Desktop 0.2.2-rc.1 update silently rewrote profile package.json (34 bundles -> 2) and broke plugin boot: update needs safeguards

[alexunderstand2-pixel]

Environment: Windows 11, DSH Desktop 0.2.2-rc.1 (nightly), upgraded in-app from 0.2.1-rc.5. Profile desktop: 28 third-party/local plugins, custom cordis.patch.yml (~16 KB), several local link: bundles.

What happened

1. After the update the first boot failed: web boot: 1 entry did not activate — @scandicboy/dsh-locale-ru: failed. The locale plugin (latest 1.1.0) is incompatible with 0.2.2, and the UI could not start.
2. Worse: the update rewrote ~/.dsh/profiles/desktop/package.json and dropped dsh.profile.bundles from 34 entries to 2 (@deepseek-ai/dsh-base, @deepseek-ai/dsh-web-app). All 32 user-installed and local bundles silently disappeared from the profile, so the app booted almost without plugins.
3. There is no automatic pre-update profile backup and no rollback in the UI. Recovery took about 5 hours of manual work: restoring from a nightly archive, pnpm install, dsh-fix, rebuilding node_modules, restoring plugin sources and re-checking every plugin.
4. This looks like the same class of problem as the existing report "[Bug][Desktop][macOS] rc.5: profile patch 被重写时丢失手写的 insert 条目, MCP 服务器静默消失" — silent rewriting of user profile files during update.

Why it matters: for a customized profile (plugins, MCP servers, local bundles) an update is not a two-minute operation but a multi-hour repair. It costs time and tokens and makes the nightly channel hard to trust.

Requests

1. Preserve package.json (dsh.profile.bundles and dependencies) and cordis.patch.yml byte-for-byte during update; never drop unknown or local bundle entries.
2. Take an automatic profile snapshot before the update and offer one-click rollback of both app and profile.
3. Check installed plugins against the new core before applying the update, list incompatible ones (like locale-ru) and let the user disable them explicitly and continue.
4. If a profile file must be rewritten, keep a .bak and show a diff/warning in the UI.
5. Consider a stable channel or version pinning for users with heavily customized profiles.

The diagnostics already help: the crash log named the failing plugin. What is missing is preventing the damage, not only reporting it. Thanks.