feat: support explicit instance data deletion

cmd/chub/main.go

@@ -133,6 +133,12 @@ func runWindow(logger *slog.Logger) {
 		monitor:          exitMonitor,
 	}.Start, window.Invalidate)
 	shell.OnStopInstance(instanceStopper{launcher: launcher, managedProfiles: launcher, monitor: exitMonitor}.Stop, window.Invalidate)
+	dataRemover := files.NewInstanceDataRemover()
+	shell.OnDeleteInstanceData(instanceDataDeleter{
+		managedProfiles:  launcher,
+		externalProfiles: externalProfiles,
+		dataRemover:      dataRemover,
+	}.Delete, window.Invalidate)
 	shell.OnRefreshInstances(instanceStatusRefresher{
 		managedProfiles:  launcher,
 		externalProfiles: externalProfiles,
@@ -483,6 +489,43 @@ func (s instanceStatusRefresher) refreshOne(ctx context.Context, row ui.Instance
 	return result
 }
 
+type instanceDataDeleter struct {
+	managedProfiles  managedProfileInspector
+	externalProfiles browser.ExternalProfileInspector
+	dataRemover      files.InstanceDataRemover
+}
+
+func (d instanceDataDeleter) Delete(ctx context.Context, row ui.InstanceRow) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if d.managedProfiles == nil || d.externalProfiles == nil || d.dataRemover == nil {
+		return errors.New("实例数据删除服务尚未准备好")
+	}
+	if strings.TrimSpace(row.UserDataDir) == "" || !filepath.IsAbs(row.UserDataDir) {
+		return files.ErrUnsafeInstanceDataDirectory
+	}
+	kind, err := browserKind(row.Browser)
+	if err != nil {
+		return err
+	}
+	managed, err := d.managedProfiles.InspectProfile(ctx, row.UserDataDir)
+	if err != nil {
+		return fmt.Errorf("检查 Chub 实例占用失败：%w", err)
+	}
+	if managed.Occupied {
+		return domain.ErrProfileOccupied
+	}
+	external, err := d.externalProfiles.InspectProfile(ctx, kind, row.UserDataDir, row.PID)
+	if err != nil {
+		return fmt.Errorf("检查外部浏览器占用失败：%w", err)
+	}
+	if external.Occupied {
+		return domain.ErrProfileOccupied
+	}
+	return d.dataRemover.RemoveInstanceData(ctx, row.UserDataDir)
+}
+
 func (s instanceStarter) Start(ctx context.Context, row ui.InstanceRow, settings ui.SettingsState, launchGeneration uint64) (ui.InstanceStartOutcome, error) {
 	kind, err := browserKind(row.Browser)
 	if err != nil {

cmd/chub/main_test.go

@@ -12,6 +12,7 @@ import (
 	"chub/internal/domain"
 	"chub/internal/platform/browser"
 	"chub/internal/platform/config"
+	"chub/internal/platform/files"
 	"chub/internal/ui"
 )
 
@@ -276,6 +277,90 @@ func TestInstanceStatusRefresherAssociatesExternalWithoutLifecycleControl(t *tes
 	}
 }
 
+func TestInstanceDataDeleterDeletesOnlyUnoccupiedConfiguredProfile(t *testing.T) {
+	remover := &fakeInstanceDataRemover{}
+	deleter := instanceDataDeleter{
+		managedProfiles:  fakeManagedProfileInspector{},
+		externalProfiles: fakeExternalProfileInspector{},
+		dataRemover:      remover,
+	}
+	row := ui.InstanceRow{ID: "chrome-a", Browser: "Chrome", UserDataDir: `C:\profiles\chrome-a`}
+
+	if err := deleter.Delete(context.Background(), row); err != nil {
+		t.Fatalf("Delete() error = %v", err)
+	}
+	if remover.calls != 1 || remover.userDataDir != row.UserDataDir {
+		t.Fatalf("remover calls=%d userDataDir=%q, want 1 %q", remover.calls, remover.userDataDir, row.UserDataDir)
+	}
+}
+
+func TestInstanceDataDeleterRejectsOccupiedProfileBeforeRemoval(t *testing.T) {
+	tests := []struct {
+		name     string
+		managed  fakeManagedProfileInspector
+		external fakeExternalProfileInspector
+	}{
+		{
+			name:    "chub managed instance",
+			managed: fakeManagedProfileInspector{use: browser.ProfileUse{Occupied: true, PID: 4242}},
+		},
+		{
+			name:     "external browser instance",
+			external: fakeExternalProfileInspector{use: browser.ProfileUse{Occupied: true, PID: 4243, Source: browser.ProfileSourceLock}},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			remover := &fakeInstanceDataRemover{}
+			deleter := instanceDataDeleter{
+				managedProfiles:  tt.managed,
+				externalProfiles: tt.external,
+				dataRemover:      remover,
+			}
+
+			err := deleter.Delete(context.Background(), ui.InstanceRow{ID: "chrome-a", Browser: "Chrome", UserDataDir: `C:\profiles\chrome-a`})
+			if !errors.Is(err, domain.ErrProfileOccupied) {
+				t.Fatalf("Delete() error = %v, want profile occupied", err)
+			}
+			if remover.calls != 0 {
+				t.Fatalf("remover calls = %d, want 0", remover.calls)
+			}
+		})
+	}
+}
+
+func TestInstanceDataDeleterPreservesDataWhenSafetyCheckFails(t *testing.T) {
+	remover := &fakeInstanceDataRemover{}
+	deleter := instanceDataDeleter{
+		managedProfiles:  fakeManagedProfileInspector{err: errors.New("registry unavailable")},
+		externalProfiles: fakeExternalProfileInspector{},
+		dataRemover:      remover,
+	}
+
+	err := deleter.Delete(context.Background(), ui.InstanceRow{ID: "chrome-a", Browser: "Chrome", UserDataDir: `C:\profiles\chrome-a`})
+	if err == nil || remover.calls != 0 {
+		t.Fatalf("Delete() error = %v, remover calls = %d; want safety failure before removal", err, remover.calls)
+	}
+}
+
+func TestInstanceDataDeleterRejectsUnsafeDirectoryBeforeInspection(t *testing.T) {
+	remover := &fakeInstanceDataRemover{}
+	deleter := instanceDataDeleter{
+		managedProfiles:  fakeManagedProfileInspector{},
+		externalProfiles: fakeExternalProfileInspector{},
+		dataRemover:      remover,
+	}
+
+	err := deleter.Delete(context.Background(), ui.InstanceRow{ID: "chrome-a", Browser: "Chrome", UserDataDir: `profiles\chrome-a`})
+	if !errors.Is(err, files.ErrUnsafeInstanceDataDirectory) {
+		t.Fatalf("Delete() error = %v, want unsafe directory", err)
+	}
+	if remover.calls != 0 {
+		t.Fatalf("remover calls = %d, want 0", remover.calls)
+	}
+}
+
 func TestInstanceTabsInspectorReadsOnlyVerifiedRuntimeRows(t *testing.T) {
 	remote := &fakeRemoteDebugInspector{targets: []browser.RemoteDebugTarget{{ID: "page-1", Type: "page", Title: "运营后台", URL: "https://example.com/orders"}}}
 	inspector := instanceTabsInspector{remoteDebug: remote}
@@ -373,10 +458,28 @@ func (m *fakeManagedExitObserver) ExpectStop(id string, generation uint64, pid i
 
