => !copies.Contains(x.FullName)))
             try
             {
-                File.Delete(shadowCopiedPlug.FullName);
+                stale.Delete();
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
             {
-                shouldCopy = false;
-                _logger.LogError(ex, "PluginManager");
+                _logger.LogWarning(ex, "Stale shadow copy {FullName} could not be deleted", stale.FullName);
             }
-        }
 
-        if (!shouldCopy) return shadowCopiedPlug;
+        return target;
+    }
+
+    private static void CopyFile(FileInfo source, FileInfo copy)
+    {
         try
         {
-            File.Copy(plug.FullName, shadowCopiedPlug.FullName, true);
+            File.Copy(source.FullName, copy.FullName, true);
         }
-        catch (IOException)
+        catch (IOException) when (copy.Exists)
         {
-            _logger.LogInformation("{FullName} is locked, attempting to rename", shadowCopiedPlug.FullName);
-            //this occurs when the files are locked,
-            //for some reason devenv locks plugin files some times and for another crazy reason you are allowed to rename them
-            //which releases the lock, so that it what we are doing here, once it's renamed, we can re-shadow copy
-            try
-            {
-                var oldFile = shadowCopiedPlug.FullName + Guid.NewGuid().ToString("N") + ".old";
-                File.Move(shadowCopiedPlug.FullName, oldFile);
-            }
-            catch (IOException exc)
-            {
-                throw new IOException(shadowCopiedPlug.FullName + " rename failed, cannot initialize plugin", exc);
-            }
-
-            //ok, we've made it this far, now retry the shadow copy
-            File.Copy(plug.FullName, shadowCopiedPlug.FullName, true);
+            //a copy in use (another process still running from it, or a debugger) cannot be overwritten, but it
+            //can be renamed, which frees its name; the renamed file is removed as stale by a later start
+            _logger.LogInformation("{FullName} is locked, attempting to rename", copy.FullName);
+            File.Move(copy.FullName, copy.FullName + "." + Guid.NewGuid().ToString("N") + ".old");
+            File.Copy(source.FullName, copy.FullName, true);
         }
 
-        return shadowCopiedPlug;
+        //compared on the next start; not every file system keeps it on copy
+        File.SetLastWriteTimeUtc(copy.FullName, source.LastWriteTimeUtc);
     }
 
     /// <summary>
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs
index 753101905c..6782219886 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/PluginFolderFixture.cs
@@ -4,8 +4,8 @@
 namespace Grand.Infrastructure.Tests.Plugins.Fixtures;
 
 /// <summary>
-///     A temporary Plugins folder and a collectible load context for plugin loading tests. Disposing
-///     unloads the context and removes the folder.
+///     A temporary Plugins folder for plugin loading tests, whose plugins load into collectible contexts of
+///     their own. Disposing unloads every context and removes the folder.
 /// </summary>
 public sealed class PluginFolderFixture : IDisposable
 {
@@ -13,18 +13,44 @@ public sealed class PluginFolderFixture : IDisposable
     private static readonly HashSet<string> Host = new(StringComparer.OrdinalIgnoreCase) { "Grand.Infrastructure" };
 
     private readonly string _root;
+    private readonly List<AssemblyLoadContext> _contexts = [];
 
     public PluginFolderFixture()
     {
         _root = Path.Combine(Path.GetTempPath(), "grand-plugin-tests", Guid.NewGuid().ToString("N"));
         PluginsFolder = Path.Combine(_root, "Plugins");
         Directory.CreateDirectory(PluginsFolder);
-        Context = new AssemblyLoadContext("plugin-tests-" + Guid.NewGuid().ToString("N"), true);
     }
 
     public string PluginsFolder { get; }
 
-    public AssemblyLoadContext Context { get; }
+    /// <summary>
+    ///     The contexts created so far, one per plugin loaded
+    /// </summary>
+    public IReadOnlyList<AssemblyLoadContext> Contexts
+    {
+        get
+        {
+            lock (_contexts)
+            {
+                return _contexts.ToList();
+            }
+        }
+    }
+
+    /// <summary>
+    ///     A plugin's own context, as production creates it, but collectible
+    /// </summary>
+    public AssemblyLoadContext CreateContext(string name, string mainAssemblyPath, ISet<string> hostAssemblyNames)
+    {
+        var context = new IsolatedLoadContext("plugin-tests-" + name, mainAssemblyPath, hostAssemblyNames, true);
+        lock (_contexts)
+        {
+            _contexts.Add(context);
+        }
+
+        return context;
+    }
 
     public string Folder(string name) => Path.Combine(PluginsFolder, name);
 
@@ -55,15 +81,28 @@ public string CompileElsewhere(string assemblyName, string source)
 
     public PluginInfo Load(string folder, bool installed)
     {
-        return PluginLoader.Load(Candidate(folder), installed, Context, x => x);
+        var hostAssemblyNames = PluginManager.HostAssemblyNames();
+        return PluginLoader.Load(Candidate(folder), installed,
+            main => CreateContext(folder, main, hostAssemblyNames), x => x.Folder);
     }
 
+    /// <summary>
+    ///     The one assembly of that name loaded by any of the plugins
+    /// </summary>
     public System.Reflection.Assembly Loaded(string assemblyName) =>
-        Context.Assemblies.Single(x => x.GetName().Name == assemblyName);
+        Contexts.SelectMany(x => x.Assemblies).Single(x => x.GetName().Name == assemblyName);
+
+    /// <summary>
+    ///     The assembly of that name in the plugin's own context
+    /// </summary>
+    public static System.Reflection.Assembly Loaded(PluginInfo plugin, string assemblyName) =>
+        AssemblyLoadContext.GetLoadContext(plugin.ReferencedAssembly)!.Assemblies
+            .Single(x => x.GetName().Name == assemblyName);
 
     public void Dispose()
     {
-        Context.Unload();
+        foreach (var context in Contexts)
+            context.Unload();
         for (var i = 0; i < 10; i++)
         {
             GC.Collect();
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs
new file mode 100644
index 0000000000..0b68a7df00
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs
@@ -0,0 +1,200 @@
+using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Infrastructure.Tests.Plugins;
+
+[TestClass]
+[DoNotParallelize]
+public class IsolatedLoadContextTests
+{
+    private PluginFolderFixture _fixture;
+    private IEnumerable<PluginInfo> _referencedPlugins;
+    private PluginLoadSnapshot _loadSnapshot;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+        _referencedPlugins = PluginManager.ReferencedPlugins;
+        _loadSnapshot = PluginManager.LoadSnapshot;
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        PluginManager.ReferencedPlugins = _referencedPlugins;
+        PluginManager.LoadSnapshot = _loadSnapshot;
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    public void TwoPlugins_DifferentDependencyVersions_BothRun()
+    {
+        var one = TestPluginBuilder.Compile(_fixture.Folder("One"), "Isolated.SharedDep", """
+            namespace SharedDep { public static class Dep { public static string Value() => "1.0"; } }
+            """, new Version(1, 0, 0, 0));
+        _fixture.AddPlugin("One", "Isolated.One", "Isolated.One", """
+            public class OnePlugin : BasePlugin { }
+            public static class Entry { public static string Run() => SharedDep.Dep.Value(); }
+            """, one);
+        var two = TestPluginBuilder.Compile(_fixture.Folder("Two"), "Isolated.SharedDep", """
+            namespace SharedDep
+            {
+                public static class Dep
+                {
+                    public static string Value() => "2.0";
+                    public static string OnlyInTwo() => "2.0 only";
+                }
+            }
+            """, new Version(2, 0, 0, 0));
+        _fixture.AddPlugin("Two", "Isolated.Two", "Isolated.Two", """
+            public class TwoPlugin : BasePlugin { }
+            public static class Entry { public static string Run() => SharedDep.Dep.OnlyInTwo(); }
+            """, two);
+
+        Load("Isolated.One,Isolated.Two");
+
+        Assert.AreEqual("1.0", Run(Plugin("Isolated.One")));
+        Assert.AreEqual("2.0 only", Run(Plugin("Isolated.Two")));
+    }
+
+    [TestMethod]
+    public void Load_HostAssemblyName_ComesFromDefaultContext()
+    {
+        _fixture.AddPlugin("Host", "Isolated.Host", "Isolated.Host", "public class HostPlugin : BasePlugin { }");
+        File.Copy(PluginFolderFixture.CoreAssemblyPath, Path.Combine(_fixture.Folder("Host"), "Grand.Infrastructure.dll"));
+
+        Load("Isolated.Host");
+
+        var plugin = Plugin("Isolated.Host");
+        Assert.IsNull(plugin.LoadError);
+        var instance = Activator.CreateInstance(plugin.PluginType);
+        Assert.IsInstanceOfType<IPlugin>(instance);
+        Assert.AreSame(typeof(IPlugin).Assembly,
+            plugin.PluginType.GetInterfaces().Single(x => x.Name == nameof(IPlugin)).Assembly);
+    }
+
+    [TestMethod]
+    public void PluginTypes_AreRecognisedByMvcApplicationPart()
+    {
+        //no Controller suffix: it is recognised only through the host's [Controller] on ControllerBase
+        _fixture.AddPlugin("Mvc", "Isolated.Mvc", "Isolated.Mvc", """
+            public class MvcPlugin : BasePlugin { }
+            public class PluginEndpoint : Microsoft.AspNetCore.Mvc.ControllerBase { }
+            """);
+
+        var mvcCoreBuilder = Load("Isolated.Mvc");
+
+        var feature = new ControllerFeature();
+        mvcCoreBuilder.PartManager.PopulateFeature(feature);
+        Assert.IsTrue(feature.Controllers.Any(x =>
+            x.Name == "PluginEndpoint" && x.Assembly == Plugin("Isolated.Mvc").ReferencedAssembly));
+    }
+
+    [TestMethod]
+    public void Load_DependencyListedInDepsJson_IsResolvedFromItsListedPath()
+    {
+        //outside the top of the folder: only the plugin's deps.json says where it is, listed the way a package's
+        //runtimes/<rid> asset is (Payments.StripeCheckout ships one)
+        var lib = TestPluginBuilder.Compile(Path.Combine(_fixture.Folder("Deps"), "lib"), "Isolated.Deps.Lib",
+            "namespace DepsLib { public static class Lib { public static string Value() => \"from lib\"; } }");
+        _fixture.AddPlugin("Deps", "Isolated.Deps", "Isolated.Deps", """
+            public class DepsPlugin : BasePlugin { }
+            public static class Entry { public static string Run() => DepsLib.Lib.Value(); }
+            """, lib);
+        File.WriteAllText(Path.Combine(_fixture.Folder("Deps"), "Isolated.Deps.deps.json"), """
+            {
+              "runtimeTarget": { "name": ".NETCoreApp,Version=v10.0" },
+              "targets": {
+                ".NETCoreApp,Version=v10.0": {
+                  "Isolated.Deps/1.0.0": {
+                    "dependencies": { "Isolated.Deps.Lib": "1.0.0" },
+                    "runtime": { "Isolated.Deps.dll": {} }
+                  },
+                  "Isolated.Deps.Lib/1.0.0": {
+                    "runtimeTargets": {
+                      "lib/Isolated.Deps.Lib.dll": { "rid": "any", "assetType": "runtime", "assemblyVersion": "1.0.0.0", "fileVersion": "1.0.0.0" }
+                    }
+                  }
+                }
+              },
+              "libraries": {
+                "Isolated.Deps/1.0.0": { "type": "project", "serviceable": false, "sha512": "" },
+                "Isolated.Deps.Lib/1.0.0": { "type": "project", "serviceable": false, "sha512": "" }
+              }
+            }
+            """);
+
+        Load("Isolated.Deps");
+
+        var plugin = Plugin("Isolated.Deps");
+        Assert.AreEqual("from lib", Run(plugin));
+        Assert.AreEqual(Path.GetFullPath(lib), PluginFolderFixture.Loaded(plugin, "Isolated.Deps.Lib").Location);
+    }
+
+    [TestMethod]
+    public void Load_AssemblyOfAnotherPlugin_IsLoadErrorNotCrash()
+    {
+        //not supported: a plugin takes nothing from another plugin's context
+        var api = _fixture.AddPlugin("Api", "Isolated.Api", "Isolated.Api", """
+            public class ApiPlugin : BasePlugin { }
+            namespace ApiTypes { public class Api { } }
+            """);
+        _fixture.AddPlugin("User", "Isolated.User", "Isolated.User", """
+            public class UserPlugin : BasePlugin { }
+            public class UsesApi : ApiTypes.Api { }
+            """, api);
+
+        Load("Isolated.Api,Isolated.User");
+
+        Assert.IsTrue(Plugin("Isolated.Api").IsActive);
+        var user = Plugin("Isolated.User");
+        Assert.IsNotNull(user.LoadError);
+        Assert.Contains("Isolated.Api", user.LoadError);
+        Assert.IsNull(user.ReferencedAssembly);
+    }
+
+    [TestMethod]
+    public void FindPlugin_AssemblyInPluginsContext_FindsThePlugin()
+    {
+        _fixture.AddPlugin("Find", "Isolated.Find", "Isolated.Find", "public class FindPlugin : BasePlugin { }");
+        TestPluginBuilder.Compile(_fixture.Folder("Find"), "Isolated.Find.Core", "public class Core { }");
+
+        Load("Isolated.Find");
+
+        var plugin = Plugin("Isolated.Find");
+        Assert.AreSame(plugin, PluginManager.FindPlugin(plugin.PluginType));
+        Assert.AreSame(plugin, PluginManager.FindPlugin(PluginFolderFixture.Loaded(plugin, "Isolated.Find.Core")));
+        Assert.IsNull(PluginManager.FindPlugin(typeof(IsolatedLoadContextTests)));
+    }
+
+    private IMvcCoreBuilder Load(string installed)
+    {
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string> {
+                ["Extensions:InstalledPlugins"] = installed
+            })
+            .Build();
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(Path.GetDirectoryName(_fixture.PluginsFolder)!);
+        var mvcCoreBuilder = new ServiceCollection().AddLogging().AddMvcCore();
+
+        PluginManager.Load(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.CreateContext);
+        return mvcCoreBuilder;
+    }
+
+    private static PluginInfo Plugin(string systemName) =>
+        PluginManager.ReferencedPlugins.Single(x => x.SystemName == systemName);
+
+    private static string Run(PluginInfo plugin)
+    {
+        Assert.IsNull(plugin.LoadError);
+        return (string)plugin.ReferencedAssembly.GetType("Entry", true)!.GetMethod("Run")!.Invoke(null, null);
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
index 2876132c50..146c6d48ac 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginExtensionsTests.cs
@@ -188,7 +188,7 @@ public class BrokenPlugin : BasePlugin { }
 
     [TestMethod]
     [DoNotParallelize]
-    public void OnlyInstalledPlugins_DependencySharedWithInstalledPlugin_ReturnsTrue()
+    public void OnlyInstalledPlugins_DependencyShippedByInstalledAndUninstalledPlugin_OnlyTheInstalledCopyCounts()
     {
         using var fixture = new PluginFolderFixture();
         fixture.AddPlugin("A", "Ext.A", "Ext.A", "public class APlugin : BasePlugin { }");
@@ -202,7 +202,33 @@ public void OnlyInstalledPlugins_DependencySharedWithInstalledPlugin_ReturnsTrue
         try
         {
             PluginManager.ReferencedPlugins = [uninstalled, installed];
-            Assert.IsTrue(PluginExtensions.OnlyInstalledPlugins(fixture.Loaded("Ext.Shared")));
+            //each plugin loaded its own copy into its own context
+            Assert.IsTrue(PluginExtensions.OnlyInstalledPlugins(PluginFolderFixture.Loaded(installed, "Ext.Shared")));
+            Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(PluginFolderFixture.Loaded(uninstalled, "Ext.Shared")));
+        }
+        finally
+        {
+            PluginManager.ReferencedPlugins = referencedPlugins;
+        }
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void OnlyInstalledPlugins_AssemblyOutsidePluginContextsSharedWithInstalledPlugin_ReturnsTrue()
+    {
+        //an assembly no plugin context holds is matched by name, as before plugins had contexts of their own
+        var name = typeof(SampleBasePlugin).Assembly.GetName().Name;
+        var uninstalled = new PluginInfo { SystemName = "Uninstalled", AssemblyNames = new HashSet<string> { name } };
+        var installed = new PluginInfo
+            { SystemName = "Installed", Installed = true, AssemblyNames = new HashSet<string> { name } };
+
+        var referencedPlugins = PluginManager.ReferencedPlugins;
+        try
+        {
+            PluginManager.ReferencedPlugins = [uninstalled];
+            Assert.IsFalse(PluginExtensions.OnlyInstalledPlugins(typeof(SampleBasePlugin).Assembly));
+            PluginManager.ReferencedPlugins = [uninstalled, installed];
+            Assert.IsTrue(PluginExtensions.OnlyInstalledPlugins(typeof(SampleBasePlugin).Assembly));
         }
         finally
         {
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
index cae61d6bba..0cbefe77da 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
@@ -55,7 +55,7 @@ public void Scan_DuplicateSystemName_SecondFolderIsProblem()
     }
 
