# Plugin Host with Assembly Isolation

## Module
Plugin

## Status
IMPLEMENTED

## Description
Plugin host with assembly-based loading, isolated AssemblyLoadContext, and configurable host options.

## Implementation Details
- **PluginHost**: `src/Plugin/StellaOps.Plugin.Host/PluginHost.cs` -- central coordinator implementing IPluginHost + IAsyncDisposable; manages discovery -> dependency validation -> load order -> assembly loading -> initialization -> health monitoring lifecycle; ConcurrentDictionary<string, LoadedPlugin> registry; events for state changes and health changes; auto-recovery of unhealthy plugins via reload; configurable initialization/shutdown timeouts
- **PluginAssemblyLoadContext**: `src/Plugin/StellaOps.Plugin.Host/Loading/PluginAssemblyLoadContext.cs` -- collectible AssemblyLoadContext for plugin isolation; uses AssemblyDependencyResolver for plugin-local dependency resolution; WeakReference for GC tracking; supports unmanaged DLL loading; PluginLoadContextReference wrapper with IsCollected/Unload
- **AssemblyPluginLoader**: `src/Plugin/StellaOps.Plugin.Host/Loading/AssemblyPluginLoader.cs` -- IHostPluginLoader implementation for assembly-based loading
- **PluginHostOptions**: `src/Plugin/StellaOps.Plugin.Host/PluginHostOptions.cs` -- configures PluginPaths, BuiltInPluginIds, TrustedPluginIds, TrustedVendors, FailOnPluginLoadError, AutoRecoverUnhealthyPlugins, InitializationTimeout, ShutdownTimeout
- **IPluginHost**: `src/Plugin/StellaOps.Plugin.Host/IPluginHost.cs` -- interface: StartAsync, StopAsync, LoadPluginAsync, UnloadPluginAsync, ReloadPluginAsync, GetPluginsWithCapability<T>, GetPlugin, GetCapability<T>
- **Source**: Feature matrix scan

## E2E Test Plan
- [ ] Verify plugin host loads plugins in dependency order and transitions through lifecycle states
- [ ] Test assembly isolation prevents plugin assemblies from conflicting with host assemblies
- [ ] Verify collectible AssemblyLoadContext allows plugin unloading and GC collection
- [ ] Test auto-recovery reloads unhealthy plugins when enabled
- [ ] Verify trust level determination routes BuiltIn/Trusted/Untrusted correctly