 func (m *fakeManagedExitObserver) ClearExpectedStop(string, uint64, int) { m.clearCalls++ }
 
-type fakeManagedProfileInspector struct{ use browser.ProfileUse }
+type fakeManagedProfileInspector struct {
+	use browser.ProfileUse
+	err error
+}
 
 func (i fakeManagedProfileInspector) InspectProfile(context.Context, string) (browser.ProfileUse, error) {
-	return i.use, nil
+	return i.use, i.err
+}
+
+type fakeInstanceDataRemover struct {
+	calls       int
+	userDataDir string
+	err         error
+}
+
+func (r *fakeInstanceDataRemover) RemoveInstanceData(ctx context.Context, userDataDir string) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	r.calls++
+	r.userDataDir = userDataDir
+	return r.err
 }
 
 type fakeManagedStopper struct {

docs/06-tasks.md

@@ -56,7 +56,7 @@
 | T-403 | 便携配置路径与安全 legacy 迁移 | T-202,T-309 | DONE |
 | T-404 | 代理名称、独立默认目录与实例列表代理列 | T-304,T-306,T-309,T-403 | DONE |
 | T-405 | 设置浏览器 executable 选择与可感知搜索反馈 | T-205,T-206,T-207 | DONE |
-| T-406 | 实例删除确认中的 User Data Dir 显式删除 | T-301,T-303,T-305 | DOING |
+| T-406 | 实例删除确认中的 User Data Dir 显式删除 | T-301,T-303,T-305 | DONE |
 