     [TestMethod]
-    public void Scan_SameDependencyTwoVersions_KeepsHigherVersionOnce()
+    public void Scan_SameDependencyTwoVersions_EachFolderKeepsItsOwn()
     {
         AddPlugin("A", "Scan.A", "Scan.A");
         AddPlugin("B", "Scan.B", "Scan.B");
@@ -64,15 +64,15 @@ public void Scan_SameDependencyTwoVersions_KeepsHigherVersionOnce()
 
         var result = Scan();
 
+        //each plugin loads into its own context, so neither copy has to give way
         Assert.HasCount(2, result.Plugins);
         var a = result.Plugins.Single(x => x.Folder.Name == "A");
         var b = result.Plugins.Single(x => x.Folder.Name == "B");
-        CollectionAssert.DoesNotContain(a.AssemblyPaths.ToList(), low);
+        CollectionAssert.Contains(a.AssemblyPaths.ToList(), low);
         CollectionAssert.Contains(b.AssemblyPaths.ToList(), high);
-        Assert.AreEqual(1, result.Plugins.SelectMany(x => x.AssemblyPaths)
-            .Count(x => Path.GetFileName(x) == "Shared.Lib.dll"));
         Assert.Contains("Shared.Lib", a.AssemblyNames);
-        Assert.IsTrue(result.Warnings.Any(x => x.Contains("Shared.Lib") && x.Contains("'A'") && x.Contains("'B'")));
+        Assert.Contains("Shared.Lib", b.AssemblyNames);
+        Assert.IsEmpty(result.Warnings);
     }
 
     [TestMethod]
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
index aaa1047a7e..3f9bd634d5 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
@@ -137,7 +137,8 @@ public void Instance_ConcurrentCalls_LoadThePluginOnce()
 
         Assert.IsNull(plugin.LoadError);
         Assert.AreEqual(1, types.Distinct().Count());
-        Assert.HasCount(1, _fixture.Context.Assemblies.Where(x => x.GetName().Name == "Manager.Concurrent"));
+        Assert.HasCount(1, _fixture.Contexts);
+        Assert.HasCount(1, _fixture.Contexts.Single().Assemblies.Where(x => x.GetName().Name == "Manager.Concurrent"));
     }
 
     [TestMethod]
@@ -179,11 +180,80 @@ public class LitePlugin : BasePlugin { }
         Assert.Contains("LitePluginEntity", MappedTypeNames());
     }
 
-    private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = false)
+    [TestMethod]
+    public void Load_ShadowCopy_LoadsTheWholeFolderFromItsOwnCopy()
+    {
+        var main = _fixture.AddPlugin("Shadow", "Manager.Shadow", "Manager.Shadow",
+            "public class ShadowPlugin : BasePlugin { }");
+        WriteDepsJson(_fixture.Folder("Shadow"), "Manager.Shadow");
+        Directory.CreateDirectory(Path.Combine(_fixture.Folder("Shadow"), "runtimes", "any"));
+        File.WriteAllText(Path.Combine(_fixture.Folder("Shadow"), "runtimes", "any", "native.txt"), "native");
+        //left by an earlier start: a file the plugin no longer ships, another plugin's copy, the old flat layout
+        Directory.CreateDirectory(ShadowFolder("Shadow"));
+        File.WriteAllText(Path.Combine(ShadowFolder("Shadow"), "Removed.dll"), "old");
+        Directory.CreateDirectory(ShadowFolder("Other"));
+        File.WriteAllText(Path.Combine(ShadowFolder("Other"), "Other.dll"), "other");
+        File.WriteAllText(Path.Combine(_fixture.PluginsFolder, "bin", "Flat.dll"), "flat");
+
+        Load("Manager.Shadow", shadowCopy: true);
+
+        var plugin = Plugin("Manager.Shadow");
+        Assert.IsNull(plugin.LoadError);
+        Assert.AreEqual(Path.Combine(ShadowFolder("Shadow"), "Manager.Shadow.dll"), plugin.ReferencedAssembly.Location);
+        Assert.AreEqual(main, plugin.OriginalAssemblyFile.FullName);
+        Assert.IsTrue(File.Exists(Path.Combine(ShadowFolder("Shadow"), "Manager.Shadow.deps.json")));
+        Assert.IsTrue(File.Exists(Path.Combine(ShadowFolder("Shadow"), "runtimes", "any", "native.txt")));
+        Assert.IsFalse(File.Exists(Path.Combine(ShadowFolder("Shadow"), "Removed.dll")));
+        Assert.IsTrue(File.Exists(Path.Combine(ShadowFolder("Other"), "Other.dll")));
+        Assert.IsFalse(File.Exists(Path.Combine(_fixture.PluginsFolder, "bin", "Flat.dll")));
+        //the plugin's own folder keeps its deps.json
+        Assert.IsTrue(File.Exists(Path.Combine(_fixture.Folder("Shadow"), "Manager.Shadow.deps.json")));
+    }
+
+    [TestMethod]
+    public void Load_ShadowCopy_CopiesOnlyFilesThatChanged()
+    {
+        _fixture.AddPlugin("Copy", "Manager.Copy", "Manager.Copy", "public class CopyPlugin : BasePlugin { }");
+        var unchanged = Path.Combine(_fixture.Folder("Copy"), "unchanged.txt");
+        var changed = Path.Combine(_fixture.Folder("Copy"), "changed.txt");
+        File.WriteAllText(unchanged, "source");
+        File.WriteAllText(changed, "source");
+        Load("Manager.Copy", shadowCopy: true);
+        //same size and time as its source: taken as up to date, so the marker survives the next start
+        var unchangedCopy = Path.Combine(ShadowFolder("Copy"), "unchanged.txt");
+        File.WriteAllText(unchangedCopy, "marker");
+        File.SetLastWriteTimeUtc(unchangedCopy, File.GetLastWriteTimeUtc(unchanged));
+        File.WriteAllText(changed, "a newer, longer source");
+
+        Load("Manager.Copy", shadowCopy: true);
+
+        Assert.AreEqual("marker", File.ReadAllText(unchangedCopy));
+        Assert.AreEqual("a newer, longer source", File.ReadAllText(Path.Combine(ShadowFolder("Copy"), "changed.txt")));
+        Assert.IsTrue(Plugin("Manager.Copy").IsActive);
+    }
+
+    [TestMethod]
+    public void Load_ShadowCopyOff_LoadsFromThePluginFolderAndKeepsDepsJson()
+    {
+        var main = _fixture.AddPlugin("Direct", "Manager.Direct", "Manager.Direct",
+            "public class DirectPlugin : BasePlugin { }");
+        WriteDepsJson(_fixture.Folder("Direct"), "Manager.Direct");
+
+        Load("Manager.Direct");
+
+        var plugin = Plugin("Manager.Direct");
+        Assert.IsTrue(plugin.IsActive);
+        Assert.AreEqual(main, plugin.ReferencedAssembly.Location);
+        Assert.IsTrue(File.Exists(Path.Combine(_fixture.Folder("Direct"), "Manager.Direct.deps.json")));
+        Assert.IsFalse(Directory.Exists(ShadowFolder("Direct")));
+    }
+
+    private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = false, bool shadowCopy = false)
     {
         var configuration = new ConfigurationBuilder()
             .AddInMemoryCollection(new Dictionary<string, string> {
                 ["Extensions:InstalledPlugins"] = installed,
+                ["Extensions:PluginShadowCopy"] = shadowCopy.ToString(),
                 ["Database:UseLiteDb"] = useLiteDb.ToString()
             })
             .Build();
@@ -191,7 +261,20 @@ private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = fa
         hostEnvironment.Setup(x => x.ContentRootPath).Returns(Path.GetDirectoryName(_fixture.PluginsFolder)!);
         var mvcCoreBuilder = new ServiceCollection().AddLogging().AddMvcCore();
 
-        PluginManager.Load(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.Context);
+        PluginManager.Load(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.CreateContext);
+    }
+
+    private string ShadowFolder(string folder) => Path.Combine(_fixture.PluginsFolder, "bin", folder);
+
+    private static void WriteDepsJson(string folder, string assemblyName)
+    {
+        File.WriteAllText(Path.Combine(folder, assemblyName + ".deps.json"), $$"""
+            {
+              "runtimeTarget": { "name": ".NETCoreApp,Version=v10.0" },
+              "targets": { ".NETCoreApp,Version=v10.0": { "{{assemblyName}}/1.0.0": { "runtime": { "{{assemblyName}}.dll": {} } } } },
+              "libraries": { "{{assemblyName}}/1.0.0": { "type": "project", "serviceable": false, "sha512": "" } }
+            }
+            """);
     }
 
     private static PluginInfo Plugin(string systemName) =>
diff --git a/src/Tests/Grand.Web.Common.Tests/Infrastructure/PluginLoadContextApplicationPartsTests.cs b/src/Tests/Grand.Web.Common.Tests/Infrastructure/PluginLoadContextApplicationPartsTests.cs
new file mode 100644
index 0000000000..24586d3fce
--- /dev/null
+++ b/src/Tests/Grand.Web.Common.Tests/Infrastructure/PluginLoadContextApplicationPartsTests.cs
@@ -0,0 +1,63 @@
+using Grand.Infrastructure.Plugins;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.ApplicationParts;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.AspNetCore.Mvc.Razor.Compilation;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Web.Common.Tests.Infrastructure;
+
+/// <summary>
+///     A real built plugin, loaded into a context of its own as the application loads it: MVC must still find its
+///     controllers and its precompiled views. Inconclusive when the plugin has not been built.
+/// </summary>
+[TestClass]
+public class PluginLoadContextApplicationPartsTests
+{
+    private const string PluginName = "Widgets.Slider";
+
+    [TestMethod]
+    public void BuiltPlugin_InItsOwnContext_ControllersAndCompiledViewsAreDiscovered()
+    {
+        var path = Path.GetFullPath(Path.Combine(AppContext.BaseDirectory, "..", "..", "..", "..", "..", "Web",
+            "Grand.Web", "Plugins", PluginName, PluginName + ".dll"));
+        if (!File.Exists(path))
+            Assert.Inconclusive($"{path} is not built; run dotnet build src/Plugins/{PluginName}");
+
+        var context = new IsolatedLoadContext(PluginName, path, PluginManager.HostAssemblyNames(), true);
+        try
+        {
+            var assembly = context.LoadFromAssemblyPath(path);
+            //as PluginManager adds an installed plugin; the Razor view engine brings the compiled-views provider
+            var partManager = new ServiceCollection().AddMvcCore().AddRazorViewEngine().AddApplicationPart(assembly)
+                .PartManager;
+
+            var controllers = new ControllerFeature();
+            partManager.PopulateFeature(controllers);
+            var views = new ViewsFeature();
+            partManager.PopulateFeature(views);
+
+            Assert.IsTrue(controllers.Controllers.Any(x => x.Assembly == assembly), "no controller of the plugin");
+            var pluginViews = views.ViewDescriptors.Where(x => x.Type?.Assembly == assembly).ToList();
+            Assert.IsNotEmpty(pluginViews, "no compiled view of the plugin");
+            CollectionAssert.IsSubsetOf(
+                new[] {
+                    "/Areas/Admin/Views/WidgetsSlider/Configure.cshtml",
+                    "/Views/Shared/Components/WidgetSlider/Default.cshtml"
+                },
+                pluginViews.Select(x => x.RelativePath).ToList());
+            //the host's MVC types, not copies: the context took them from the default one
+            Assert.IsTrue(controllers.Controllers.Where(x => x.Assembly == assembly)
+                .All(x => typeof(ControllerBase).IsAssignableFrom(x)));
+            //Razor runtime compilation (Development) reads every part's references through the plugin's deps.json,
+            //which the plugin folder now keeps
+            foreach (var part in partManager.ApplicationParts.OfType<ICompilationReferencesProvider>())
+                _ = part.GetReferencePaths().ToList();
+        }
+        finally
+        {
+            context.Unload();
+        }
+    }
+}

From 9c5e55f3d620bf0bbdfa590af0cf819d44a6b9de Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 11:25:10 +0100
Subject: [PATCH 15/30] Fail a plugin's load when its code references an
 assembly its context cannot provide

---
 .../Plugins/PluginLoader.cs                   | 16 ++++++++++++++
 .../Plugins/IsolatedLoadContextTests.cs       | 22 +++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
index e66d9ecb90..27432436fc 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
@@ -62,6 +62,12 @@ string Prepared(string path) =>
             if (pluginType == null)
                 return Failed(plugin, NoPluginClassError);
 
+            //a reference used only inside a method body is not needed by GetTypes; resolved here, one the context
+            //cannot provide (such as another plugin's assembly) fails the load instead of a later request
+            foreach (var assembly in assemblies.Where(IsPluginCode))
+            foreach (var reference in assembly.GetReferencedAssemblies())
+                context.LoadFromAssemblyName(reference);
+
             plugin.ReferencedAssembly = main;
             plugin.PluginType = pluginType;
             return plugin;
@@ -148,6 +154,16 @@ public static void ThrowOnLoadError(IEnumerable<PluginInfo> plugins, IEnumerable
                 $"The plugin folder '{unidentified.Folder}' could not be loaded: {unidentified.Message}");
     }
 
+    /// <summary>
+    ///     The plugin's own code, built against GrandNode; a third-party library may reference optional
+    ///     assemblies it never loads, so its references are left to the runtime
+    /// </summary>
+    private static bool IsPluginCode(Assembly assembly)
+    {
+        var core = typeof(IPlugin).Assembly.GetName().Name;
+        return assembly.GetReferencedAssemblies().Any(x => string.Equals(x.Name, core, StringComparison.OrdinalIgnoreCase));
+    }
+
     private static bool IsPluginClass(Type type)
     {
         return typeof(IPlugin).IsAssignableFrom(type) && type.IsClass && !type.IsAbstract;
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs
index 0b68a7df00..c6a603d22f 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/IsolatedLoadContextTests.cs
@@ -160,6 +160,28 @@ public class UsesApi : ApiTypes.Api { }
         Assert.IsNull(user.ReferencedAssembly);
     }
 
+    [TestMethod]
+    public void Load_AssemblyOfAnotherPluginUsedOnlyInAMethodBody_IsLoadError()
+    {
+        //GetTypes never needs it; without the check the first request running the method would fail
+        var api = _fixture.AddPlugin("Api", "Isolated.Api", "Isolated.Api", """
+            public class ApiPlugin : BasePlugin { }
+            namespace ApiTypes { public class Api { } }
+            """);
+        _fixture.AddPlugin("User", "Isolated.User", "Isolated.User", """
+            public class UserPlugin : BasePlugin { }
+            public static class Uses { public static object M() => new ApiTypes.Api(); }
+            """, api);
+
+        Load("Isolated.Api,Isolated.User");
+
+        Assert.IsTrue(Plugin("Isolated.Api").IsActive);
+        var user = Plugin("Isolated.User");
+        Assert.IsFalse(user.IsActive);
+        Assert.IsNotNull(user.LoadError);
+        Assert.Contains("Isolated.Api", user.LoadError);
+    }
+
     [TestMethod]
     public void FindPlugin_AssemblyInPluginsContext_FindsThePlugin()
     {

From 50f19f1db7eae7488ad54082f75e3cd317be04ff Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 08:48:23 +0100
Subject: [PATCH 16/30] Let shipping by weight quote a customer without
 checkout attributes

