[AndreKalberer]

When a PDF is cleared or replaced while decoding or rendering, its pending work can complete later and overwrite the new reader state or paint stale pixels. Rapid page or zoom changes can also finish out of order.

Track ownership of the PDF loading and render tasks, destroy obsolete loads, cancel obsolete renders, and ignore stale results. Render into a detached canvas and copy pixels only when the document and generation remain current. Page navigation reports current failures without letting cancelled work disturb the replacement reader.

This is the PDF cancellation slice only, stacked on #19 (codex/hbr005-epub-resources). The three changed files are the renderer, a real-decoder cancellation smoke test, and its registration in the desktop smoke runner. No release version or installer metadata changes.

Validation:

• Consumer suite passed on the final source; independent review reported no findings.
• Fresh focused source smoke passed all 25 races; syntax checks and diff checks passed.
• The regression fixture fails on the baseline and covers file-read success/failure, decoder completion, page fetch, completed rendering, in-progress painting, and reverse page completion across clear, EPUB, audio, and PDF replacement. It checks document identity, viewer state, page/zoom, dimensions, pixels, and loading-task destruction.
• Packaged verification passed all 25 races and local-library regressions using a copied frozen 2.3.10 QA package with only the reviewed PDF production delta. Additional real disk PDF/EPUB/WAV/invalid-PDF fixtures and cleanup passed. Physical evidence confirmed isPackaged, context isolation and sandbox enabled, and Node integration disabled; testing used isolated temporary profiles.
• Archive parity confirmed only the renderer changed; 1,039 other archive files and 133 external runtime files were preserved apart from the updated archive. The original release archive remained unchanged.

Packaged verification was a scoped QA package copy, not a new released build or installer. No installation was performed. Initial launches from a temporary executable location stalled renderer debugging; the same package in the repository QA location passed without production changes.