 ## Backlog
 

docs/current-state.md

@@ -3,9 +3,9 @@
 ## 快照
 
 - 日期：2026-07-27
-- 阶段：Phase 4 CDP 只读观察与后台入口（T-301 至 T-310、T-201 至 T-208、T-401、T-403 至 T-405 已完成；T-402 已规划；T-406 进行中）
+- 阶段：Phase 4 CDP 只读观察与后台入口（T-301 至 T-310、T-201 至 T-208、T-401、T-403 至 T-406 已完成；T-402 已规划）
-- 代码：已建立 Go module `chub`、`cmd/chub` 入口、logging 测试基座、浏览器 domain/application 合约、Chrome/Edge 参数/发现模块、启动 registry、Windows 身份/占用检查、loopback CDP 端口分配与端点校验、受限 CDP 目标读取、exe 同级 JSON 配置与 legacy 安全迁移、优雅关闭、Job Object、真实 Chrome/Edge smoke、启动恢复、CLI JSON 合约、应用内事件总线、UI 状态测试和 Windows smoke 脚本，T-001 至 T-003、T-101 至 T-104、T-201 至 T-208、T-301 至 T-310、T-401、T-403 至 T-405 已完成
+- 代码：已建立 Go module `chub`、`cmd/chub` 入口、logging 测试基座、浏览器 domain/application 合约、Chrome/Edge 参数/发现模块、启动 registry、Windows 身份/占用检查、loopback CDP 端口分配与端点校验、受限 CDP 目标读取、exe 同级 JSON 配置与 legacy 安全迁移、优雅关闭、Job Object、真实 Chrome/Edge smoke、启动恢复、CLI JSON 合约、应用内事件总线、UI 状态测试和 Windows smoke 脚本，T-001 至 T-003、T-101 至 T-104、T-201 至 T-208、T-301 至 T-310、T-401、T-403 至 T-406 已完成
-- UI：Gio 双页 Shell 使用左侧“实例/设置”导航；实例页以等宽“新建实例 / 刷新实例状态”命令区开始，窄内容区自动堆叠。列表固定显示实例名称、浏览器类型、用户数据目录、代理名称、调试端口、状态和带边框的操作列；代理列只由稳定 `ProxyID` 解析当前名称（无代理时显示“无代理”），长名称省略且不挤压操作列。端口列在未启动/已退出时显示“建议 {端口}”、启动中显示“准备 {端口}”、托管运行显示“实际 {端口}”、外部关联显示“外部 {端口}”，避免将持久首选端口误作监听事实。新建表单从设置的起始端口推荐最低未冲突端口，并从实际 exe 同级 `user_data_dirs\\<实例 ID>` 预填一个独立、可编辑的 User Data Dir；ID 先分配，UI 不做目录 I/O，无法取得 exe 根目录时保留手动输入入口。编辑停止实例可修改首选端口；启动后台优先该端口并避开其他实例的首选/实际端口，成功回退后才保存新的首选值。操作顺序固定为启动/停止（或重新检测）、编辑、删除，删除与相邻操作保持更大间距以降低误点。主操作在已退出时启动，在 Chub 托管运行或调试不可用时显示停止，在启动/停止中禁用，在外部关联、外部占用或未知占用时仅重新检测；优雅停止通过后台 adapter 验证 registry 的 PID/profile 身份并等待其释放，绝不按进程名关闭或接管外部 Chrome/Edge。刷新通过后台回调只检查已保存实例，以配置快照丢弃编辑或删除后的过期结果；它结合 Chub registry、指定 profile 的外部占用证据和 loopback CDP 端点更新状态，但不扫描、接管或关闭其他 Chrome/Edge。双击、Enter 或编辑图标打开实例编辑弹层，支持名称、浏览器类型、User Data Dir、启动 URL、首选端口、以“名称 · 地址”显示的代理选择和只读实际端口；保存保留未公开启动选项，Escape 对脏表单先请求确认，活跃/外部关联实例锁定身份约束字段。设置页使用完整代理地址选择器、代理名称与地址输入及保存/删除操作；选择会回填名称和地址，保存按稳定 `proxyId` 新增或更新并校验名称/地址唯一性，删除未引用代理前必须确认，仍被实例引用的代理会被拒绝。启动通过异步回调接到 Windows 浏览器启动器：未占用目录从已保存的起始端口（空值默认 9666）选择 loopback CDP 端口，并在启动时按已选代理 ID 解析最新的 `--proxy-server` 参数；同目录外部浏览器只有在 `DevToolsActivePort` 与 CDP 端点可验证时才显示“外部已关联”，且不会接管其生命周期。删除使用确认弹层，只删除 Chub 实例配置而不删除 User Data Dir。新建、编辑和删除实例会保存到本地配置；四个设置路径有独立异步可取消搜索，切换页面后输入和任务状态保留；设置页 Chrome/Edge 路径已接入后台 Windows 原生 `.exe` 选择器，选择和搜索结果始终显示在对应字段旁；命中已填路径会明确确认而非静默完成。新建实例表单使用 Label、Windows 原生目录选择器和 Chrome/Edge RadioButton；CLI `list/events` 已可用，`start/stop/restart` 等待 BrowserManager adapter
+- UI：Gio 双页 Shell 使用左侧“实例/设置”导航；实例页以等宽“新建实例 / 刷新实例状态”命令区开始，窄内容区自动堆叠。列表固定显示实例名称、浏览器类型、用户数据目录、代理名称、调试端口、状态和带边框的操作列；代理列只由稳定 `ProxyID` 解析当前名称（无代理时显示“无代理”），长名称省略且不挤压操作列。端口列在未启动/已退出时显示“建议 {端口}”、启动中显示“准备 {端口}”、托管运行显示“实际 {端口}”、外部关联显示“外部 {端口}”，避免将持久首选端口误作监听事实。新建表单从设置的起始端口推荐最低未冲突端口，并从实际 exe 同级 `user_data_dirs\\<实例 ID>` 预填一个独立、可编辑的 User Data Dir；ID 先分配，UI 不做目录 I/O，无法取得 exe 根目录时保留手动输入入口。编辑停止实例可修改首选端口；启动后台优先该端口并避开其他实例的首选/实际端口，成功回退后才保存新的首选值。操作顺序固定为启动/停止（或重新检测）、编辑、删除，删除与相邻操作保持更大间距以降低误点。主操作在已退出时启动，在 Chub 托管运行或调试不可用时显示停止，在启动/停止中禁用，在外部关联、外部占用或未知占用时仅重新检测；优雅停止通过后台 adapter 验证 registry 的 PID/profile 身份并等待其释放，绝不按进程名关闭或接管外部 Chrome/Edge。刷新通过后台回调只检查已保存实例，以配置快照丢弃编辑或删除后的过期结果；它结合 Chub registry、指定 profile 的外部占用证据和 loopback CDP 端点更新状态，但不扫描、接管或关闭其他 Chrome/Edge。双击、Enter 或编辑图标打开实例编辑弹层，支持名称、浏览器类型、User Data Dir、启动 URL、首选端口、以“名称 · 地址”显示的代理选择和只读实际端口；保存保留未公开启动选项，Escape 对脏表单先请求确认，活跃/外部关联实例锁定身份约束字段。设置页使用完整代理地址选择器、代理名称与地址输入及保存/删除操作；选择会回填名称和地址，保存按稳定 `proxyId` 新增或更新并校验名称/地址唯一性，删除未引用代理前必须确认，仍被实例引用的代理会被拒绝。启动通过异步回调接到 Windows 浏览器启动器：未占用目录从已保存的起始端口（空值默认 9666）选择 loopback CDP 端口，并在启动时按已选代理 ID 解析最新的 `--proxy-server` 参数；同目录外部浏览器只有在 `DevToolsActivePort` 与 CDP 端点可验证时才显示“外部已关联”，且不会接管其生命周期。删除确认默认只删除 Chub 实例配置；仅已退出/启动失败实例可显式勾选删除 User Data Dir，后台会复核 Chub registry、外部占用与安全目录边界，成功删除数据后才移除配置；失败或过期结果保留配置和目录。新建、编辑和删除实例会保存到本地配置；四个设置路径有独立异步可取消搜索，切换页面后输入和任务状态保留；设置页 Chrome/Edge 路径已接入后台 Windows 原生 `.exe` 选择器，选择和搜索结果始终显示在对应字段旁；命中已填路径会明确确认而非静默完成。新建实例表单使用 Label、Windows 原生目录选择器和 Chrome/Edge RadioButton；CLI `list/events` 已可用，`start/stop/restart` 等待 BrowserManager adapter
 - T-307：本应用会话启动的受管 Chrome/Edge 根进程由单实例后台 `Wait` 监控；意外退出按 ID、启动代次和 PID 验证后立即变为“已退出”，清空运行时 PID/端口，并以可关闭、可合并的提示告知用户。提示关闭后焦点回到启动操作；Chub 请求停止、外部实例、过期事件和应用关闭取消监控均不提示。
 - T-308：设置页以可滚动的外层工作区承载浏览器路径、默认目录、运行行为和代理分区；分区、字段、状态提示和保存操作区使用统一的浅色圆角描边。路径字段在紧凑内容区会将输入与“选择/搜索”操作纵向重排，切换页面后滚动、输入与异步搜索状态仍由持久 Gio widget 保留。
 - 浏览器核心：设计参考来自 `D:\OPC\shop_helm\internal\platform\chrome`，尚未复制或接入本项目
@@ -16,8 +16,8 @@
 - T-403：默认配置已改为实际 `chub.exe` 同级 `config.json`，不受当前工作目录影响。目标缺失时会校验并原子复制旧 AppData 配置，旧文件保持恢复副本；目标优先且不会自动合并、切回 AppData 或迁移浏览器 User Data Dir。CLI 与 GUI 共用 `OpenDefault()`；配置不可用时 CLI 返回无敏感细节的稳定错误，GUI 显示恢复提示。
 - T-404：已完成代理名称/地址同次显式保存、名称与端点唯一性校验、选择回填、列表代理名称列以及独立默认 profile 目录。新建实例先分配稳定 ID，再由实际 exe 目录生成 `user_data_dirs\\<实例 ID>`；代理名称按 ProxyID 推导而不复制到实例配置，UI 不进行文件 I/O。已通过单元测试、竞态检测、vet、无控制台 GUI 打包和 Windows smoke。
 - T-405：已完成 Windows `OpenFileDialog` executable picker、Chrome/Edge 后台结果通道与字段级状态反馈。搜索同路径时明确确认当前路径可用；选择取消或错误保留输入，选择成功只更新目标字段。已通过单元测试、竞态检测、vet、无控制台打包，以及真实原生对话框取消/预选 Chrome `.exe` 返回 smoke。
-- T-406：进行中。将实例删除确认框扩展为默认仅删除配置、可显式勾选删除 User Data Dir；文件删除将在后台复核 Chub/external profile 占用和目录边界，失败时保留配置与目录。
+- T-406：已完成实例删除确认中的 User Data Dir 显式删除。默认仅删除配置；数据删除必须显式勾选且只对已退出/启动失败实例开放。后台在删除前复核 Chub/external profile 占用，目录删除拒绝不安全路径、卷根、文件、链接和 Windows 重解析点；失败与过期结果均保留配置和目录。
-- blocker：无；当前任务为 T-406，随后恢复 T-402。
+- blocker：无；下一任务为 T-402。
 