---
 .../ByWeightShippingProvider.cs               |  3 +-
 .../ByWeightShippingCalcPluginTests.cs        | 56 +++++++++++++++++++
 2 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 src/Tests/Grand.Modules.Tests/Plugins/Shipping/ByWeightShippingCalcPluginTests.cs

diff --git a/src/Plugins/Shipping.ByWeight/ByWeightShippingProvider.cs b/src/Plugins/Shipping.ByWeight/ByWeightShippingProvider.cs
index 77b2ca2237..4ed11e11cf 100644
--- a/src/Plugins/Shipping.ByWeight/ByWeightShippingProvider.cs
+++ b/src/Plugins/Shipping.ByWeight/ByWeightShippingProvider.cs
@@ -168,7 +168,8 @@ private async Task<double> GetTotalWeight(GetShippingOptionRequest request, bool
             var checkoutAttributes =
                 customer.GetUserFieldFromEntity<List<CustomAttribute>>(SystemCustomerFieldNames.CheckoutAttributes,
                     request.StoreId);
-            if (checkoutAttributes.Any())
+            //null until the customer chooses checkout attributes, and again once an order clears them
+            if (checkoutAttributes is { Count: > 0 })
             {
                 var attributeValues = await _checkoutAttributeParser.ParseCheckoutAttributeValues(checkoutAttributes);
                 foreach (var attributeValue in attributeValues)
diff --git a/src/Tests/Grand.Modules.Tests/Plugins/Shipping/ByWeightShippingCalcPluginTests.cs b/src/Tests/Grand.Modules.Tests/Plugins/Shipping/ByWeightShippingCalcPluginTests.cs
new file mode 100644
index 0000000000..6601f238d2
--- /dev/null
+++ b/src/Tests/Grand.Modules.Tests/Plugins/Shipping/ByWeightShippingCalcPluginTests.cs
@@ -0,0 +1,56 @@
+using Grand.Business.Core.Interfaces.Catalog.Prices;
+using Grand.Business.Core.Interfaces.Catalog.Products;
+using Grand.Business.Core.Interfaces.Checkout.CheckoutAttributes;
+using Grand.Business.Core.Interfaces.Checkout.Shipping;
+using Grand.Business.Core.Interfaces.Common.Directory;
+using Grand.Business.Core.Utilities.Checkout;
+using Grand.Domain.Catalog;
+using Grand.Domain.Common;
+using Grand.Domain.Customers;
+using Grand.Domain.Orders;
+using Grand.Domain.Shipping;
+using Grand.Infrastructure;
+using Grand.Web.Common.Localization;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using Shipping.ByWeight;
+using Shipping.ByWeight.Services;
+
+namespace Grand.Modules.Tests.Plugins.Shipping;
+
+[TestClass]
+public class ByWeightShippingCalcPluginTests
+{
+    [TestMethod]
+    public async Task GetShippingOptions_CustomerWithoutCheckoutAttributes_DoesNotThrow()
+    {
+        var product = new Product { Weight = 2 };
+        var productService = new Mock<IProductService>();
+        productService.Setup(x => x.GetProductById(product.Id, It.IsAny<bool>())).ReturnsAsync(product);
+        var contextAccessor = new Mock<IContextAccessor>();
+        contextAccessor.Setup(x => x.StoreContext.CurrentStore).Returns(new Grand.Domain.Stores.Store());
+        contextAccessor.Setup(x => x.WorkContext.CurrentCustomer).Returns(new Customer());
+        var shippingMethodService = new Mock<IShippingMethodService>();
+        shippingMethodService
+            .Setup(x => x.GetAllShippingMethods(It.IsAny<string>(), It.IsAny<Customer>(), It.IsAny<string>()))
+            .ReturnsAsync(new List<ShippingMethod>());
+        var provider = new ByWeightShippingCalcPlugin(shippingMethodService.Object, contextAccessor.Object,
+            Mock.Of<IRequestTranslationService>(), productService.Object, Mock.Of<ICheckoutAttributeParser>(),
+            Mock.Of<ICurrencyService>(), Mock.Of<IPricingService>(), Mock.Of<IShippingByWeightService>(),
+            new ByWeightShippingSettings());
+        //a customer who never chose checkout attributes, or whose choice the last order cleared
+        var request = new GetShippingOptionRequest {
+            Customer = new Customer(),
+            StoreId = "store",
+            ShippingAddress = new Address(),
+            Items = [
+                new GetShippingOptionRequest.PackageItem(new ShoppingCartItem
+                    { ProductId = product.Id, Quantity = 1, IsFreeShipping = true })
+            ]
+        };
+
+        var response = await provider.GetShippingOptions(request);
+
+        Assert.IsTrue(response.Success);
+    }
+}

From d47aff8e2375587df2ad28b7a47e4403d8b17b66 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 09:12:50 +0100
Subject: [PATCH 17/30] Load modules like plugins and stop shipping host
 assembly copies

---
 .../Configuration/ExtensionsConfig.cs         |   5 +-
 .../Modules/ModuleLoader.cs                   | 163 ++++++++----
 .../Plugins/PluginManager.cs                  |   7 +-
 .../Grand.Infrastructure/StartupLogging.cs    |  21 ++
 .../TypeSearch/TypeSearcher.cs                |   5 +-
 .../Grand.Module.Scim.csproj                  |   8 +
 .../Modules/ModuleLoaderTests.cs              | 231 ++++++++++++++++++
 .../Grand.Web.Admin/App_Data/appsettings.json |   2 +-
 .../Grand.Web.Store/App_Data/appsettings.json |   2 +-
 .../App_Data/appsettings.json                 |   2 +-
 src/Web/Grand.Web/App_Data/appsettings.json   |   2 +-
 11 files changed, 385 insertions(+), 63 deletions(-)
 create mode 100644 src/Core/Grand.Infrastructure/StartupLogging.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs

diff --git a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
index b47bb2d956..56164e505f 100644
--- a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
+++ b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
@@ -32,8 +32,9 @@ public class ExtensionsConfig
     public string InstalledPlugins { get; set; }
 
     /// <summary>
-    ///     Stop the application when an installed plugin fails to load. Off: the plugin is logged,
-    ///     listed with its error and left inactive, and the application starts without it.
+    ///     Stop the application when an installed plugin, or a module enabled under FeatureManagement, fails to
+    ///     load. Off: the plugin is logged, listed with its error and left inactive, the module is logged as
+    ///     critical, and the application starts without it.
     /// </summary>
     public bool FailOnPluginLoadError { get; set; }
 }
\ No newline at end of file
diff --git a/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs b/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
index 8d5e00730b..655f8c56cc 100644
--- a/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
+++ b/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
@@ -1,4 +1,7 @@
-using Microsoft.AspNetCore.Hosting;
+using Grand.Infrastructure.Configuration;
+using Grand.Infrastructure.Plugins;
+using Grand.SharedKernel;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.ApplicationParts;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
@@ -9,12 +12,19 @@
 
 namespace Grand.Infrastructure.Modules;
 
+/// <summary>
+///     Loads the modules enabled under FeatureManagement, each into a load context of its own, as plugins are
+///     loaded: the module shares the host's assemblies and resolves its private libraries from its folder.
+/// </summary>
 public static class ModuleLoader
 {
     private const string MODULE_SECTION_PATH = "FeatureManagement";
     private const string MODULES_DIRECTORY = "Modules";
     private const string LOGGER_NAME = "ModuleManager";
 
+    //the contexts of modules that failed to load; their assemblies stay loaded, so scans must skip them
+    private static readonly ConditionalWeakTable<AssemblyLoadContext, object> FailedContexts = new();
+
     private static List<(string FeatureName, bool IsEnabled)> GetFeatureList(IConfiguration configuration)
     {
         var featureSection = configuration.GetSection(MODULE_SECTION_PATH);
@@ -30,16 +40,40 @@ public static class ModuleLoader
             ))
             .ToList();
     }
-    
+
+    /// <summary>
+    ///     Loads the enabled modules. A module that cannot be loaded is logged and left out, or, with
+    ///     Extensions:FailOnPluginLoadError, stops the application.
+    /// </summary>
+    /// <exception cref="GrandException">A module failed to load and Extensions:FailOnPluginLoadError is set</exception>
     [MethodImpl(MethodImplOptions.NoInlining)]
     public static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration, IWebHostEnvironment hostingEnvironment)
+    {
+        using var loggerFactory = StartupLogging.CreateLoggerFactory(configuration);
+        LoadModules(mvcCoreBuilder, configuration, hostingEnvironment,
+            (name, mainAssemblyPath, hostAssemblyNames) =>
+                new IsolatedLoadContext(name, mainAssemblyPath, hostAssemblyNames),
+            loggerFactory);
+    }
+
+    /// <param name="createContext">
+    ///     Creates a module's own context from its name, main assembly path and the host assembly names; tests
+    ///     create collectible ones
+    /// </param>
+    internal static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration,
+        IWebHostEnvironment hostingEnvironment, Func<string, string, ISet<string>, AssemblyLoadContext> createContext,
+        ILoggerFactory loggerFactory)
     {
         var modules = GetFeatureList(configuration);
         if (modules.Count == 0)
         {
             return;
         }
-        var logger = CreateLogger(mvcCoreBuilder.Services);
+
+        var config = new ExtensionsConfig();
+        configuration.GetSection("Extensions").Bind(config);
+        var logger = loggerFactory.CreateLogger(LOGGER_NAME);
+        var hostAssemblyNames = PluginManager.HostAssemblyNames();
         foreach (var module in modules)
         {
             if (!module.IsEnabled)
@@ -47,12 +81,32 @@ public static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration co
                 logger.LogInformation("Module '{ModuleName}' is disabled.", module.FeatureName);
                 continue;
             }
-            LoadModule(module.FeatureName, hostingEnvironment, mvcCoreBuilder, logger);
+
+            var error = LoadModule(module.FeatureName, hostingEnvironment, mvcCoreBuilder, logger,
+                mainAssemblyPath => createContext(module.FeatureName, mainAssemblyPath, hostAssemblyNames));
+            if (error == null)
+                continue;
+
+            logger.LogCritical("Module '{ModuleName}' could not be loaded: {LoadError}", module.FeatureName, error);
+            if (config.FailOnPluginLoadError)
+                throw new GrandException($"The module '{module.FeatureName}' could not be loaded: {error}");
         }
     }
 
-    private static void LoadModule(string moduleName, IWebHostEnvironment hostingEnvironment,
-            IMvcCoreBuilder mvcCoreBuilder, ILogger logger)
+    /// <summary>
+    ///     Whether the assembly belongs to a module that failed to load; its types must not be scanned
+    /// </summary>
+    internal static bool IsFailedModule(Assembly assembly)
+    {
+        ArgumentNullException.ThrowIfNull(assembly);
+
+        var context = AssemblyLoadContext.GetLoadContext(assembly);
+        return context != null && FailedContexts.TryGetValue(context, out _);
+    }
+
+    /// <returns>The reason the module could not be loaded; null when it is loaded, or has no files to load</returns>
+    private static string LoadModule(string moduleName, IWebHostEnvironment hostingEnvironment,
+        IMvcCoreBuilder mvcCoreBuilder, ILogger logger, Func<string, AssemblyLoadContext> createContext)
     {
         var modulePath = GetModulePath(hostingEnvironment, moduleName);
         var moduleFile = Path.Combine(modulePath, $"{moduleName}.dll");
@@ -61,73 +115,74 @@ private static void LoadModule(string moduleName, IWebHostEnvironment hostingEnv
         {
             logger.LogWarning("Module '{ModuleName}' does not exist at path: {ModulePath}",
                 moduleName, moduleFile);
-            return;
+            return null;
         }
 
+        AssemblyLoadContext context = null;
         try
         {
-            var assemblyLoadContext = new ModuleLoadContext();
-            LoadModuleDependencies(modulePath, assemblyLoadContext, mvcCoreBuilder, logger);
+            context = createContext(moduleFile);
+            var assembly = context.LoadFromAssemblyPath(moduleFile);
+
+            //resolved now, so a dependency the context cannot provide fails the module here instead of a type scan
+            //or a request
+            _ = assembly.GetTypes();
+            var error = ResolveReferences(assembly, context);
+            if (error != null)
+            {
+                FailedContexts.AddOrUpdate(context, null);
+                return error;
+            }
+
+            AddApplicationPart(mvcCoreBuilder, assembly);
             logger.LogInformation("Module '{ModuleName}' has been successfully loaded.", moduleName);
+            return null;
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Failed to load module '{ModuleName}'. Error: {Error}",
-                moduleName, ex.Message);
+            if (context != null)
+                FailedContexts.AddOrUpdate(context, null);
+
+            return ex is ReflectionTypeLoadException typeLoad
+                ? typeLoad.LoaderExceptions.FirstOrDefault(x => x != null)?.Message ?? ex.Message
+                : ex.Message;
         }
     }
-    private static void LoadModuleDependencies(string modulePath, ModuleLoadContext assemblyLoadContext,
-            IMvcCoreBuilder mvcCoreBuilder, ILogger logger)
-    {
-        var loadedAssemblies = AppDomain.CurrentDomain.GetAssemblies()
-            .Select(a => a.Location)
-            .ToHashSet();
 
-        foreach (var dependencyDll in Directory.GetFiles(modulePath, "*.dll"))
+    /// <summary>
+    ///     Resolves every assembly the module references. The application's copy of an assembly wins over the
+    ///     module's, and the runtime binds it whatever its version, so one older than the module was built against
+    ///     is reported here: it would fail only once a request reached the member it lacks.
+    /// </summary>
+    /// <returns>The reason the module cannot use its references; null when it can</returns>
+    private static string ResolveReferences(Assembly assembly, AssemblyLoadContext context)
+    {
+        foreach (var reference in assembly.GetReferencedAssemblies())
         {
-            if (loadedAssemblies.Contains(dependencyDll))
-                continue;
-
-            try
-            {
-                var assembly = assemblyLoadContext.LoadFromAssemblyPath(dependencyDll);
-                AddApplicationPart(mvcCoreBuilder, assembly);
-                logger.LogDebug("Successfully loaded dependency: {Dependency}", dependencyDll);
-            }
-            catch (Exception ex)
-            {
-                logger.LogWarning(ex, "Failed to load dependency: {Dependency}", dependencyDll);
-            }
+            var resolved = context.LoadFromAssemblyName(reference).GetName();
+            if (reference.Version != null && resolved.Version != null && resolved.Version < reference.Version)
+                return $"it is built against {reference.Name} {reference.Version}, " +
+                       $"but the application provides {resolved.Version}";
         }
+
+        return null;
     }
 
     private static string GetModulePath(IWebHostEnvironment hostingEnvironment, string moduleName)
            => Path.Combine(hostingEnvironment.ContentRootPath, MODULES_DIRECTORY, moduleName);
 
-    private static ILogger CreateLogger(IServiceCollection services)
-        => services.BuildServiceProvider()
-            .GetService<ILoggerFactory>()
-            ?.CreateLogger(LOGGER_NAME)
-            ?? throw new InvalidOperationException("Logger factory not found in services.");
-
+    /// <summary>
+    ///     Adds the module's own assembly and its related assemblies; its dependencies are not application parts
+    /// </summary>
     private static void AddApplicationPart(IMvcCoreBuilder mvcCoreBuilder, Assembly assembly)
     {
-        mvcCoreBuilder.AddApplicationPart(assembly);
-
-        var relatedAssemblies = RelatedAssemblyAttribute.GetRelatedAssemblies(assembly, false);
-        foreach (var relatedAssembly in relatedAssemblies)
-        {
-            var applicationPartFactory = ApplicationPartFactory.GetApplicationPartFactory(relatedAssembly);
-            foreach (var part in applicationPartFactory.GetApplicationParts(relatedAssembly))
-                mvcCoreBuilder.PartManager.ApplicationParts.Add(part);
-        }
-    }
-
-    private class ModuleLoadContext : AssemblyLoadContext
-    {
-        public ModuleLoadContext() : base(isCollectible: true)
-        {
+        //related parts are read first, so a failure adds nothing
+        var relatedParts = RelatedAssemblyAttribute.GetRelatedAssemblies(assembly, false)
+            .SelectMany(x => ApplicationPartFactory.GetApplicationPartFactory(x).GetApplicationParts(x))
+            .ToList();
 
-        }
+        mvcCoreBuilder.AddApplicationPart(assembly);
+        foreach (var part in relatedParts)
+            mvcCoreBuilder.PartManager.ApplicationParts.Add(part);
     }
-}
\ No newline at end of file
+}
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index 512326a9c3..05cbafb957 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -32,6 +32,8 @@ public static class PluginManager
     private static DirectoryInfo _copyFolder;
     private static DirectoryInfo _pluginFolder;
     private static ExtensionsConfig _config;
+    //not disposed after Load: LoadForInstall logs to it while the application runs
+    private static ILoggerFactory _loggerFactory;
     private static ILogger _logger;
 
     //what LoadForInstall needs to load a plugin as Load would have
@@ -90,8 +92,9 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
         {
             ArgumentNullException.ThrowIfNull(mvcCoreBuilder);
 
-            _logger = mvcCoreBuilder.Services.BuildServiceProvider().GetService<ILoggerFactory>()
-                .CreateLogger("PluginManager");
+            _loggerFactory?.Dispose();
+            _loggerFactory = StartupLogging.CreateLoggerFactory(configuration);
+            _logger = _loggerFactory.CreateLogger("PluginManager");
 
