[bubavanhalen]

Summary

Rebuilds ElliePdf around a production-grade, worker-isolated PDF architecture while staying pinned to the newest approved .NET 11 preview toolchain. The reader now prioritizes bounded latency, responsive navigation, crash containment, atomic persistence, and releasable Windows packaging.

Changes

• Moves all PDFium parsing, rendering, forms, printing, organization, and annotation persistence behind an authenticated out-of-process worker with AppContainer/LPAC, brokered handles, process mitigations, watchdogs, and resource limits.
• Adds virtualized continuous layout, viewport tiling, prioritized scheduling, single-flight rendering, bounded CPU/GPU caches, semantic text/link/form overlays, and direct-pixel handoff.
• Adds atomic document saves, external-change detection, crash recovery checkpoints, source-preserving editable annotations, and an explicit flattened-copy workflow.
• Reconciles current master by removing its legacy in-process PDFium annotation writer and dependent tests; the supported Labs edit path now uses the worker transaction boundary.
• Adds session restoration, single-instance file activation, privacy-safe diagnostics, localization/pseudo-localization, accessibility contracts, printing, and responsive WinUI shell behavior.
• Pins .NET 11 preview, Windows App SDK preview dependencies, NuGet lock files, and verified x64/ARM64 PDFium assets with provenance and SBOM evidence.
• Adds x64/ARM64 CI, NativeAOT and MSIX lifecycle tooling, signing/store flight workflows, fuzz/soak/performance gates, and preview-update governance.
• Fixes .NET 11 preview solution-build commands that otherwise fail with NETSDK1134, and hardens concurrent AppContainer profile discovery.

Validation

• Locked solution restore passed.
• x64 Release app build passed with 0 warnings and 0 errors.
• ARM64 Release solution build passed with 0 warnings and 0 errors.
• Full Release suite passed: 342 passed, 3 intentional external-environment skips, 0 failed.
• Self-contained worker fuzz smoke passed: 5/5.
• PDFium integration passed: 17/17.
• Workflow lint passed with actionlint 1.7.7.
• Resource/localization validation passed: 262 keys across en-US and both pseudo-locales.
• Pinned PDFium verification passed for x64 and ARM64, including hashes, PE architecture, and 103 required exports.
• x64 NativeAOT worker self-test and unsigned MSIX payload/package validation completed during implementation.

Draft follow-ups

• Physical ARM64 NativeAOT/package execution requires the Visual Studio ARM64 C++ toolchain and trusted ARM64 runner; regular ARM64 compilation is green.
• WACK/install/update/uninstall validation, signed package provenance, and Microsoft Store flighting require release credentials/infrastructure.
• Interactive UIA/accessibility and reference-machine performance SLO runs require their dedicated Windows agents.

Checklist

• PDF document sessions and worker operations have bounded cancellation/disposal paths.
• No native PDFium binary is committed beside the UI process; production loading is worker-only.
• New services are registered through DI and WinUI consumers do not use static app state.
• Tests cover domain, transport, worker, recovery, rendering, semantics, packaging, fuzzing, and release contracts.