 ## 当前目录
 

docs/tasks/T-406.md

@@ -3,7 +3,7 @@ id: T-406
 title: 实例删除确认中的 User Data Dir 显式删除
 phase: 4
 deps: [T-301, T-303, T-305]
-status: DOING
+status: DONE
 created: 2026-07-27
 owner: codex
 ---
@@ -28,7 +28,7 @@ owner: codex
 
 ## 执行记录
 
-- 状态：DOING
+- 状态：DONE
-- 变更：已完成需求、架构、API、用户故事、交互清单、原型验收场景与安全边界定义；待更新原型并提交文档后实现。
+- 变更：确认框默认只删除配置，新增默认未选的数据删除复选框、目录/不可恢复警告、动态确认文案、取消默认焦点和 Escape 取消。仅“已退出”与“启动失败”允许勾选；数据删除在后台运行，确认框在执行中保持并禁用重复/取消。成功后才删除配置，失败或过期结果保留配置、目录与确认框。`cmd/chub` 在删除前复核 Chub registry 与外部 profile 占用，`internal/platform/files` 拒绝相对路径、卷根、普通文件、链接及 Windows 重解析点。
-- 验证：待执行。
+- 验证：`go test ./...`、`go test -race ./cmd/chub ./internal/ui ./internal/platform/files`、`go vet ./...`、`cmd /c build.bat` 均通过。目录删除测试在 Windows 临时真实目录上验证成功删除，并验证相对路径、卷根、文件、链接和已取消上下文均不会执行删除；Shell 与 adapter 测试覆盖默认配置删除、运行态禁用、成功/失败/过期结果、Chub/外部占用复核。
 - 阻塞：无。

internal/platform/files/instance_data_remover.go

@@ -0,0 +1,77 @@
+package files
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+var (
+	ErrUnsafeInstanceDataDirectory = errors.New("unsafe instance data directory")
+	ErrInstanceDataNotDirectory    = errors.New("instance data path is not a directory")
+)
+
+// InstanceDataRemover deletes one explicitly authorized browser User Data Dir.
+// Callers must check browser occupancy before invoking it.
+type InstanceDataRemover interface {
+	RemoveInstanceData(context.Context, string) error
+}
+
+type instanceDataRemover struct {
+	lstat     func(string) (os.FileInfo, error)
+	removeAll func(string) error
+}
+
+func NewInstanceDataRemover() InstanceDataRemover {
+	return newInstanceDataRemover(os.Lstat, os.RemoveAll)
+}
+
+func newInstanceDataRemover(lstat func(string) (os.FileInfo, error), removeAll func(string) error) instanceDataRemover {
+	return instanceDataRemover{lstat: lstat, removeAll: removeAll}
+}
+
+func (r instanceDataRemover) RemoveInstanceData(ctx context.Context, userDataDir string) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	path, err := normalizeRemovableInstanceDataDir(userDataDir)
+	if err != nil {
+		return err
+	}
+	info, err := r.lstat(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("inspect instance data directory: %w", err)
+	}
+	if info.Mode()&(os.ModeSymlink|os.ModeIrregular) != 0 || isReparsePoint(info) {
+		return fmt.Errorf("%w: links and reparse points are not removable", ErrUnsafeInstanceDataDirectory)
+	}
+	if !info.IsDir() {
+		return ErrInstanceDataNotDirectory
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if err := r.removeAll(path); err != nil {
+		return fmt.Errorf("remove instance data directory: %w", err)
+	}
+	return nil
+}
+
+func normalizeRemovableInstanceDataDir(value string) (string, error) {
+	value = strings.TrimSpace(value)
+	if value == "" || !filepath.IsAbs(value) {
+		return "", fmt.Errorf("%w: path must be absolute", ErrUnsafeInstanceDataDirectory)
+	}
+	path := filepath.Clean(value)
+	volumeRoot := filepath.Clean(filepath.VolumeName(path) + string(filepath.Separator))
+	if strings.EqualFold(path, volumeRoot) {
+		return "", fmt.Errorf("%w: volume root is not removable", ErrUnsafeInstanceDataDirectory)
+	}
+	return path, nil
+}