             _pluginFolder = new DirectoryInfo(Path.Combine(hostEnvironment.ContentRootPath, CommonPath.Plugins));
             _copyFolder = new DirectoryInfo(Path.Combine(hostEnvironment.ContentRootPath, CommonPath.Plugins, "bin"));
diff --git a/src/Core/Grand.Infrastructure/StartupLogging.cs b/src/Core/Grand.Infrastructure/StartupLogging.cs
new file mode 100644
index 0000000000..3222e0e1aa
--- /dev/null
+++ b/src/Core/Grand.Infrastructure/StartupLogging.cs
@@ -0,0 +1,21 @@
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+
+namespace Grand.Infrastructure;
+
+/// <summary>
+///     Logging for code that runs while services are being registered, before the application's logger exists:
+///     the console, filtered by the application's Logging section. Building a service provider for a logger at
+///     that stage would create a second container and the singletons registered so far.
+/// </summary>
+internal static class StartupLogging
+{
+    public static ILoggerFactory CreateLoggerFactory(IConfiguration configuration)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+
+        return LoggerFactory.Create(builder => builder
+            .AddConfiguration(configuration.GetSection("Logging"))
+            .AddConsole());
+    }
+}
diff --git a/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs b/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
index d0faac108e..4f4cc4aeaf 100644
--- a/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
+++ b/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
@@ -1,4 +1,5 @@
-using Grand.Infrastructure.Plugins;
+using Grand.Infrastructure.Modules;
+using Grand.Infrastructure.Plugins;
 using Grand.Infrastructure.Roslyn;
 using System.Collections.Concurrent;
 using System.Collections.ObjectModel;
@@ -59,6 +60,8 @@ private static IList<Assembly> AssembliesInAppDomain()
             if (addedAssemblyNames.Contains(assembly.FullName)) continue;
             //an uninstalled plugin contributes no types to any scan
             if (!PluginExtensions.OnlyInstalledPlugins(assembly)) continue;
+            //nor does a module that failed to load; its types may not even resolve
+            if (ModuleLoader.IsFailedModule(assembly)) continue;
             assemblies.Add(assembly);
             addedAssemblyNames.Add(assembly.FullName);
         }
diff --git a/src/Modules/Grand.Module.Scim/Grand.Module.Scim.csproj b/src/Modules/Grand.Module.Scim/Grand.Module.Scim.csproj
index bef073f488..e980a0455a 100644
--- a/src/Modules/Grand.Module.Scim/Grand.Module.Scim.csproj
+++ b/src/Modules/Grand.Module.Scim/Grand.Module.Scim.csproj
@@ -12,6 +12,14 @@
             <Private>False</Private>
 			<ExcludeAssets>runtime</ExcludeAssets>
         </ProjectReference>
+		<ProjectReference Include="..\..\Core\Grand.Mapping\Grand.Mapping.csproj">
+			<Private>False</Private>
+			<ExcludeAssets>runtime</ExcludeAssets>
+		</ProjectReference>
+		<ProjectReference Include="..\..\Core\Grand.Mediator\Grand.Mediator.csproj">
+			<Private>False</Private>
+			<ExcludeAssets>runtime</ExcludeAssets>
+		</ProjectReference>
 		<ProjectReference Include="..\..\Core\Grand.Infrastructure\Grand.Infrastructure.csproj">
             <Private>False</Private>
 			<ExcludeAssets>runtime</ExcludeAssets>
diff --git a/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs
new file mode 100644
index 0000000000..aea3e12618
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs
@@ -0,0 +1,231 @@
+using Grand.Infrastructure.Modules;
+using Grand.Infrastructure.Tests.Plugins.Fixtures;
+using Grand.Mediator;
+using Grand.SharedKernel;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.ApplicationParts;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using System.Reflection;
+using System.Runtime.Loader;
+
+namespace Grand.Infrastructure.Tests.Modules;
+
+[TestClass]
+[DoNotParallelize]
+public class ModuleLoaderTests
+{
+    private static readonly string MediatorAssemblyPath = typeof(IRequestHandler<,>).Assembly.Location;
+
+    private PluginFolderFixture _fixture;
+    private CapturingLoggerProvider _logs;
+
+    private string ContentRoot => Path.GetDirectoryName(_fixture.PluginsFolder)!;
+
+    [TestInitialize]
+    public void Init()
+    {
+        _fixture = new PluginFolderFixture();
+        _logs = new CapturingLoggerProvider();
+    }
+
+    [TestCleanup]
+    public void Cleanup()
+    {
+        _fixture.Dispose();
+    }
+
+    [TestMethod]
+    public void LoadModules_HostAssemblyCopyInModuleFolder_UsesHostCopy()
+    {
+        File.Copy(MediatorAssemblyPath, Path.Combine(ModuleFolder("Grand.Module.Fake"), "Grand.Mediator.dll"));
+        AddModule("Grand.Module.Fake", """
+            public class Ping : Grand.Mediator.IRequest<string> { }
+            public class PingHandler : Grand.Mediator.IRequestHandler<Ping, string>
+            {
+                public System.Threading.Tasks.Task<string> Handle(Ping request,
+                    System.Threading.CancellationToken cancellationToken) => System.Threading.Tasks.Task.FromResult("pong");
+            }
+            """, MediatorAssemblyPath);
+
+        Load(false, "Grand.Module.Fake");
+
+        var handler = _fixture.Loaded("Grand.Module.Fake").GetType("PingHandler", true)!;
+        Assert.IsTrue(handler.GetInterfaces()
+            .Any(x => x.IsGenericType && x.GetGenericTypeDefinition() == typeof(IRequestHandler<,>)));
+        Assert.IsFalse(LoadedByModules().Any(x => x.GetName().Name == "Grand.Mediator"));
+    }
+
+    [TestMethod]
+    public void LoadModules_OnlyModuleAssemblyIsApplicationPart()
+    {
+        //a private library of the module, loaded when the module's code needs it
+        var lib = TestPluginBuilder.Compile(ModuleFolder("Grand.Module.Parts"), "Parts.Lib",
+            "namespace PartsLib { public static class Lib { public static string Value() => \"from lib\"; } }");
+        AddModule("Grand.Module.Parts", """
+            public class PartsEndpoint : Microsoft.AspNetCore.Mvc.ControllerBase { }
+            public static class Entry { public static string Run() => PartsLib.Lib.Value(); }
+            """, lib);
+
+        var mvcCoreBuilder = Load(false, "Grand.Module.Parts");
+
+        var module = _fixture.Loaded("Grand.Module.Parts");
+        CollectionAssert.AreEqual(new[] { module }, ModuleParts(mvcCoreBuilder));
+        Assert.AreEqual("from lib", module.GetType("Entry", true)!.GetMethod("Run")!.Invoke(null, null));
+    }
+
+    [TestMethod]
+    public void LoadModules_ModuleThatCannotLoad_IsLoggedCriticalAndLeftOut()
+    {
+        //its base class is in an assembly it does not ship
+        var missing = _fixture.CompileElsewhere("Broken.Missing", "namespace Missing { public class Base { } }");
+        //it uses GrandNode, so a type scan would include it
+        AddModule("Grand.Module.Broken", """
+            public class Derived : Missing.Base { }
+            public class Startup { public Grand.Infrastructure.Plugins.IPlugin Plugin; }
+            """, missing);
+        AddModule("Grand.Module.Healthy", "public class Healthy { }");
+
+        var mvcCoreBuilder = Load(false, "Grand.Module.Broken", "Grand.Module.Healthy");
+
+        Assert.IsTrue(_logs.Entries.Any(x =>
+            x.Level == LogLevel.Critical && x.Message.Contains("Grand.Module.Broken") &&
+            x.Message.Contains("Broken.Missing")));
+        var parts = ModuleParts(mvcCoreBuilder);
+        Assert.IsFalse(parts.Any(x => x.GetName().Name == "Grand.Module.Broken"));
+        Assert.IsTrue(parts.Any(x => x.GetName().Name == "Grand.Module.Healthy"));
+        //its types would fail every scan
+        Assert.IsFalse(new Infrastructure.TypeSearch.TypeSearcher().GetAssemblies().Any(x => x.GetName().Name == "Grand.Module.Broken"));
+    }
+
+    [TestMethod]
+    public void LoadModules_ModuleThatCannotLoad_FailOnPluginLoadError_Throws()
+    {
+        var missing = _fixture.CompileElsewhere("Broken.Missing", "namespace Missing { public class Base { } }");
+        AddModule("Grand.Module.Broken", "public class Derived : Missing.Base { }", missing);
+
+        var ex = Assert.Throws<GrandException>(() => Load(true, "Grand.Module.Broken"));
+        Assert.Contains("Grand.Module.Broken", ex.Message);
+    }
+
+    [TestMethod]
+    public void LoadModules_ModuleBuiltAgainstNewerHostAssembly_FailsAtStartup()
+    {
+        //the host's copy wins, and it is older than the one the module was built against; used only in a method
+        //body, so without the check the first request running it would fail
+        var newer = TestPluginBuilder.Compile(Path.Combine(ContentRoot, "newer"), "Grand.Mediator",
+            "namespace Grand.Mediator { public interface INewer { } }", new Version(99, 0, 0, 0));
+        File.Copy(newer, Path.Combine(ModuleFolder("Grand.Module.Newer"), "Grand.Mediator.dll"));
+        CompileAgainst(ModuleFolder("Grand.Module.Newer"), "Grand.Module.Newer",
+            "public static class Uses { public static object M() => typeof(Grand.Mediator.INewer); }", newer);
+
+        var mvcCoreBuilder = Load(false, "Grand.Module.Newer");
+
+        Assert.IsTrue(_logs.Entries.Any(x =>
+            x.Level == LogLevel.Critical && x.Message.Contains("Grand.Module.Newer") &&
+            x.Message.Contains("Grand.Mediator")));
+        Assert.IsFalse(ModuleParts(mvcCoreBuilder).Any());
+    }
+
+    private string ModuleFolder(string moduleName)
+    {
+        var folder = Path.Combine(ContentRoot, "Modules", moduleName);
+        Directory.CreateDirectory(folder);
+        return folder;
+    }
+
+    private string AddModule(string moduleName, string source, params string[] references)
+    {
+        return TestPluginBuilder.Compile(ModuleFolder(moduleName), moduleName, source, null,
+            [PluginFolderFixture.CoreAssemblyPath, .. references]);
+    }
+
+    /// <summary>
+    ///     Compiles against <paramref name="replacement" /> in place of the platform assembly of the same name
+    /// </summary>
+    private static void CompileAgainst(string outputDir, string assemblyName, string source, string replacement)
+    {
+        var replaced = Path.GetFileName(replacement);
+        var references = ((string)AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES")!)
+            .Split(Path.PathSeparator)
+            .Where(x => !string.Equals(Path.GetFileName(x), replaced, StringComparison.OrdinalIgnoreCase))
+            .Append(replacement)
+            .Select(x => MetadataReference.CreateFromFile(x));
+        var result = CSharpCompilation.Create(assemblyName, [CSharpSyntaxTree.ParseText(source)], references,
+                new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary))
+            .Emit(Path.Combine(outputDir, assemblyName + ".dll"));
+        Assert.IsTrue(result.Success, string.Join(Environment.NewLine, result.Diagnostics));
+    }
+
+    private IMvcCoreBuilder Load(bool failOnPluginLoadError, params string[] modules)
+    {
+        var settings = modules.ToDictionary(x => "FeatureManagement:" + x, _ => "true");
+        settings["Extensions:FailOnPluginLoadError"] = failOnPluginLoadError.ToString();
+        var configuration = new ConfigurationBuilder().AddInMemoryCollection(settings!).Build();
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(ContentRoot);
+        var mvcCoreBuilder = new ServiceCollection().AddMvcCore();
+
+        using var loggerFactory = LoggerFactory.Create(x => x.AddProvider(_logs));
+        ModuleLoader.LoadModules(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.CreateContext,
+            loggerFactory);
+        return mvcCoreBuilder;
+    }
+
+    private IEnumerable<Assembly> LoadedByModules() => _fixture.Contexts.SelectMany(x => x.Assemblies);
+
+    /// <summary>
+    ///     The application parts whose assembly a module context loaded
+    /// </summary>
+    private List<Assembly> ModuleParts(IMvcCoreBuilder mvcCoreBuilder)
+    {
+        var contexts = _fixture.Contexts;
+        return mvcCoreBuilder.PartManager.ApplicationParts.OfType<AssemblyPart>()
+            .Select(x => x.Assembly)
+            .Where(x => contexts.Contains(AssemblyLoadContext.GetLoadContext(x)))
+            .ToList();
+    }
+
+    private sealed class CapturingLoggerProvider : ILoggerProvider
+    {
+        private readonly List<(LogLevel Level, string Message)> _entries = [];
+
+        public IReadOnlyList<(LogLevel Level, string Message)> Entries
+        {
+            get
+            {
+                lock (_entries)
+                {
+                    return _entries.ToList();
+                }
+            }
+        }
+
+        public ILogger CreateLogger(string categoryName) => new Logger(this);
+
+        public void Dispose()
+        {
+        }
+
+        private sealed class Logger(CapturingLoggerProvider provider) : ILogger
+        {
+            public IDisposable BeginScope<TState>(TState state) where TState : notnull => null;
+
+            public bool IsEnabled(LogLevel logLevel) => true;
+
+            public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception exception,
+                Func<TState, Exception, string> formatter)
+            {
+                lock (provider._entries)
+                {
+                    provider._entries.Add((logLevel, formatter(state, exception)));
+                }
+            }
+        }
+    }
+}
diff --git a/src/Web/Grand.Web.Admin/App_Data/appsettings.json b/src/Web/Grand.Web.Admin/App_Data/appsettings.json
index a95affe184..e76fdf99e2 100644
--- a/src/Web/Grand.Web.Admin/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Admin/App_Data/appsettings.json
@@ -134,7 +134,7 @@
     "PluginShadowCopy": true,
     //separator comma
     "InstalledPlugins": "",
-    //Stop the application when an installed plugin fails to load; false starts without it and shows the error on the admin plugin list
+    //Stop the application when an installed plugin or an enabled module fails to load; false starts without it, shows a plugin's error on the admin plugin list and logs a module's as critical
     "FailOnPluginLoadError": false
   },
   "AccessControl": {
diff --git a/src/Web/Grand.Web.Store/App_Data/appsettings.json b/src/Web/Grand.Web.Store/App_Data/appsettings.json
index da98052bee..cbfda6b718 100644
--- a/src/Web/Grand.Web.Store/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Store/App_Data/appsettings.json
@@ -134,7 +134,7 @@
     "PluginShadowCopy": true,
     //separator comma
     "InstalledPlugins": "",
-    //Stop the application when an installed plugin fails to load; false starts without it and shows the error on the admin plugin list
+    //Stop the application when an installed plugin or an enabled module fails to load; false starts without it, shows a plugin's error on the admin plugin list and logs a module's as critical
     "FailOnPluginLoadError": false
   },
   "AccessControl": {
diff --git a/src/Web/Grand.Web.Vendor/App_Data/appsettings.json b/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
index a95affe184..e76fdf99e2 100644
--- a/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
+++ b/src/Web/Grand.Web.Vendor/App_Data/appsettings.json
@@ -134,7 +134,7 @@
     "PluginShadowCopy": true,
     //separator comma
     "InstalledPlugins": "",
-    //Stop the application when an installed plugin fails to load; false starts without it and shows the error on the admin plugin list
+    //Stop the application when an installed plugin or an enabled module fails to load; false starts without it, shows a plugin's error on the admin plugin list and logs a module's as critical
     "FailOnPluginLoadError": false
   },
   "AccessControl": {
diff --git a/src/Web/Grand.Web/App_Data/appsettings.json b/src/Web/Grand.Web/App_Data/appsettings.json
index 5e48700de3..0ca3e0e82a 100644
--- a/src/Web/Grand.Web/App_Data/appsettings.json
+++ b/src/Web/Grand.Web/App_Data/appsettings.json
@@ -148,7 +148,7 @@
     "PluginShadowCopy": true,
     //separator comma
     "InstalledPlugins": "",
-    //Stop the application when an installed plugin fails to load; false starts without it and shows the error on the admin plugin list
+    //Stop the application when an installed plugin or an enabled module fails to load; false starts without it, shows a plugin's error on the admin plugin list and logs a module's as critical
     "FailOnPluginLoadError": false
   },
   "AccessControl": {