internal/platform/files/instance_data_remover_test.go

@@ -0,0 +1,94 @@
+package files
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestInstanceDataRemoverDeletesExistingDirectory(t *testing.T) {
+	root := t.TempDir()
+	target := filepath.Join(root, "profile")
+	if err := os.MkdirAll(filepath.Join(target, "Default"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(target, "Local State"), []byte("state"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	remover := NewInstanceDataRemover()
+	if err := remover.RemoveInstanceData(context.Background(), target); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Lstat(target); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("target still exists or could not be inspected: %v", err)
+	}
+}
+
+func TestInstanceDataRemoverRejectsUnsafePathsBeforeDeletion(t *testing.T) {
+	called := false
+	remover := newInstanceDataRemover(func(string) (os.FileInfo, error) {
+		return nil, os.ErrNotExist
+	}, func(string) error {
+		called = true
+		return nil
+	})
+	for _, path := range []string{"", "relative-profile", filepath.VolumeName(t.TempDir()) + string(filepath.Separator)} {
+		if err := remover.RemoveInstanceData(context.Background(), path); !errors.Is(err, ErrUnsafeInstanceDataDirectory) {
+			t.Fatalf("path %q error = %v", path, err)
+		}
+	}
+	if called {
+		t.Fatal("unsafe path reached removal")
+	}
+}
+
+func TestInstanceDataRemoverRejectsFilesAndLinks(t *testing.T) {
+	file := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(file, []byte("data"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := NewInstanceDataRemover().RemoveInstanceData(context.Background(), file); !errors.Is(err, ErrInstanceDataNotDirectory) {
+		t.Fatalf("file error = %v", err)
+	}
+
+	linkInfo := fakeFileInfo{mode: os.ModeSymlink | 0o777}
+	remover := newInstanceDataRemover(func(string) (os.FileInfo, error) {
+		return linkInfo, nil
+	}, func(string) error {
+		t.Fatal("link reached removal")
+		return nil
+	})
+	if err := remover.RemoveInstanceData(context.Background(), t.TempDir()); !errors.Is(err, ErrUnsafeInstanceDataDirectory) {
+		t.Fatalf("link error = %v", err)
+	}
+}
+
+func TestInstanceDataRemoverHonorsCanceledContext(t *testing.T) {
+	target := filepath.Join(t.TempDir(), "profile")
+	if err := os.Mkdir(target, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := NewInstanceDataRemover().RemoveInstanceData(ctx, target); !errors.Is(err, context.Canceled) {
+		t.Fatalf("error = %v", err)
+	}
+	if _, err := os.Lstat(target); err != nil {
+		t.Fatalf("canceled deletion changed target: %v", err)
+	}
+}
+
+type fakeFileInfo struct {
+	mode os.FileMode
+	sys  any
+}
+
+func (f fakeFileInfo) Name() string       { return "fake" }
+func (f fakeFileInfo) Size() int64        { return 0 }
+func (f fakeFileInfo) Mode() os.FileMode  { return f.mode }
+func (f fakeFileInfo) ModTime() time.Time { return time.Time{} }
+func (f fakeFileInfo) IsDir() bool        { return f.mode.IsDir() }
+func (f fakeFileInfo) Sys() any           { return f.sys }

internal/platform/files/reparse_other.go

@@ -0,0 +1,9 @@
+//go:build !windows
+
+package files
+
+import "io/fs"
+
+func isReparsePoint(fs.FileInfo) bool {
+	return false
+}

internal/platform/files/reparse_windows.go

@@ -0,0 +1,13 @@
+//go:build windows
+
+package files
+
+import (
+	"io/fs"
+	"syscall"
+)
+
+func isReparsePoint(info fs.FileInfo) bool {
+	attributes, ok := info.Sys().(*syscall.Win32FileAttributeData)
+	return ok && attributes.FileAttributes&syscall.FILE_ATTRIBUTE_REPARSE_POINT != 0
+}

internal/platform/files/reparse_windows_test.go

@@ -0,0 +1,32 @@
+//go:build windows
+
+package files
+
+import (
+	"context"
+	"errors"
+	"os"
+	"syscall"
+	"testing"
+)
+
+func TestInstanceDataRemoverRejectsWindowsReparsePoint(t *testing.T) {
+	called := false
+	remover := newInstanceDataRemover(func(string) (os.FileInfo, error) {
+		return fakeFileInfo{
+			mode: os.ModeDir,
+			sys:  &syscall.Win32FileAttributeData{FileAttributes: syscall.FILE_ATTRIBUTE_REPARSE_POINT},
+		}, nil
+	}, func(string) error {
+		called = true
+		return nil
+	})
+
+	err := remover.RemoveInstanceData(context.Background(), `C:\profiles\junction`)
+	if !errors.Is(err, ErrUnsafeInstanceDataDirectory) {
+		t.Fatalf("RemoveInstanceData() error = %v, want unsafe directory", err)
+	}
+	if called {
+		t.Fatal("reparse point reached removal")
+	}
+}

internal/ui/shell.go

@@ -100,6 +100,10 @@ type InstanceStarter func(context.Context, InstanceRow, SettingsState, uint64) (
 // instance. Implementations must reject external or unverified processes.
 type InstanceStopper func(context.Context, InstanceRow, uint64) error
 
+// InstanceDataDeleter removes the explicitly selected User Data Dir only after
+// its implementation has revalidated browser occupancy and path boundaries.
+type InstanceDataDeleter func(context.Context, InstanceRow) error
+
 // InstanceRefreshResult carries a read-only status check for one configured
 // instance. The UI applies it only while the row's editable fields still match
 // the snapshot passed to the refresher.
@@ -154,6 +158,13 @@ type instanceStopResult struct {
 	err     error
 }
 