From 4bce3b5221f3b3479aa2e6c3389e74fd84973ecf Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 09:24:37 +0100
Subject: [PATCH 18/30] Keep the plugin and module loader logs on every
 configured logging provider

---
 .../Modules/ModuleLoader.cs                   | 15 +++--
 .../Grand.Infrastructure/StartupLogging.cs    | 21 -------
 .../Modules/ModuleLoaderTests.cs              | 57 ++++++-------------
 .../Fixtures/CapturingLoggerProvider.cs       | 44 ++++++++++++++
 .../Plugins/PluginManagerTests.cs             | 21 ++++++-
 5 files changed, 92 insertions(+), 66 deletions(-)
 delete mode 100644 src/Core/Grand.Infrastructure/StartupLogging.cs
 create mode 100644 src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/CapturingLoggerProvider.cs

diff --git a/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs b/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
index 655f8c56cc..bfdcf1f5f2 100644
--- a/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
+++ b/src/Core/Grand.Infrastructure/Modules/ModuleLoader.cs
@@ -49,20 +49,20 @@ public static class ModuleLoader
     [MethodImpl(MethodImplOptions.NoInlining)]
     public static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration, IWebHostEnvironment hostingEnvironment)
     {
-        using var loggerFactory = StartupLogging.CreateLoggerFactory(configuration);
         LoadModules(mvcCoreBuilder, configuration, hostingEnvironment,
             (name, mainAssemblyPath, hostAssemblyNames) =>
                 new IsolatedLoadContext(name, mainAssemblyPath, hostAssemblyNames),
-            loggerFactory);
+            () => GetLoggerFactory(mvcCoreBuilder.Services));
     }
 
     /// <param name="createContext">
     ///     Creates a module's own context from its name, main assembly path and the host assembly names; tests
     ///     create collectible ones
     /// </param>
+    /// <param name="getLoggerFactory">The logger factory, asked for only when there are modules to load</param>
     internal static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configuration,
         IWebHostEnvironment hostingEnvironment, Func<string, string, ISet<string>, AssemblyLoadContext> createContext,
-        ILoggerFactory loggerFactory)
+        Func<ILoggerFactory> getLoggerFactory)
     {
         var modules = GetFeatureList(configuration);
         if (modules.Count == 0)
@@ -72,7 +72,7 @@ internal static void LoadModules(IMvcCoreBuilder mvcCoreBuilder, IConfiguration
 
         var config = new ExtensionsConfig();
         configuration.GetSection("Extensions").Bind(config);
-        var logger = loggerFactory.CreateLogger(LOGGER_NAME);
+        var logger = getLoggerFactory().CreateLogger(LOGGER_NAME);
         var hostAssemblyNames = PluginManager.HostAssemblyNames();
         foreach (var module in modules)
         {
@@ -168,6 +168,13 @@ private static string ResolveReferences(Assembly assembly, AssemblyLoadContext c
         return null;
     }
 
+    /// <summary>
+    ///     The application's logging, with every provider configured so far (console, event log, OpenTelemetry)
+    /// </summary>
+    private static ILoggerFactory GetLoggerFactory(IServiceCollection services)
+        => services.BuildServiceProvider().GetService<ILoggerFactory>()
+           ?? throw new InvalidOperationException("Logger factory not found in services.");
+
     private static string GetModulePath(IWebHostEnvironment hostingEnvironment, string moduleName)
            => Path.Combine(hostingEnvironment.ContentRootPath, MODULES_DIRECTORY, moduleName);
 
diff --git a/src/Core/Grand.Infrastructure/StartupLogging.cs b/src/Core/Grand.Infrastructure/StartupLogging.cs
deleted file mode 100644
index 3222e0e1aa..0000000000
--- a/src/Core/Grand.Infrastructure/StartupLogging.cs
+++ /dev/null
@@ -1,21 +0,0 @@
-using Microsoft.Extensions.Configuration;
-using Microsoft.Extensions.Logging;
-
-namespace Grand.Infrastructure;
-
-/// <summary>
-///     Logging for code that runs while services are being registered, before the application's logger exists:
-///     the console, filtered by the application's Logging section. Building a service provider for a logger at
-///     that stage would create a second container and the singletons registered so far.
-/// </summary>
-internal static class StartupLogging
-{
-    public static ILoggerFactory CreateLoggerFactory(IConfiguration configuration)
-    {
-        ArgumentNullException.ThrowIfNull(configuration);
-
-        return LoggerFactory.Create(builder => builder
-            .AddConfiguration(configuration.GetSection("Logging"))
-            .AddConsole());
-    }
-}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs
index aea3e12618..552175cd81 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Modules/ModuleLoaderTests.cs
@@ -132,6 +132,23 @@ public void LoadModules_ModuleBuiltAgainstNewerHostAssembly_FailsAtStartup()
         Assert.IsFalse(ModuleParts(mvcCoreBuilder).Any());
     }
 
+    [TestMethod]
+    public void LoadModules_LogsToTheLoggingProvidersOfTheServices()
+    {
+        //an enabled module without files: nothing is loaded, it is only logged
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string> { ["FeatureManagement:Grand.Module.Absent"] = "true" })
+            .Build();
+        var hostEnvironment = new Mock<IWebHostEnvironment>();
+        hostEnvironment.Setup(x => x.ContentRootPath).Returns(ContentRoot);
+        var mvcCoreBuilder = new ServiceCollection().AddLogging(x => x.AddProvider(_logs)).AddMvcCore();
+
+        ModuleLoader.LoadModules(mvcCoreBuilder, configuration, hostEnvironment.Object);
+
+        Assert.IsTrue(_logs.Entries.Any(x =>
+            x.Category == "ModuleManager" && x.Level == LogLevel.Warning && x.Message.Contains("Grand.Module.Absent")));
+    }
+
     private string ModuleFolder(string moduleName)
     {
         var folder = Path.Combine(ContentRoot, "Modules", moduleName);
@@ -173,7 +190,7 @@ private IMvcCoreBuilder Load(bool failOnPluginLoadError, params string[] modules
 
         using var loggerFactory = LoggerFactory.Create(x => x.AddProvider(_logs));
         ModuleLoader.LoadModules(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.CreateContext,
-            loggerFactory);
+            () => loggerFactory);
         return mvcCoreBuilder;
     }
 
@@ -190,42 +207,4 @@ private List<Assembly> ModuleParts(IMvcCoreBuilder mvcCoreBuilder)
             .Where(x => contexts.Contains(AssemblyLoadContext.GetLoadContext(x)))
             .ToList();
     }
-
-    private sealed class CapturingLoggerProvider : ILoggerProvider
-    {
-        private readonly List<(LogLevel Level, string Message)> _entries = [];
-
-        public IReadOnlyList<(LogLevel Level, string Message)> Entries
-        {
-            get
-            {
-                lock (_entries)
-                {
-                    return _entries.ToList();
-                }
-            }
-        }
-
-        public ILogger CreateLogger(string categoryName) => new Logger(this);
-
-        public void Dispose()
-        {
-        }
-
-        private sealed class Logger(CapturingLoggerProvider provider) : ILogger
-        {
-            public IDisposable BeginScope<TState>(TState state) where TState : notnull => null;
-
-            public bool IsEnabled(LogLevel logLevel) => true;
-
-            public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception exception,
-                Func<TState, Exception, string> formatter)
-            {
-                lock (provider._entries)
-                {
-                    provider._entries.Add((logLevel, formatter(state, exception)));
-                }
-            }
-        }
-    }
 }
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/CapturingLoggerProvider.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/CapturingLoggerProvider.cs
new file mode 100644
index 0000000000..333f02b6be
--- /dev/null
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/Fixtures/CapturingLoggerProvider.cs
@@ -0,0 +1,44 @@
+using Microsoft.Extensions.Logging;
+
+namespace Grand.Infrastructure.Tests.Plugins.Fixtures;
+
+/// <summary>
+///     Keeps every entry logged through it, for tests that check what a loader logged
+/// </summary>
+public sealed class CapturingLoggerProvider : ILoggerProvider
+{
+    private readonly List<(string Category, LogLevel Level, string Message)> _entries = [];
+
+    public IReadOnlyList<(string Category, LogLevel Level, string Message)> Entries
+    {
+        get
+        {
+            lock (_entries)
+            {
+                return _entries.ToList();
+            }
+        }
+    }
+
+    public ILogger CreateLogger(string categoryName) => new Logger(this, categoryName);
+
+    public void Dispose()
+    {
+    }
+
+    private sealed class Logger(CapturingLoggerProvider provider, string category) : ILogger
+    {
+        public IDisposable BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception exception,
+            Func<TState, Exception, string> formatter)
+        {
+            lock (provider._entries)
+            {
+                provider._entries.Add((category, logLevel, formatter(state, exception)));
+            }
+        }
+    }
+}
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
index 3f9bd634d5..59c7dd3913 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
@@ -6,6 +6,7 @@
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 using Moq;
 using System.Collections;
@@ -248,7 +249,19 @@ public void Load_ShadowCopyOff_LoadsFromThePluginFolderAndKeepsDepsJson()
         Assert.IsFalse(Directory.Exists(ShadowFolder("Direct")));
     }
 
-    private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = false, bool shadowCopy = false)
+    [TestMethod]
+    public void Load_LogsToTheLoggingProvidersOfTheServices()
+    {
+        var logs = new CapturingLoggerProvider();
+
+        Load(logs: logs);
+
+        Assert.IsTrue(logs.Entries.Any(x =>
+            x.Category == "PluginManager" && x.Message.Contains("Creating shadow copy folder")));
+    }
+
+    private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = false, bool shadowCopy = false,
+        CapturingLoggerProvider logs = null)
     {
         var configuration = new ConfigurationBuilder()
             .AddInMemoryCollection(new Dictionary<string, string> {
@@ -259,7 +272,11 @@ private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = fa
             .Build();
         var hostEnvironment = new Mock<IWebHostEnvironment>();
         hostEnvironment.Setup(x => x.ContentRootPath).Returns(Path.GetDirectoryName(_fixture.PluginsFolder)!);
-        var mvcCoreBuilder = new ServiceCollection().AddLogging().AddMvcCore();
+        var mvcCoreBuilder = new ServiceCollection().AddLogging(x =>
+        {
+            if (logs != null)
+                x.AddProvider(logs);
+        }).AddMvcCore();
 
         PluginManager.Load(mvcCoreBuilder, configuration, hostEnvironment.Object, _fixture.CreateContext);
     }

From 9e02ecd3cb0da16f2e4cb42b25bd14c6b4fbc8b4 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 09:24:53 +0100
Subject: [PATCH 19/30] Keep the plugin manager's log on every configured
 logging provider

---
 src/Core/Grand.Infrastructure/Plugins/PluginManager.cs | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index 05cbafb957..512326a9c3 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -32,8 +32,6 @@ public static class PluginManager
     private static DirectoryInfo _copyFolder;
     private static DirectoryInfo _pluginFolder;
     private static ExtensionsConfig _config;
-    //not disposed after Load: LoadForInstall logs to it while the application runs
-    private static ILoggerFactory _loggerFactory;
     private static ILogger _logger;
 
     //what LoadForInstall needs to load a plugin as Load would have
@@ -92,9 +90,8 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
         {
             ArgumentNullException.ThrowIfNull(mvcCoreBuilder);
 
-            _loggerFactory?.Dispose();
-            _loggerFactory = StartupLogging.CreateLoggerFactory(configuration);
-            _logger = _loggerFactory.CreateLogger("PluginManager");
+            _logger = mvcCoreBuilder.Services.BuildServiceProvider().GetService<ILoggerFactory>()
+                .CreateLogger("PluginManager");
 
             _pluginFolder = new DirectoryInfo(Path.Combine(hostEnvironment.ContentRootPath, CommonPath.Plugins));
             _copyFolder = new DirectoryInfo(Path.Combine(hostEnvironment.ContentRootPath, CommonPath.Plugins, "bin"));

From faa9ebc5bb930f4689954ceac0087097ad7c84ba Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 16:48:36 +0100
Subject: [PATCH 20/30] Resolve types only in a plugin's own code, not in its
 third-party libraries

A library may hold types built on an optional assembly it never ships; GetTypes on it failed the whole plugin although it works at runtime. The check now covers the main assembly and the assemblies the reference check already treats as plugin code.
---
 .../Plugins/PluginLoader.cs                   |  9 ++++++---
 .../Plugins/PluginLoaderTests.cs              | 19 +++++++++++++++++++
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
index 27432436fc..d666bc2c41 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
@@ -50,9 +50,12 @@ string Prepared(string path) =>
                          !string.Equals(x, candidate.MainAssemblyPath, StringComparison.OrdinalIgnoreCase)))
                 assemblies.Add(context.LoadFromAssemblyName(AssemblyName.GetAssemblyName(Prepared(path))));
 
-            //every assembly is loaded before any type is resolved, so the order of the files does not matter
+            //only the plugin's own code is checked: a third-party library may hold types built on optional
+            //assemblies it never ships, and it would fail here although it works at runtime.
+            //Every assembly is loaded before any type is resolved, so the order of the files does not matter
+            var pluginCode = assemblies.Where(x => x == main || IsPluginCode(x)).ToList();
             Type pluginType = null;
-            foreach (var assembly in assemblies)
+            foreach (var assembly in pluginCode)
             {
                 var types = assembly.GetTypes();
                 if (assembly == main)
@@ -64,7 +67,7 @@ string Prepared(string path) =>
 
             //a reference used only inside a method body is not needed by GetTypes; resolved here, one the context
             //cannot provide (such as another plugin's assembly) fails the load instead of a later request
-            foreach (var assembly in assemblies.Where(IsPluginCode))
+            foreach (var assembly in pluginCode)
             foreach (var reference in assembly.GetReferencedAssemblies())
                 context.LoadFromAssemblyName(reference);
 
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
index 5fd033e60b..aa980fc44b 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
@@ -98,6 +98,25 @@ public class APlugin : BasePlugin { }
         Assert.AreEqual("APlugin", plugin.PluginType.Name);
     }
 
+    [TestMethod]
+    public void Load_ThirdPartyLibraryWithTypeOnAbsentAssembly_StillLoads()
+    {
+        //a library's optional integration: a type built on an assembly the library does not ship
+        var optional = _fixture.CompileElsewhere("Loader.Optional", "namespace Optional { public class Base { } }");
+        var library = TestPluginBuilder.Compile(_fixture.Folder("P"), "Loader.ThirdParty", """
+            namespace ThirdParty { public class Used { } public class Integration : Optional.Base { } }
+            """, null, optional);
+        _fixture.AddPlugin("P", "Loader.UsesLibrary", "Loader.UsesLibrary", """
+            public class UsesLibraryPlugin : BasePlugin { public ThirdParty.Used Used { get; } = new(); }
+            """, library);
+
+        var plugin = _fixture.Load("P", true);
+
+        Assert.IsNull(plugin.LoadError);
+        Assert.IsTrue(plugin.IsActive);
+        Assert.AreEqual("UsesLibraryPlugin", plugin.PluginType.Name);
+    }
+
     [TestMethod]
     public void Problem_KnownSystemNameOfInstalledPlugin_IsInstalledAndFailsStrictMode()
     {

From 2398191860eade7cdafec99d80166f36c11ce859 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 16:48:36 +0100
Subject: [PATCH 21/30] Keep a plugin upload from replacing another plugin's
 folder

The target is the existing folder matched case-insensitively, under its exact name, so a case-variant archive root replaces it in place on every platform. An existing folder holding a plugin is only replaced by an archive with the same system name. The comment on a kept temp folder now says it stays until an operator removes it.
---
 .../Plugins/PluginArchiveInstaller.cs         | 84 +++++++++++++++----
 .../Plugins/PluginArchiveInstallerTests.cs    | 42 ++++++++++
 2 files changed, 108 insertions(+), 18 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
index cba1b32091..bf99a86f66 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginArchiveInstaller.cs
@@ -51,12 +51,16 @@ public PluginArchiveResult Install(string archivePath)
                 throw new GrandException(
                     $"This plugin doesn't support the current version - {GrandVersion.SupportedPluginVersion}");
 
-            if (IsSystemNameUsedByAnotherFolder(manifest.SystemName, folderName))
+            //an existing folder is replaced under its own name, also when the archive spells it in another case
+            var targetName = ExistingFolderName(folderName) ?? folderName;
+            CheckTargetHoldsSamePlugin(targetName, manifest.SystemName);
+
+            if (IsSystemNameUsedByAnotherFolder(manifest.SystemName, targetName))
                 throw new GrandException(
                     $"A plugin with the system name '{manifest.SystemName}' is already installed in another folder.");
 