+type instanceDataDeleteResult struct {
+	id          string
+	request     uint64
+	fingerprint string
+	err         error
+}
+
 type instanceRefreshState struct {
 	request uint64
 	running bool
@@ -363,6 +374,12 @@ type Shell struct {
 	deleteConfirm          widget.Clickable
 	deleteCancel           widget.Clickable
 	deleteBlocker          widget.Clickable
+	deleteData             widget.Bool
+	deleteDataRunning      bool
+	deleteDataRequest      uint64
+	deleteDataFeedback     string
+	deleteDataFocus        bool
+	deleteDataResults      chan instanceDataDeleteResult
 	startStates            map[string]*instanceStartState
 	startResults           chan instanceStartResult
 	stopStates             map[string]*instanceStopState
@@ -407,6 +424,7 @@ type Shell struct {
 	onProxiesChanged       func([]ProxyOption)
 	instanceStarter        InstanceStarter
 	instanceStopper        InstanceStopper
+	instanceDataDeleter    InstanceDataDeleter
 	instanceRefresher      InstanceRefresher
 	instanceTabInspector   InstanceTabInspector
 	pathSearcher           PathSearcher
@@ -432,7 +450,7 @@ func NewShell(theme *material.Theme) *Shell {
 		PathEdgeExecutable:   {},
 		PathDefaultUserData:  {},
 		PathLogDirectory:     {},
-	}, pathFieldFeedback: make(map[PathField]string), rowClicks: make(map[string]*widget.Clickable), startClicks: make(map[string]*widget.Clickable), editClicks: make(map[string]*widget.Clickable), deleteClicks: make(map[string]*widget.Clickable), proxyPickerChoices: make(map[string]*widget.Clickable), startStates: make(map[string]*instanceStartState), stopStates: make(map[string]*instanceStopState), pendingManagedExit: make(map[managedExitKey]ManagedInstanceExit), nextInstance: 4, startResults: make(chan instanceStartResult, 8), stopResults: make(chan instanceStopResult, 8), refreshResults: make(chan instanceRefreshResult, 1), tabsResults: make(chan instanceTabsResult, 1), searchResults: make(chan pathSearchResult, 8), executableResults: make(chan executablePickResult, 1), directoryResults: make(chan directoryPickResult, 1)}
+	}, pathFieldFeedback: make(map[PathField]string), rowClicks: make(map[string]*widget.Clickable), startClicks: make(map[string]*widget.Clickable), editClicks: make(map[string]*widget.Clickable), deleteClicks: make(map[string]*widget.Clickable), proxyPickerChoices: make(map[string]*widget.Clickable), startStates: make(map[string]*instanceStartState), stopStates: make(map[string]*instanceStopState), pendingManagedExit: make(map[managedExitKey]ManagedInstanceExit), nextInstance: 4, startResults: make(chan instanceStartResult, 8), stopResults: make(chan instanceStopResult, 8), deleteDataResults: make(chan instanceDataDeleteResult, 1), refreshResults: make(chan instanceRefreshResult, 1), tabsResults: make(chan instanceTabsResult, 1), searchResults: make(chan pathSearchResult, 8), executableResults: make(chan executablePickResult, 1), directoryResults: make(chan directoryPickResult, 1)}
 	s.chromePath.SetText(`C:\Program Files\Google\Chrome\Application\chrome.exe`)
 	s.edgePath.SetText(`C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe`)
 	s.dataDir.SetText(`C:\Users\Public\chub\profiles`)
@@ -535,6 +553,11 @@ func (s *Shell) OnStopInstance(stopper InstanceStopper, invalidate func()) {
 	s.invalidate = invalidate
 }
 
+func (s *Shell) OnDeleteInstanceData(deleter InstanceDataDeleter, invalidate func()) {
+	s.instanceDataDeleter = deleter
+	s.invalidate = invalidate
+}
+
 // ReportManagedExit is safe for the application's single per-instance monitor
 // goroutine. The event is consumed during the next UI frame and therefore does
 // not perform layout or mutate widgets from a background thread. The monitor
@@ -579,6 +602,7 @@ func (s *Shell) Layout(gtx layout.Context) layout.Dimensions {
 	s.consumeDirectoryResults()
 	s.consumeStartResults()
 	s.consumeStopResults()
+	s.consumeInstanceDataDeleteResults()
 	s.consumeRefreshResults()
 	s.consumeTabsResults()
 	s.consumeManagedExitResults()
@@ -736,6 +760,8 @@ func (s *Shell) consumeKeyboard(gtx layout.Context) {
 		case key.NameEscape:
 			if s.unexpectedExitOpen {
 				s.dismissUnexpectedExitNotice()
+			} else if s.pendingDeleteID != "" && !s.deleteDataRunning {
+				s.cancelDelete()
 			} else if s.pendingProxyDelete != "" {
 				s.cancelProxyDelete()
 			} else if s.proxyPicker.open {
@@ -1674,27 +1700,74 @@ func (s *Shell) deleteConfirmationCard(row InstanceRow) layout.Widget {
 			},
 			func(gtx layout.Context) layout.Dimensions {
 				return layout.Inset{Top: unit.Dp(20), Right: unit.Dp(24), Bottom: unit.Dp(20), Left: unit.Dp(24)}.Layout(gtx, func(gtx layout.Context) layout.Dimensions {
-					return layout.Flex{Axis: layout.Vertical}.Layout(gtx,
+					children := []layout.FlexChild{
 						layout.Rigid(material.H6(s.theme, "删除实例？").Layout),
 						layout.Rigid(layout.Spacer{Height: unit.Dp(8)}.Layout),
 						layout.Rigid(material.Body1(s.theme, fmt.Sprintf("确定删除实例“%s”？", row.Name)).Layout),
 						layout.Rigid(layout.Spacer{Height: unit.Dp(6)}.Layout),
-						layout.Rigid(material.Caption(s.theme, "不会删除 User Data Dir；若浏览器仍在运行，它会继续运行。").Layout),
+						layout.Rigid(material.Caption(s.theme, "默认只删除 Chub 实例配置；User Data Dir 会保留。").Layout),
-						layout.Rigid(layout.Spacer{Height: unit.Dp(18)}.Layout),
+						layout.Rigid(layout.Spacer{Height: unit.Dp(12)}.Layout),
-						layout.Rigid(func(gtx layout.Context) layout.Dimensions {
+					}
-							return layout.Flex{Alignment: layout.Middle}.Layout(gtx,
+					if s.deleteDataRunning {
-								layout.Rigid(s.deleteCancelButton),
+						children = append(children,
-								layout.Rigid(layout.Spacer{Width: unit.Dp(8)}.Layout),
+							layout.Rigid(s.instanceFormFeedback("正在删除 User Data Dir 数据，请勿关闭应用…")),
-								layout.Rigid(s.deleteConfirmButton),
+						)
-							)
+					} else {
-						}),
+						children = append(children,
-					)
+							layout.Rigid(s.deleteDataOption(row)),
+							layout.Rigid(layout.Spacer{Height: unit.Dp(18)}.Layout),
+							layout.Rigid(func(gtx layout.Context) layout.Dimensions {
+								return layout.Flex{Alignment: layout.Middle}.Layout(gtx,
+									layout.Rigid(s.deleteCancelButton),
+									layout.Rigid(layout.Spacer{Width: unit.Dp(8)}.Layout),
+									layout.Rigid(s.deleteConfirmButton),
+								)
+							}),
+						)
+					}
+					dims := layout.Flex{Axis: layout.Vertical}.Layout(gtx, children...)
+					if s.deleteDataFocus && !s.deleteDataRunning {
+						gtx.Execute(key.FocusCmd{Tag: &s.deleteCancel})
+						s.deleteDataFocus = false
+					}
+					return dims
 				})
 			},
 		)
 	}
 }
 