-            Replace(sourceFolder, Path.Combine(pluginsPath, folderName), Path.Combine(tempRoot, PreviousFolderName));
-            return new PluginArchiveResult(folderName, manifest);
+            Replace(sourceFolder, Path.Combine(pluginsPath, targetName), Path.Combine(tempRoot, PreviousFolderName));
+            return new PluginArchiveResult(targetName, manifest);
         }
         catch (RollbackFailedException)
         {
@@ -249,6 +253,40 @@ private static PluginManifest ReadSingleManifest(string folder)
         };
     }
 
+    /// <summary>
+    ///     The exact name of the plugin folder that <paramref name="folderName" /> names, compared case-insensitively
+    ///     on every platform; the folder with exactly that name wins when several match. Null when there is none.
+    /// </summary>
+    private string ExistingFolderName(string folderName)
+    {
+        if (!Directory.Exists(pluginsPath))
+            return null;
+
+        var matches = Directory.GetDirectories(pluginsPath).Select(Path.GetFileName)
+            .Where(x => !IsReservedFolder(x) && string.Equals(x, folderName, StringComparison.OrdinalIgnoreCase))
+            .Order(StringComparer.Ordinal)
+            .ToList();
+
+        return matches.FirstOrDefault(x => string.Equals(x, folderName, StringComparison.Ordinal))
+               ?? matches.FirstOrDefault();
+    }
+
+    /// <summary>
+    ///     An existing folder may only be replaced by the plugin it holds; a folder without a readable plugin
+    ///     (an earlier broken upload) may be replaced by any.
+    /// </summary>
+    private void CheckTargetHoldsSamePlugin(string targetName, string systemName)
+    {
+        var target = Path.Combine(pluginsPath, targetName);
+        if (!Directory.Exists(target))
+            return;
+
+        var existing = ReadSystemNames(target);
+        if (existing.Count > 0 && !existing.Contains(systemName, StringComparer.OrdinalIgnoreCase))
+            throw new GrandException(
+                $"The folder '{targetName}' holds the plugin '{string.Join(", ", existing)}' and cannot be replaced by the plugin '{systemName}'. Rename the plugin folder in the archive.");
+    }
+
     private bool IsSystemNameUsedByAnotherFolder(string systemName, string folderName)
     {
         if (!Directory.Exists(pluginsPath))
@@ -260,24 +298,34 @@ private bool IsSystemNameUsedByAnotherFolder(string systemName, string folderNam
             if (IsReservedFolder(name) || string.Equals(name, folderName, StringComparison.OrdinalIgnoreCase))
                 continue;
 
-            foreach (var dll in Directory.GetFiles(directory, "*.dll", SearchOption.TopDirectoryOnly))
+            if (ReadSystemNames(directory).Contains(systemName, StringComparer.OrdinalIgnoreCase))
+                return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    ///     The system names declared by the manifests at the top of an installed plugin folder
+    /// </summary>
+    private static List<string> ReadSystemNames(string folder)
+    {
+        var names = new List<string>();
+        foreach (var dll in Directory.GetFiles(folder, "*.dll", SearchOption.TopDirectoryOnly))
+        {
+            try
             {
-                try
-                {
-                    var existing = PluginManifestReader.Read(dll);
-                    if (existing != null && string.Equals(existing.SystemName, systemName,
-                            StringComparison.OrdinalIgnoreCase))
-                        return true;
-                }
-                catch (Exception ex) when (ex is IOException or BadImageFormatException
-                                               or UnauthorizedAccessException)
-                {
-                    //an unreadable file in another plugin folder is not the uploaded plugin's concern
-                }
+                var manifest = PluginManifestReader.Read(dll);
+                if (!string.IsNullOrWhiteSpace(manifest?.SystemName))
+                    names.Add(manifest.SystemName);
+            }
+            catch (Exception ex) when (ex is IOException or BadImageFormatException or UnauthorizedAccessException)
+            {
+                //an unreadable file in an installed folder is not the uploaded plugin's concern
             }
         }
 
-        return false;
+        return names;
     }
 
     /// <summary>
@@ -340,7 +388,7 @@ private void DeleteTempRoot(string tempRoot)
         catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
         {
             //the previous plugin version moved here can hold an assembly this process has loaded;
-            //it is not loaded from here on the next start and the next upload removes it
+            //it is not loaded from here on the next start, and it stays here until an operator removes it
             logger.LogWarning(ex, "The temporary upload folder {TempDirectory} could not be deleted", tempRoot);
         }
     }
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
index acf043f1e3..95e52641c3 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginArchiveInstallerTests.cs
@@ -186,6 +186,48 @@ public void Install_SystemNameUsedByAnotherFolder_IsRejected()
         Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Tax.FixedRateCopy")));
     }
 
+    [TestMethod]
+    public void Install_IntoFolderOfAnotherPlugin_IsRejectedAndLeavesItUntouched()
+    {
+        var existing = BuildPluginFolder("Payments.StripeCheckout", "Payments.StripeCheckout");
+        var target = Path.Combine(_plugins, "Payments.StripeCheckout");
+        Directory.CreateDirectory(target);
+        File.Copy(Path.Combine(existing, "Payments.StripeCheckout.dll"),
+            Path.Combine(target, "Payments.StripeCheckout.dll"));
+        File.WriteAllText(Path.Combine(target, "keep.txt"), "keep");
+        var before = Hash(target);
+
+        var other = BuildPluginFolder("Payments.StripeCheckout", "Other");
+        var ex = Assert.ThrowsExactly<GrandException>(() => CreateInstaller().Install(ZipFolder(other)));
+
+        Assert.Contains("Payments.StripeCheckout", ex.Message);
+        Assert.Contains("Other", ex.Message);
+        Assert.AreEqual(before, Hash(target));
+        Assert.IsFalse(Directory.Exists(Path.Combine(_plugins, "Other")));
+    }
+
+    [TestMethod]
+    public void Install_CaseVariantRoot_ReplacesTheExistingFolderInPlace()
+    {
+        var existing = BuildPluginFolder("Payments.StripeCheckout", "Payments.StripeCheckout");
+        var target = Path.Combine(_plugins, "Payments.StripeCheckout");
+        Directory.CreateDirectory(target);
+        File.Copy(Path.Combine(existing, "Payments.StripeCheckout.dll"),
+            Path.Combine(target, "Payments.StripeCheckout.dll"));
+        File.WriteAllText(Path.Combine(target, "old.txt"), "old");
+
+        var upload = BuildPluginFolder("payments.stripecheckout", "Payments.StripeCheckout");
+        var result = CreateInstaller().Install(ZipFolder(upload));
+
+        //the existing folder's exact name, whatever the file system's case sensitivity
+        Assert.AreEqual("Payments.StripeCheckout", result.FolderName);
+        var folders = Directory.GetDirectories(_plugins).Select(Path.GetFileName)
+            .Where(x => x != "TempUploads").ToList();
+        CollectionAssert.AreEqual(new[] { "Payments.StripeCheckout" }, folders);
+        Assert.IsFalse(File.Exists(Path.Combine(target, "old.txt")));
+        Assert.IsTrue(File.Exists(Path.Combine(target, "Payments.StripeCheckout.dll")));
+    }
+
     [TestMethod]
     public void Install_TooManyEntries_IsRejected()
     {

From 98dd958e73294f91d821585e38632fcf01301884 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 16:48:37 +0100
Subject: [PATCH 22/30] Say which version an incompatible plugin was built for
 when it is created

---
 .../Grand.Infrastructure/Plugins/PluginInfo.cs   |  5 ++++-
 .../Plugins/PluginInfoTests.cs                   | 16 +++++++++++++++-
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
index b1ba2b62cb..1f8aea1e25 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
@@ -138,7 +138,10 @@ public T Instance<T>(IServiceProvider serviceProvider) where T : class, IPlugin
         if (PluginType == null)
             throw new GrandException(LoadError != null
                 ? $"Plugin {SystemName} could not be loaded: {LoadError}"
-                : $"Plugin {SystemName} has no IPlugin class");
+                : SupportedVersion != GrandVersion.SupportedPluginVersion
+                    //listed from its manifest and never loaded
+                    ? $"Plugin {SystemName} was built for GrandNode version {SupportedVersion ?? "(unknown)"} and is not compatible with the current version {GrandVersion.SupportedPluginVersion}"
+                    : $"Plugin {SystemName} has no IPlugin class");
 
         object instance;
         try
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs
index af7fd0b8dc..a2e13ae9f1 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginInfoTests.cs
@@ -34,10 +34,24 @@ public void Instance_DependencyMissing_KeepsInnerException()
     public void Instance_NoPluginType_ThrowsGrandException()
     {
         using var provider = new ServiceCollection().BuildServiceProvider();
-        var info = new PluginInfo { SystemName = "Empty" };
+        var info = new PluginInfo { SystemName = "Empty", SupportedVersion = GrandVersion.SupportedPluginVersion };
 
         var ex = Assert.Throws<GrandException>(() => info.Instance(provider));
 
         Assert.AreEqual("Plugin Empty has no IPlugin class", ex.Message);
     }
+
+    [TestMethod]
+    public void Instance_IncompatiblePlugin_SaysWhichVersionItWasBuiltFor()
+    {
+        using var provider = new ServiceCollection().BuildServiceProvider();
+        //an incompatible plugin is listed from its manifest and never loaded
+        var info = new PluginInfo { SystemName = "Old", SupportedVersion = "1.0" };
+
+        var ex = Assert.Throws<GrandException>(() => info.Instance(provider));
+
+        Assert.AreEqual(
+            $"Plugin Old was built for GrandNode version 1.0 and is not compatible with the current version {GrandVersion.SupportedPluginVersion}",
+            ex.Message);
+    }
 }

From 6f499185d78117b7ab7fc1f9d6c4559992de0304 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 16:48:37 +0100
Subject: [PATCH 23/30] Report a skip-pattern timeout as a problem of the
 plugin folder

---
 .../Plugins/PluginFolderScanner.cs             | 13 ++++++++++---
 .../Plugins/PluginFolderScannerTests.cs        | 18 ++++++++++++++++++
 2 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
index b0000a8ec4..8d82d9cfc8 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginFolderScanner.cs
@@ -139,15 +139,22 @@ private static List<ScannedFile> ScanFolder(DirectoryInfo folder, string skipPat
         var result = new List<ScannedFile>();
         foreach (var file in dlls.OrderBy(x => x.Name, StringComparer.Ordinal))
         {
-            if (IsSkipped(file.Name, skipPattern))
-                continue;
-
             try
             {
+                if (IsSkipped(file.Name, skipPattern))
+                    continue;
+
                 var scanned = ScanFile(folder, file, hostAssemblyNames, warnings);
                 if (scanned != null)
                     result.Add(scanned);
             }
+            catch (RegexMatchTimeoutException)
+            {
+                //whether the file is skipped is unknown, so the folder is not loaded, as for a file it cannot read
+                problems.Add(new PluginLoadProblem(folder.Name,
+                    $"'{file.Name}' could not be matched against Extensions:PluginSkipLoadingPattern in time; check the pattern."));
+                return null;
+            }
             catch (Exception ex) when (IsReadFailure(ex))
             {
                 problems.Add(new PluginLoadProblem(folder.Name, $"'{file.Name}' could not be read: {ex.Message}"));
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
index 0cbefe77da..c3b1996206 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginFolderScannerTests.cs
@@ -133,6 +133,24 @@ public void Scan_SkipPattern_ExcludesMatchingFiles()
         Assert.DoesNotContain("Skipped.Lib", plugin.AssemblyNames);
     }
 
+    [TestMethod]
+    public void Scan_SkipPatternTimesOut_IsProblemOfThatFolderOnly()
+    {
+        var slow = new string('a', 40);
+        AddPlugin("A", "Scan.A", "Scan.A");
+        TestPluginBuilder.Compile(Folder("A"), slow, "public class Lib { }");
+        AddPlugin("B", "Scan.B", "Scan.B");
+
+        //catastrophic backtracking on the long name; the other file names fail on the first character
+        var result = Scan("^(a+)+$");
+
+        Assert.AreEqual("B", result.Plugins.Single().Folder.Name);
+        var problem = result.Problems.Single();
+        Assert.AreEqual("A", problem.Folder);
+        Assert.Contains(slow + ".dll", problem.Message);
+        Assert.Contains("PluginSkipLoadingPattern", problem.Message);
+    }
+
     [TestMethod]
     [OSCondition(OperatingSystems.Windows)]
     public void Scan_UnreadableMainAssembly_IsProblemNamingTheFolder()

From c26fc574786984179bd4880b3caa469b12cff42f Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 16:48:37 +0100
Subject: [PATCH 24/30] Use the admin note markup for the plugin restart notice

---
 .../PluginRestartNoticeViewComponentTests.cs      | 15 +++++++++++++++
 .../Components/PluginRestartNotice/Default.cshtml |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs b/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs
index 2a93ed10e3..b9dbaf9c79 100644
--- a/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs
+++ b/src/Tests/Grand.Web.Admin.Tests/Components/PluginRestartNoticeViewComponentTests.cs
@@ -33,4 +33,19 @@ public async Task InvokeAsync_NoPendingChanges_RendersNothing()
         Assert.IsInstanceOfType(result, typeof(ContentViewComponentResult));
         permissionService.Verify(x => x.Authorize(StandardPermission.ManagePlugins), Times.Once);
     }
+
+    [TestMethod]
+    public void View_UsesTheAdminNoteMarkup()
+    {
+        //the admin UI guide keeps genuine messages in note note-*, like the other warning components
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir != null && !Directory.Exists(Path.Combine(dir.FullName, "src", "Web")))
+            dir = dir.Parent;
+        Assert.IsNotNull(dir, "repository root not found");
+        var source = File.ReadAllText(Path.Combine(dir.FullName, "src", "Web", "Grand.Web.Admin", "Areas", "Admin",
+            "Views", "Shared", "Components", "PluginRestartNotice", "Default.cshtml"));
+
+        Assert.Contains("class=\"note note-warning\"", source);
+        Assert.DoesNotContain("alert", source);
+    }
 }
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml
index 2a28223223..da12b0e63e 100644
--- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Components/PluginRestartNotice/Default.cshtml
@@ -1,7 +1,7 @@
 @using Grand.Infrastructure.Plugins
 @model IReadOnlyList<PluginPendingChange>
 @* the restart button is handled in _AdminLayout ([data-plugin-restart]), like the header's restart link *@
-<div class="alert alert-warning" role="status" id="plugin-restart-notice">
+<div class="note note-warning" role="status" id="plugin-restart-notice">
     <div class="d-flex flex-wrap align-items-center gap-2">
         <strong class="me-auto">
             <i class="bi bi-exclamation-triangle" aria-hidden="true"></i> @Loc["Admin.Plugins.RestartRequired"]

From fe0ab9bfa4d69b2c77a7a178f6add4e6a3943d74 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 21:20:31 +0100
Subject: [PATCH 25/30] Remove the plugin folder chosen on the list, also one
 whose plugin was not identified

An entry for a folder that could not be loaded has no main assembly, so Remove
failed on it, and two folders declaring one system name were told apart by
neither: Remove deleted the first, the working one. The list now carries the
folder name, and Remove finds the entry by system name and folder.
---
 .../Plugins/PluginInfo.cs                     |  7 +++
 .../Plugins/PluginLoader.cs                   |  3 ++
 .../Plugins/PluginLoaderTests.cs              |  3 ++
 .../Controllers/PluginControllerTests.cs      | 45 ++++++++++++++++++-
 .../Areas/Admin/Views/Plugin/List.cshtml      |  2 +-
 .../Controllers/PluginController.cs           |  8 ++--
 .../Models/Plugins/PluginModel.cs             |  2 +
 7 files changed, 64 insertions(+), 6 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
index 1f8aea1e25..0540cebc69 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginInfo.cs
@@ -17,6 +17,7 @@ public PluginInfo(
     {
         ReferencedAssembly = referencedAssembly;
         OriginalAssemblyFile = originalAssemblyFile;
+        FolderName = originalAssemblyFile?.Directory?.Name;
         PluginType = pluginType;
         if (referencedAssembly != null)
             AssemblyNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
@@ -67,6 +68,12 @@ public Assembly ReferencedAssembly
     /// </summary>
     public FileInfo OriginalAssemblyFile { get; internal set; }
 
+    /// <summary>
+    ///     The plugin's folder in Plugins; together with <see cref="SystemName" /> it tells apart two folders
+    ///     declaring the same system name, and it is known also for a folder whose plugin could not be identified
+    /// </summary>
+    public string FolderName { get; internal set; }
+
     /// <summary>
     ///     Gets or sets the plugin group
     /// </summary>
diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
index d666bc2c41..0b98c34a0f 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoader.cs
@@ -102,6 +102,7 @@ internal static PluginInfo Describe(PluginCandidate candidate, bool installed)
             Author = manifest.Author,
             PluginFileName = Path.GetFileName(candidate.MainAssemblyPath),
             OriginalAssemblyFile = new FileInfo(candidate.MainAssemblyPath),
+            FolderName = candidate.Folder.Name,
             AssemblyNames = new HashSet<string>(candidate.AssemblyNames, StringComparer.OrdinalIgnoreCase),
             Installed = installed
         };
@@ -122,6 +123,7 @@ public static IEnumerable<PluginInfo> DescribeProblem(PluginLoadProblem problem,
                 new PluginInfo {
                     SystemName = problem.Folder,
                     FriendlyName = problem.Folder,
+                    FolderName = problem.Folder,
                     LoadError = problem.Message
                 }
             ];
@@ -130,6 +132,7 @@ public static IEnumerable<PluginInfo> DescribeProblem(PluginLoadProblem problem,
         return problem.SystemNames.Select(name => new PluginInfo {
             SystemName = name,
             FriendlyName = name,
+            FolderName = problem.Folder,
             LoadError = problem.Message,
             Installed = installed.Contains(name)
         }).ToList();
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
index aa980fc44b..8ac3ccc88a 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginLoaderTests.cs
@@ -148,6 +148,9 @@ public void Problem_UnknownSystemName_FailsStrictModeOnly()
         Assert.IsEmpty(problem.SystemNames);
         var entries = PluginLoader.DescribeProblem(problem, []).ToList();
         Assert.AreEqual("Nameless", entries.Single().SystemName);
+        //the folder to remove, although no plugin file was identified
+        Assert.AreEqual("Nameless", entries.Single().FolderName);
+        Assert.IsNull(entries.Single().OriginalAssemblyFile);
         Assert.IsFalse(entries.Single().Installed);
 
         var ex = Assert.ThrowsExactly<GrandException>(() => PluginLoader.ThrowOnLoadError(entries, problems, true));
diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
index 1e82278ccf..3b940cf09d 100644
--- a/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
+++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/PluginControllerTests.cs
@@ -146,7 +146,7 @@ public async Task Remove_InstalledPlugin_DoesNotDeleteFolder()
 
         await WithPlugins(async () =>
         {
-            await _controller.Remove(SystemName);
+            await _controller.Remove(SystemName, "Tests.Plugin");
 
             Assert.IsTrue(Directory.Exists(folder));
             _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
@@ -217,7 +217,7 @@ await WithInstalledFile(async _ =>
             await WithPlugins(async () =>
             {
                 await _controller.Uninstall(SystemName);
-                await _controller.Remove(SystemName);
+                await _controller.Remove(SystemName, "Tests.Plugin");
 
                 Assert.IsFalse(Directory.Exists(folder));
                 _applicationLifetime.Verify(x => x.StopApplication(), Times.Never);
@@ -225,6 +225,47 @@ await WithPlugins(async () =>
         });
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Remove_SecondFolderOfASystemName_DeletesOnlyThatFolder()
+    {
+        var working = Path.Combine(_contentRoot, "Plugins", "Tests.Plugin");
+        Directory.CreateDirectory(working);
+        var mainAssembly = Path.Combine(working, "Tests.Plugin.dll");
+        await File.WriteAllTextAsync(mainAssembly, "");
+        var copy = Directory.CreateDirectory(Path.Combine(_contentRoot, "Plugins", "Tests.Plugin.Copy")).FullName;
+        var plugin = new PluginInfo(new FileInfo(mainAssembly), null, typeof(IPlugin)) {
+            SystemName = SystemName,
+            SupportedVersion = GrandVersion.SupportedPluginVersion
+        };
+        var duplicate = PluginLoader.DescribeProblem(
+            new PluginLoadProblem("Tests.Plugin.Copy", "already used", [SystemName]), []).Single();
+
+        await WithPlugins(async () =>
+        {
+            await _controller.Remove(SystemName, "Tests.Plugin.Copy");
+
+            Assert.IsFalse(Directory.Exists(copy));
+            Assert.IsTrue(Directory.Exists(working));
+        }, plugin, duplicate);
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public async Task Remove_FolderWhosePluginWasNotIdentified_DeletesIt()
+    {
+        var folder = Directory.CreateDirectory(Path.Combine(_contentRoot, "Plugins", "Broken")).FullName;
+        var entry = PluginLoader.DescribeProblem(new PluginLoadProblem("Broken", "has no SystemName"), []).Single();
+
+        await WithPlugins(async () =>
+        {
+            await _controller.Remove("Broken", "Broken");
+
+            Assert.IsFalse(Directory.Exists(folder));
+            CollectionAssert.Contains(Notifications("Success"), "Admin.Plugins.Removed.AfterRestart");
+        }, entry);
+    }
+
     [TestMethod]
     [DoNotParallelize]
     public async Task Install_AfterRemoveBeforeRestart_Refuses()
diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
index 1b8862cd42..cd4c21f4fe 100644
--- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
+++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Plugin/List.cshtml
@@ -133,7 +133,7 @@
                                     "<div class='content'><div class='title'>" + item.FriendlyName + "<span class='install-" + item.Installed + "'>@Loc["Admin.Plugins.Fields.Installed"]</span></div><ul class='info'><li class='version'><span>@Loc["Admin.Plugins.Fields.Version"]:</span>" + item.Version + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.Author"]:</span>" + item.Author + "</li><li class='version'><span>@Loc["Admin.Plugins.Fields.SystemName"]:</span>" + item.SystemName + "</li>" +
                                     (item.LoadError ? "<li class='version text-danger'><span>@Loc["Admin.Plugins.LoadError"]:</span>" + GrandAdmin.htmlEncode(item.LoadError) + "</li>" : "") +
                                     "</div></div>" +
-                                    "<div class='buttons'><a class='btn btn-outline-secondary btn-sm button-" + item.ConfigurationUrl + "' href='" + item.ConfigurationUrl + "'>@Loc["Admin.Plugins.Fields.Configure"]</a><input type='submit' formaction='@(installurl)?SystemName=" + item.SystemName + "' name='install-plugin-link-" + item.SystemName + "' class='btn btn-outline-secondary btn-sm install-plugin-link button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Install"]' /><input type='submit' formaction='@(uninstallurl)?SystemName=" + item.SystemName + "' name='uninstall-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm uninstall-plugin-link button-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Uninstall"]' /><input type='submit' formaction='@(remove)?SystemName=" + item.SystemName + "' name='remove-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Remove"]' /></div>"
+                                    "<div class='buttons'><a class='btn btn-outline-secondary btn-sm button-" + item.ConfigurationUrl + "' href='" + item.ConfigurationUrl + "'>@Loc["Admin.Plugins.Fields.Configure"]</a><input type='submit' formaction='@(installurl)?SystemName=" + item.SystemName + "' name='install-plugin-link-" + item.SystemName + "' class='btn btn-outline-secondary btn-sm install-plugin-link button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Install"]' /><input type='submit' formaction='@(uninstallurl)?SystemName=" + item.SystemName + "' name='uninstall-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm uninstall-plugin-link button-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Uninstall"]' /><input type='submit' formaction='@(remove)?SystemName=" + item.SystemName + "&folderName=" + encodeURIComponent(item.FolderName || "") + "' name='remove-plugin-link-" + item.SystemName + "' class='btn btn-outline-danger btn-sm button-installed-" + item.Installed + "' value='@Loc["Admin.Plugins.Fields.Remove"]' /></div>"
                                 +"</li>");
                             }
                         });
diff --git a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
index 6183f16ec9..b8fcd30173 100644
--- a/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
+++ b/src/Web/Grand.Web.Admin/Controllers/PluginController.cs
@@ -267,7 +267,7 @@ public async Task<IActionResult> Uninstall(string systemName)
     }
 
     [HttpPost]
-    public async Task<IActionResult> Remove(string systemName)
+    public async Task<IActionResult> Remove(string systemName, string folderName)
     {
         if (extConfig.DisableUploadExtensions)
         {
@@ -277,7 +277,9 @@ public async Task<IActionResult> Remove(string systemName)
 
         try
         {
-            var pluginInfo = PluginManager.ReferencedPlugins.FirstOrDefault(x => x.SystemName == systemName);
+            //by folder too: two folders may declare one system name, and only the chosen one is removed
+            var pluginInfo = PluginManager.ReferencedPlugins.FirstOrDefault(x => x.SystemName == systemName
+                && x.FolderName != null && string.Equals(x.FolderName, folderName, StringComparison.OrdinalIgnoreCase));
             if (pluginInfo == null)
                 //No plugin found with the specified id
                 return RedirectToAction("List");
@@ -289,7 +291,7 @@ public async Task<IActionResult> Remove(string systemName)
                 return RedirectToAction("List");
             }
 
-            DeleteDirectory(pluginInfo.OriginalAssemblyFile.DirectoryName);
+            DeleteDirectory(Path.Combine(PluginsPath, pluginInfo.FolderName));
             await auditEventRecorder.Plugin(systemName, "removed");
 
             Success(translationService.GetResource("Admin.Plugins.Removed.AfterRestart"));
diff --git a/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs b/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
index d53ee7dcc2..30610d2cb9 100644
--- a/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
+++ b/src/Web/Grand.Web.AdminShared/Models/Plugins/PluginModel.cs
@@ -14,6 +14,8 @@ public class PluginModel : BaseModel
     [GrandResourceDisplayName("Admin.Plugins.Fields.SystemName")]
     public string SystemName { get; set; }
 
+    public string FolderName { get; set; }
+
     [GrandResourceDisplayName("Admin.Plugins.Fields.Version")]
     public string Version { get; set; }
 

From 3b759ef0ded9762f441ab326e7100f2334b89ba9 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 21:21:20 +0100
Subject: [PATCH 26/30] List a second folder of an installed system name as not
 installed

The installed plugin of that name is the folder that loaded; the second one
was listed installed, so FailOnPluginLoadError stopped the application although
the plugin was working, and the list asked to uninstall it before removal.
---
 .../Plugins/PluginManager.cs                  |  7 +++++--
 .../Plugins/PluginManagerTests.cs             | 20 ++++++++++++++++++-
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index 512326a9c3..c1a12feb30 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -190,12 +190,15 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
                 mvcCoreBuilder.Services.AddScoped(plugin.PluginType);
             }
 
-            //after the loaded plugins: a lookup by a system name a second folder duplicates finds the working one
+            //after the loaded plugins: a lookup by a system name a second folder duplicates finds the working one.
+            //The installed plugin of such a name is that folder's, so the second folder is not listed installed
+            var listedSystemNames = referencedPlugins.Select(x => x.SystemName).ToHashSet(StringComparer.OrdinalIgnoreCase);
+            var installedNotListed = installedPluginSystemNames.Where(x => !listedSystemNames.Contains(x)).ToList();
             foreach (var problem in scan.Problems)
             {
                 _logger.LogError("Plugin folder {PluginFolder} could not be loaded: {LoadError}",
                     problem.Folder, problem.Message);
-                referencedPlugins.AddRange(PluginLoader.DescribeProblem(problem, installedPluginSystemNames));
+                referencedPlugins.AddRange(PluginLoader.DescribeProblem(problem, installedNotListed));
             }
 
             ReferencedPlugins = referencedPlugins;
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
index 59c7dd3913..86fb5717ff 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
@@ -249,6 +249,23 @@ public void Load_ShadowCopyOff_LoadsFromThePluginFolderAndKeepsDepsJson()
         Assert.IsFalse(Directory.Exists(ShadowFolder("Direct")));
     }
 
+    [TestMethod]
+    public void Load_SecondFolderOfAnInstalledSystemName_IsNotInstalledAndDoesNotStopTheApplication()
+    {
+        _fixture.AddPlugin("A", "Manager.TwiceA", "Manager.Twice", "public class TwiceA : BasePlugin { }");
+        _fixture.AddPlugin("B", "Manager.TwiceB", "Manager.Twice", "public class TwiceB : BasePlugin { }");
+
+        Load("Manager.Twice", failOnPluginLoadError: true);
+
+        var entries = PluginManager.ReferencedPlugins.Where(x => x.SystemName == "Manager.Twice").ToList();
+        Assert.HasCount(2, entries);
+        Assert.IsTrue(entries[0].IsActive);
+        Assert.AreEqual("A", entries[0].FolderName);
+        Assert.IsFalse(entries[1].Installed);
+        Assert.IsNotNull(entries[1].LoadError);
+        Assert.AreEqual("B", entries[1].FolderName);
+    }
+
     [TestMethod]
     public void Load_LogsToTheLoggingProvidersOfTheServices()
     {
@@ -261,12 +278,13 @@ public void Load_LogsToTheLoggingProvidersOfTheServices()
     }
 
     private void Load(string installed = "Manager.NotInstalled", bool useLiteDb = false, bool shadowCopy = false,
-        CapturingLoggerProvider logs = null)
+        CapturingLoggerProvider logs = null, bool failOnPluginLoadError = false)
     {
         var configuration = new ConfigurationBuilder()
             .AddInMemoryCollection(new Dictionary<string, string> {
                 ["Extensions:InstalledPlugins"] = installed,
                 ["Extensions:PluginShadowCopy"] = shadowCopy.ToString(),
+                ["Extensions:FailOnPluginLoadError"] = failOnPluginLoadError.ToString(),
                 ["Database:UseLiteDb"] = useLiteDb.ToString()
             })
             .Build();

From 9d77582c310388e30ddbb44d086e5eef93618984 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 21:21:21 +0100
Subject: [PATCH 27/30] Delete the shadow copies of plugin folders that are
 gone

Only the top-level files of Plugins/bin were cleared at startup, so each removed
or renamed plugin folder left its whole copy there for good.
---
 .../Plugins/PluginManager.cs                  | 23 +++++++++++++++++--
 .../Plugins/PluginManagerTests.cs             |  7 +++++-
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
index c1a12feb30..30dae1c4df 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginManager.cs
@@ -106,8 +106,26 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
             Directory.CreateDirectory(_pluginFolder.FullName);
             Directory.CreateDirectory(_copyFolder.FullName);
             if (_config.PluginShadowCopy)
-                //clear out the files of the flat layout older versions shadow copied to; each plugin's own
-                //folder below is kept, and its unchanged files are not copied again
+            {
+                //the copies of plugin folders that are gone (removed or renamed); every other plugin's copy is
+                //kept, so its unchanged files are not copied again
+                foreach (var copy in _copyFolder.GetDirectories())
+                {
+                    if (Directory.Exists(Path.Combine(_pluginFolder.FullName, copy.Name)))
+                        continue;
+
+                    _logger.LogInformation("Deleting the shadow copy of the removed plugin folder {FolderName}", copy.Name);
+                    try
+                    {
+                        copy.Delete(true);
+                    }
+                    catch (Exception exc) when (exc is IOException or UnauthorizedAccessException)
+                    {
+                        _logger.LogWarning(exc, "Shadow copy {FullName} could not be deleted", copy.FullName);
+                    }
+                }
+
+                //clear out the files of the flat layout older versions shadow copied to
                 foreach (var f in _copyFolder.GetFiles("*", SearchOption.TopDirectoryOnly))
                 {
                     _logger.LogInformation("Deleting {FName}", f.Name);
@@ -124,6 +142,7 @@ internal static void Load(IMvcCoreBuilder mvcCoreBuilder, IConfiguration configu
                         _logger.LogError(exc, "PluginManager");
                     }
                 }
+            }
 
             //plan from metadata first: nothing is loaded for a folder that cannot be loaded
             var hostAssemblyNames = HostAssemblyNames();
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
index 86fb5717ff..eae3ad3998 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginManagerTests.cs
@@ -189,11 +189,15 @@ public void Load_ShadowCopy_LoadsTheWholeFolderFromItsOwnCopy()
         WriteDepsJson(_fixture.Folder("Shadow"), "Manager.Shadow");
         Directory.CreateDirectory(Path.Combine(_fixture.Folder("Shadow"), "runtimes", "any"));
         File.WriteAllText(Path.Combine(_fixture.Folder("Shadow"), "runtimes", "any", "native.txt"), "native");
-        //left by an earlier start: a file the plugin no longer ships, another plugin's copy, the old flat layout
+        //left by an earlier start: a file the plugin no longer ships, another plugin's copy, the copy of a removed
+        //plugin folder, the old flat layout
         Directory.CreateDirectory(ShadowFolder("Shadow"));
         File.WriteAllText(Path.Combine(ShadowFolder("Shadow"), "Removed.dll"), "old");
+        Directory.CreateDirectory(_fixture.Folder("Other"));
         Directory.CreateDirectory(ShadowFolder("Other"));
         File.WriteAllText(Path.Combine(ShadowFolder("Other"), "Other.dll"), "other");
+        Directory.CreateDirectory(Path.Combine(ShadowFolder("Gone"), "runtimes"));
+        File.WriteAllText(Path.Combine(ShadowFolder("Gone"), "runtimes", "Gone.dll"), "gone");
         File.WriteAllText(Path.Combine(_fixture.PluginsFolder, "bin", "Flat.dll"), "flat");
 