+func (s *Shell) deleteDataOption(row InstanceRow) layout.Widget {
+	return func(gtx layout.Context) layout.Dimensions {
+		canDeleteData := s.instanceDataDeletionAllowed(row)
+		children := []layout.FlexChild{
+			layout.Rigid(func(gtx layout.Context) layout.Dimensions {
+				if !canDeleteData {
+					gtx = gtx.Disabled()
+				}
+				return material.CheckBox(s.theme, &s.deleteData, "同时删除 User Data Dir 中的数据").Layout(gtx)
+			}),
+			layout.Rigid(layout.Spacer{Height: unit.Dp(4)}.Layout),
+		}
+		if !canDeleteData {
+			children = append(children, layout.Rigid(material.Caption(s.theme, "浏览器正在运行、启动/停止或占用；请先停止并刷新状态后再删除数据。当前仍可只删除实例配置。").Layout))
+		} else if s.deleteData.Value {
+			children = append(children, layout.Rigid(s.instanceFormFeedback(fmt.Sprintf("将永久删除 User Data Dir：\n%s\n此操作无法恢复；执行前会再次检查浏览器占用。", row.UserDataDir))))
+		}
+		if s.deleteDataFeedback != "" {
+			children = append(children,
+				layout.Rigid(layout.Spacer{Height: unit.Dp(8)}.Layout),
+				layout.Rigid(s.instanceFormFeedback(s.deleteDataFeedback)),
+			)
+		}
+		return layout.Flex{Axis: layout.Vertical}.Layout(gtx, children...)
+	}
+}
+
+func (s *Shell) instanceDataDeletionAllowed(row InstanceRow) bool {
+	return row.Status == "已退出" || row.Status == "启动失败"
+}
+
 func (s *Shell) deleteCancelButton(gtx layout.Context) layout.Dimensions {
 	style := material.Button(s.theme, &s.deleteCancel, "取消")
 	style.Background = color.NRGBA{R: 230, G: 232, B: 235, A: 255}
@@ -1703,7 +1776,11 @@ func (s *Shell) deleteCancelButton(gtx layout.Context) layout.Dimensions {
 }
 
 func (s *Shell) deleteConfirmButton(gtx layout.Context) layout.Dimensions {
-	style := material.Button(s.theme, &s.deleteConfirm, "删除")
+	label := "删除实例"
+	if s.deleteData.Value {
+		label = "删除实例及数据"
+	}
+	style := material.Button(s.theme, &s.deleteConfirm, label)
 	style.Background = color.NRGBA{R: 188, G: 51, B: 51, A: 255}
 	style.Color = color.NRGBA{R: 255, G: 255, B: 255, A: 255}
 	return style.Layout(gtx)
@@ -3145,11 +3222,18 @@ func (s *Shell) requestDelete(id string) {
 		return
 	}
 	s.pendingDeleteID = id
+	s.deleteData.Value = false
+	s.deleteDataRunning = false
+	s.deleteDataFeedback = ""
+	s.deleteDataFocus = true
 }
 
 func (s *Shell) consumeDeleteConfirmation(gtx layout.Context) {
 	for s.deleteBlocker.Clicked(gtx) {
 	}
+	if s.deleteDataRunning {
+		return
+	}
 	for s.deleteCancel.Clicked(gtx) {
 		s.cancelDelete()
 	}
@@ -3198,16 +3282,50 @@ func (s *Shell) dismissUnexpectedExitNotice() {
 }
 
 func (s *Shell) cancelDelete() {
+	if s.deleteDataRunning {
+		return
+	}
 	if row, ok := s.instanceRow(s.pendingDeleteID); ok {
 		s.instanceFeedback = fmt.Sprintf("已取消删除实例“%s”。", row.Name)
 	}
 	s.pendingDeleteID = ""
+	s.deleteData.Value = false
+	s.deleteDataFeedback = ""
+	s.deleteDataFocus = false
 }
 
 func (s *Shell) confirmDelete() {
-	id := s.pendingDeleteID
+	row, ok := s.instanceRow(s.pendingDeleteID)
-	s.pendingDeleteID = ""
+	if !ok {
-	s.deleteInstance(id)
+		s.pendingDeleteID = ""
+		return
+	}
+	if !s.deleteData.Value {
+		s.pendingDeleteID = ""
+		s.deleteDataFocus = false
+		s.deleteInstance(row.ID)
+		return
+	}
+	if !s.instanceDataDeletionAllowed(row) {
+		s.deleteDataFeedback = "当前状态不能删除 User Data Dir；请先停止浏览器并刷新状态。实例配置尚未删除。"
+		return
+	}
+	if s.instanceDataDeleter == nil {
+		s.deleteDataFeedback = "删除实例数据服务尚未准备好。实例配置和 User Data Dir 均未删除。"
+		return
+	}
+	s.deleteDataRequest++
+	request := s.deleteDataRequest
+	fingerprint := instanceRefreshFingerprint(row)
+	s.deleteDataRunning = true
+	s.deleteDataFeedback = ""
+	go func() {
+		err := s.instanceDataDeleter(context.Background(), row)
+		s.deleteDataResults <- instanceDataDeleteResult{id: row.ID, request: request, fingerprint: fingerprint, err: err}
+		if s.invalidate != nil {
+			s.invalidate()
+		}
+	}()
 }
 
 func (s *Shell) deleteInstance(id string) {
@@ -3229,6 +3347,54 @@ func (s *Shell) deleteInstance(id string) {
 	s.instanceFeedback = "找不到要删除的实例。"
 }
 