         Load("Manager.Shadow", shadowCopy: true);
@@ -206,6 +210,7 @@ public void Load_ShadowCopy_LoadsTheWholeFolderFromItsOwnCopy()
         Assert.IsTrue(File.Exists(Path.Combine(ShadowFolder("Shadow"), "runtimes", "any", "native.txt")));
         Assert.IsFalse(File.Exists(Path.Combine(ShadowFolder("Shadow"), "Removed.dll")));
         Assert.IsTrue(File.Exists(Path.Combine(ShadowFolder("Other"), "Other.dll")));
+        Assert.IsFalse(Directory.Exists(ShadowFolder("Gone")));
         Assert.IsFalse(File.Exists(Path.Combine(_fixture.PluginsFolder, "bin", "Flat.dll")));
         //the plugin's own folder keeps its deps.json
         Assert.IsTrue(File.Exists(Path.Combine(_fixture.Folder("Shadow"), "Manager.Shadow.deps.json")));

From f5e865ed1da2350a600817dd03d2777c6090a463 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 21:21:38 +0100
Subject: [PATCH 28/30] Scan each plugin's own copy of a library two plugins
 ship

Assemblies were de-duplicated by full name, but every plugin now loads its
files into a context of its own: only the first plugin's copy of a shared
library was scanned, so the second plugin's types from it were never
registered. One assembly is now kept per load context.
---
 .../TypeSearch/TypeSearcher.cs                | 15 ++++++----
 .../TypeSearcher/TypeSearcherTests.cs         | 30 +++++++++++++++++++
 2 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs b/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
index 4f4cc4aeaf..ec0ba85443 100644
--- a/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
+++ b/src/Core/Grand.Infrastructure/TypeSearch/TypeSearcher.cs
@@ -5,6 +5,7 @@
 using System.Collections.ObjectModel;
 using System.Diagnostics;
 using System.Reflection;
+using System.Runtime.Loader;
 
 namespace Grand.Infrastructure.TypeSearch;
 
@@ -48,7 +49,9 @@ private static IList<Assembly> CachedAssemblies()
 
     private static IList<Assembly> AssembliesInAppDomain()
     {
-        var addedAssemblyNames = new List<string>();
+        //one assembly per load context: plugins shipping the same library each load their own copy, and each
+        //plugin's code uses the types of its own
+        var addedAssemblies = new HashSet<(AssemblyLoadContext, string)>();
         var assemblies = new List<Assembly>();
         var currentAssem = Assembly.GetExecutingAssembly();
         foreach (var assembly in AppDomain.CurrentDomain.GetAssemblies())
@@ -57,13 +60,14 @@ private static IList<Assembly> AssembliesInAppDomain()
             var referencedAssemblies = assembly.GetReferencedAssemblies().ToList();
             if (referencedAssemblies.All(x => x.FullName != currentAssem.FullName) &&
                 product?.Product != "grandnode") continue;
-            if (addedAssemblyNames.Contains(assembly.FullName)) continue;
+            var key = (AssemblyLoadContext.GetLoadContext(assembly), assembly.FullName);
+            if (addedAssemblies.Contains(key)) continue;
             //an uninstalled plugin contributes no types to any scan
             if (!PluginExtensions.OnlyInstalledPlugins(assembly)) continue;
             //nor does a module that failed to load; its types may not even resolve
             if (ModuleLoader.IsFailedModule(assembly)) continue;
             assemblies.Add(assembly);
-            addedAssemblyNames.Add(assembly.FullName);
+            addedAssemblies.Add(key);
         }
 
         //add scripts
@@ -71,9 +75,10 @@ private static IList<Assembly> AssembliesInAppDomain()
         foreach (var scripts in RoslynCompiler.ReferencedScripts)
         {
             if (string.IsNullOrEmpty(scripts.ReferencedAssembly.FullName)) continue;
-            if (addedAssemblyNames.Contains(scripts.ReferencedAssembly.FullName)) continue;
+            var key = (AssemblyLoadContext.GetLoadContext(scripts.ReferencedAssembly), scripts.ReferencedAssembly.FullName);
+            if (addedAssemblies.Contains(key)) continue;
             assemblies.Add(scripts.ReferencedAssembly);
-            addedAssemblyNames.Add(scripts.ReferencedAssembly.FullName);
+            addedAssemblies.Add(key);
         }
 
         return assemblies;
diff --git a/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs b/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
index 0f8452a4d9..d576f25536 100644
--- a/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/TypeSearcher/TypeSearcherTests.cs
@@ -109,6 +109,36 @@ public class LateLoadedMarker { }
         }
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetAssemblies_SameAssemblyInTwoContexts_IncludesBoth()
+    {
+        const string name = "Grand.Infrastructure.Tests.SharedLibrary";
+        var dir = Path.Combine(Path.GetTempPath(), "grand-typesearcher-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            //as two plugins each shipping the same library load it, each into its own context
+            var path = TestPluginBuilder.Compile(dir, name, """
+                [assembly: System.Reflection.AssemblyProduct("grandnode")]
+                public class SharedLibraryMarker { }
+                """);
+            var copies = new[] { "shared-one", "shared-two" }.Select(contextName =>
+            {
+                using var stream = new MemoryStream(File.ReadAllBytes(path));
+                return new AssemblyLoadContext(contextName, true).LoadFromStream(stream);
+            }).ToList();
+
+            var assemblies = _typeSearcher.GetAssemblies();
+
+            Assert.Contains(copies[0], assemblies);
+            Assert.Contains(copies[1], assemblies);
+        }
+        finally
+        {
+            Directory.Delete(dir, true);
+        }
+    }
+
     [TestMethod]
     [DoNotParallelize]
     public void GetAssemblies_AfterReferencedPluginsReplaced_Recomputes()

From 59ee5c2e42d443acc073e44eb76c9a7acfe394c4 Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 21:21:40 +0100
Subject: [PATCH 29/30] Report a replaced dependency, and a plugin copied into
 an existing folder, as pending

A loaded plugin was compared by its main assembly only, and a folder that
existed at load time was never read again, so neither change showed the
restart notice nor stopped Install and Uninstall before the restart. All
top-level dlls are compared now, and a folder that had no plugin is read
again once its dlls change.
---
 .../Plugins/PluginLoadSnapshot.cs             | 55 ++++++++-----------
 .../Plugins/PluginPendingChangesTests.cs      | 28 ++++++++++
 2 files changed, 50 insertions(+), 33 deletions(-)

diff --git a/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs b/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs
index ee85def7db..0ef9b20a12 100644
--- a/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs
+++ b/src/Core/Grand.Infrastructure/Plugins/PluginLoadSnapshot.cs
@@ -4,16 +4,17 @@ namespace Grand.Infrastructure.Plugins;
 
 /// <summary>
 ///     The plugin state this process loaded, kept to tell which changes on disk wait for a restart. Comparing
-///     runs on every admin page view, so it reads file attributes, the installed-plugins file once, and the
-///     manifests of folders that did not exist at load time - never an assembly into the process.
+///     runs on every admin page view, so it reads the attributes of each folder's top-level dlls, the
+///     installed-plugins file once, and the manifests of folders that had no plugin at load time and changed
+///     since - never an assembly into the process.
 /// </summary>
 internal sealed class PluginLoadSnapshot
 {
     /// <summary>
-    ///     A plugin folder as it was loaded. A folder that could not be loaded has no main assembly; its
-    ///     plugin assemblies as a whole are compared instead.
+    ///     A plugin folder as it was loaded; its assemblies as a whole are compared, so a replaced dependency
+    ///     counts as an update as much as a replaced main assembly
     /// </summary>
-    private sealed record LoadedFolder(string SystemName, string MainAssemblyPath, FileStamp Stamp);
+    private sealed record LoadedFolder(string SystemName, FileStamp Stamp);
 
     private sealed record FileStamp(long Length, DateTime LastWriteTimeUtc, int Count);
 
@@ -21,17 +22,17 @@ private sealed record FileStamp(long Length, DateTime LastWriteTimeUtc, int Coun
     private readonly string _installedPluginsFile;
     private readonly string _skipPattern;
     private readonly HashSet<string> _installed;
-    private readonly HashSet<string> _knownFolders;
+    private readonly Dictionary<string, FileStamp> _otherFolders;
     private readonly Dictionary<string, LoadedFolder> _plugins;
 
     private PluginLoadSnapshot(string pluginsFolder, string installedPluginsFile, string skipPattern,
-        HashSet<string> installed, HashSet<string> knownFolders, Dictionary<string, LoadedFolder> plugins)
+        HashSet<string> installed, Dictionary<string, FileStamp> otherFolders, Dictionary<string, LoadedFolder> plugins)
     {
         _pluginsFolder = pluginsFolder;
         _installedPluginsFile = installedPluginsFile;
         _skipPattern = skipPattern;
         _installed = installed;
-        _knownFolders = knownFolders;
+        _otherFolders = otherFolders;
         _plugins = plugins;
     }
 
@@ -48,17 +49,21 @@ internal static PluginLoadSnapshot Capture(DirectoryInfo pluginsFolder, PluginSc
         var plugins = new Dictionary<string, LoadedFolder>(StringComparer.OrdinalIgnoreCase);
         foreach (var candidate in scan.Plugins)
             plugins[candidate.Folder.Name] = new LoadedFolder(candidate.Manifest.SystemName,
-                candidate.MainAssemblyPath, StampOf(candidate.MainAssemblyPath));
+                StampOfAssemblies(candidate.Folder.FullName));
 
         var knownFolders = (Folders(pluginsFolder.FullName) ?? []).ToHashSet(StringComparer.OrdinalIgnoreCase);
         //a problem names its folder, or the Plugins folder itself when that could not be listed
         foreach (var problem in scan.Problems.Where(x =>
                      knownFolders.Contains(x.Folder) && !plugins.ContainsKey(x.Folder)))
-            plugins[problem.Folder] = new LoadedFolder(problem.SystemNames.FirstOrDefault() ?? problem.Folder, null,
+            plugins[problem.Folder] = new LoadedFolder(problem.SystemNames.FirstOrDefault() ?? problem.Folder,
                 StampOfAssemblies(Path.Combine(pluginsFolder.FullName, problem.Folder)));
 
+        //a folder without a plugin (empty, or only a plugin's leftovers) is read again once its assemblies change
+        var otherFolders = knownFolders.Where(x => !plugins.ContainsKey(x)).ToDictionary(x => x,
+            x => StampOfAssemblies(Path.Combine(pluginsFolder.FullName, x)), StringComparer.OrdinalIgnoreCase);
+
         return new PluginLoadSnapshot(pluginsFolder.FullName, installedPluginsFile, skipPattern,
-            installedSystemNames.ToHashSet(StringComparer.OrdinalIgnoreCase), knownFolders, plugins);
+            installedSystemNames.ToHashSet(StringComparer.OrdinalIgnoreCase), otherFolders, plugins);
     }
 
     /// <summary>
@@ -106,12 +111,16 @@ private void CompareFolders(List<PluginPendingChange> changes)
         {
             if (!folders.Contains(folder))
                 changes.Add(new PluginPendingChange(loaded.SystemName, folder, PluginPendingChangeKind.Removed));
-            else if (loaded.Stamp != CurrentStamp(folder, loaded))
+            else if (loaded.Stamp != StampOfAssemblies(Path.Combine(_pluginsFolder, folder)))
                 changes.Add(new PluginPendingChange(loaded.SystemName, folder, PluginPendingChangeKind.Updated));
         }
 
-        foreach (var folder in folders.Where(x => !_knownFolders.Contains(x)).Order(StringComparer.Ordinal))
+        foreach (var folder in folders.Where(x => !_plugins.ContainsKey(x)).Order(StringComparer.Ordinal))
         {
+            if (_otherFolders.TryGetValue(folder, out var stamp) &&
+                stamp == StampOfAssemblies(Path.Combine(_pluginsFolder, folder)))
+                continue;
+
             var manifest = ReadManifest(Path.Combine(_pluginsFolder, folder));
             if (manifest != null)
                 changes.Add(new PluginPendingChange(
@@ -120,13 +129,6 @@ private void CompareFolders(List<PluginPendingChange> changes)
         }
     }
 
-    private FileStamp CurrentStamp(string folder, LoadedFolder loaded)
-    {
-        return loaded.MainAssemblyPath != null
-            ? StampOf(loaded.MainAssemblyPath)
-            : StampOfAssemblies(Path.Combine(_pluginsFolder, folder));
-    }
-
     private string FolderOf(string systemName)
     {
         return _plugins.FirstOrDefault(x => string.Equals(x.Value.SystemName, systemName,
@@ -159,19 +161,6 @@ private PluginManifest ReadManifest(string folder)
         return null;
     }
 
-    private static FileStamp StampOf(string path)
-    {
-        try
-        {
-            var file = new FileInfo(path);
-            return file.Exists ? new FileStamp(file.Length, file.LastWriteTimeUtc, 1) : null;
-        }
-        catch (Exception ex) when (PluginFolderScanner.IsReadFailure(ex))
-        {
-            return null;
-        }
-    }
-
     private static FileStamp StampOfAssemblies(string folder)
     {
         var files = Files(folder);
diff --git a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs
index 7e23e80043..b3024c7193 100644
--- a/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs
+++ b/src/Tests/Grand.Infrastructure.Tests/Plugins/PluginPendingChangesTests.cs
@@ -130,6 +130,34 @@ public void GetPendingChanges_MainDllReplaced_ReportsUpdated()
             changes.Single());
     }
 
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_OnlyDependencyReplaced_ReportsUpdated()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        TestPluginBuilder.Compile(_fixture.Folder("A"), "Pending.A.Dependency", "public class Dependency { }");
+        WriteInstalled("Pending.A");
+
+        var changes = PendingAfter(() => TestPluginBuilder.Compile(_fixture.Folder("A"), "Pending.A.Dependency",
+            "public class Dependency { } public class AddedInTheNewVersion { }"));
+
+        Assert.AreEqual(new PluginPendingChange("Pending.A", "A", PluginPendingChangeKind.Updated),
+            changes.Single());
+    }
+
+    [TestMethod]
+    [DoNotParallelize]
+    public void GetPendingChanges_PluginCopiedIntoAFolderThatHadNone_ReportsAdded()
+    {
+        _fixture.AddPlugin("A", "Pending.A", "Pending.A");
+        Directory.CreateDirectory(_fixture.Folder("B"));
+        WriteInstalled();
+
+        var changes = PendingAfter(() => _fixture.AddPlugin("B", "Pending.B", "Pending.B"));
+
+        Assert.AreEqual(new PluginPendingChange("Pending.B", "B", PluginPendingChangeKind.Added), changes.Single());
+    }
+
     /// <summary>
     ///     Records the state as <see cref="PluginManager.Load" /> does, applies the change and compares
     /// </summary>

From c6ea6d8e4d0ba7338a817dccdf973a5338a5617f Mon Sep 17 00:00:00 2001
From: support <support@grandnode.com>
Date: Wed, 4 Nov 2026 21:21:41 +0100
Subject: [PATCH 30/30] Say that a module not deployed with the application is
 not a load failure

---
 .../Grand.Infrastructure/Configuration/ExtensionsConfig.cs     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
index 56164e505f..3ff932601a 100644
--- a/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
+++ b/src/Core/Grand.Infrastructure/Configuration/ExtensionsConfig.cs
@@ -34,7 +34,8 @@ public class ExtensionsConfig
     /// <summary>
     ///     Stop the application when an installed plugin, or a module enabled under FeatureManagement, fails to
     ///     load. Off: the plugin is logged, listed with its error and left inactive, the module is logged as
-    ///     critical, and the application starts without it.
+    ///     critical, and the application starts without it. A module whose folder is not deployed with this
+    ///     application is not a load failure: it is logged as a warning either way.
     /// </summary>
     public bool FailOnPluginLoadError { get; set; }
 }
\ No newline at end of file