+func (s *Shell) consumeInstanceDataDeleteResults() {
+	for {
+		select {
+		case result := <-s.deleteDataResults:
+			if !s.deleteDataRunning || result.request != s.deleteDataRequest || result.id != s.pendingDeleteID {
+				continue
+			}
+			row, ok := s.instanceRow(result.id)
+			if !ok || instanceRefreshFingerprint(row) != result.fingerprint {
+				s.deleteDataRunning = false
+				s.deleteDataFeedback = "实例配置已变化，未继续删除数据。请重新打开删除确认。"
+				continue
+			}
+			s.deleteDataRunning = false
+			if result.err != nil {
+				s.deleteDataFeedback = "未删除实例配置或 User Data Dir。请关闭浏览器并检查目录权限后重试。"
+				continue
+			}
+			s.pendingDeleteID = ""
+			s.deleteData.Value = false
+			s.deleteDataFeedback = ""
+			s.deleteDataFocus = false
+			s.deleteInstanceAndData(row.ID)
+		default:
+			return
+		}
+	}
+}
+
+func (s *Shell) deleteInstanceAndData(id string) {
+	for i, row := range s.rows {
+		if row.ID != id {
+			continue
+		}
+		s.rows = append(s.rows[:i], s.rows[i+1:]...)
+		delete(s.startClicks, id)
+		delete(s.rowClicks, id)
+		delete(s.editClicks, id)
+		delete(s.deleteClicks, id)
+		delete(s.startStates, id)
+		delete(s.stopStates, id)
+		s.instanceFeedback = fmt.Sprintf("已删除实例“%s”及其 User Data Dir 数据。", row.Name)
+		s.notifyInstancesChanged()
+		return
+	}
+	s.instanceFeedback = "找不到要删除的实例。"
+}
+
 func (s *Shell) instanceRow(id string) (InstanceRow, bool) {
 	for _, row := range s.rows {
 		if row.ID == id {

internal/ui/shell_test.go

@@ -136,6 +136,111 @@ func TestShellDeletesOnlyAfterConfirmation(t *testing.T) {
 	}
 }
 
+func TestShellDeletesInstanceDataBeforeRemovingConfiguration(t *testing.T) {
+	shell := NewShell(material.NewTheme())
+	target := shell.rows[3]
+	deletions := 0
+	shell.OnDeleteInstanceData(func(_ context.Context, row InstanceRow) error {
+		deletions++
+		if row.ID != target.ID || row.UserDataDir != target.UserDataDir {
+			t.Fatalf("delete snapshot = %#v", row)
+		}
+		return nil
+	}, nil)
+
+	shell.requestDelete(target.ID)
+	shell.deleteData.Value = true
+	shell.confirmDelete()
+	if !shell.deleteDataRunning || len(shell.rows) != 4 {
+		t.Fatalf("data deletion started=%v rows=%d", shell.deleteDataRunning, len(shell.rows))
+	}
+	var result instanceDataDeleteResult
+	select {
+	case result = <-shell.deleteDataResults:
+	case <-time.After(time.Second):
+		t.Fatal("data deletion did not produce a result")
+	}
+	if deletions != 1 {
+		t.Fatalf("deletions = %d", deletions)
+	}
+	shell.deleteDataResults <- result
+	shell.consumeInstanceDataDeleteResults()
+	if shell.pendingDeleteID != "" || shell.deleteDataRunning || len(shell.rows) != 3 {
+		t.Fatalf("data deletion state = pending %q running=%v rows=%d", shell.pendingDeleteID, shell.deleteDataRunning, len(shell.rows))
+	}
+	if _, exists := shell.instanceRow(target.ID); exists || !strings.Contains(shell.instanceFeedback, "及其 User Data Dir 数据") {
+		t.Fatalf("data deletion did not remove target: rows=%#v feedback=%q", shell.rows, shell.instanceFeedback)
+	}
+}
+
+func TestShellKeepsInstanceWhenDataDeletionFails(t *testing.T) {
+	shell := NewShell(material.NewTheme())
+	target := shell.rows[3]
+	shell.OnDeleteInstanceData(func(context.Context, InstanceRow) error {
+		return errors.New("permission denied")
+	}, nil)
+
+	shell.requestDelete(target.ID)
+	shell.deleteData.Value = true
+	shell.confirmDelete()
+	var result instanceDataDeleteResult
+	select {
+	case result = <-shell.deleteDataResults:
+	case <-time.After(time.Second):
+		t.Fatal("data deletion did not produce a result")
+	}
+	shell.deleteDataResults <- result
+	shell.consumeInstanceDataDeleteResults()
+	if !shell.deleteData.Value || shell.pendingDeleteID != target.ID || shell.deleteDataRunning || len(shell.rows) != 4 {
+		t.Fatalf("failed deletion state = data=%v pending=%q running=%v rows=%d", shell.deleteData.Value, shell.pendingDeleteID, shell.deleteDataRunning, len(shell.rows))
+	}
+	if !strings.Contains(shell.deleteDataFeedback, "未删除实例配置或 User Data Dir") {
+		t.Fatalf("failure feedback = %q", shell.deleteDataFeedback)
+	}
+}
+
+func TestShellRejectsInstanceDataDeletionWhenStatusIsActive(t *testing.T) {
+	shell := NewShell(material.NewTheme())
+	target := shell.rows[0]
+	called := false
+	shell.OnDeleteInstanceData(func(context.Context, InstanceRow) error {
+		called = true
+		return nil
+	}, nil)
+
+	shell.requestDelete(target.ID)
+	shell.deleteData.Value = true
+	shell.confirmDelete()
+	if called || shell.deleteDataRunning || len(shell.rows) != 4 {
+		t.Fatalf("active data deletion called=%v running=%v rows=%d", called, shell.deleteDataRunning, len(shell.rows))
+	}
+	if !strings.Contains(shell.deleteDataFeedback, "当前状态不能删除") {
+		t.Fatalf("active deletion feedback = %q", shell.deleteDataFeedback)
+	}
+}
+
+func TestShellDiscardsStaleInstanceDataDeletionResult(t *testing.T) {
+	shell := NewShell(material.NewTheme())
+	target := shell.rows[3]
+	shell.OnDeleteInstanceData(func(context.Context, InstanceRow) error { return nil }, nil)
+
+	shell.requestDelete(target.ID)
+	shell.deleteData.Value = true
+	shell.confirmDelete()
+	var result instanceDataDeleteResult
+	select {
+	case result = <-shell.deleteDataResults:
+	case <-time.After(time.Second):
+		t.Fatal("data deletion did not produce a result")
+	}
+	shell.rows[3].UserDataDir = "C:\\profiles\\changed"
+	shell.deleteDataResults <- result
+	shell.consumeInstanceDataDeleteResults()
+	if shell.pendingDeleteID != target.ID || len(shell.rows) != 4 || !strings.Contains(shell.deleteDataFeedback, "配置已变化") {
+		t.Fatalf("stale deletion state = pending=%q rows=%d feedback=%q", shell.pendingDeleteID, len(shell.rows), shell.deleteDataFeedback)
+	}
+}
+
 func TestShellStartsInstanceAsynchronouslyAndAppliesResult(t *testing.T) {
 	shell := NewShell(material.NewTheme())
 	target := shell.rows[0]