fix(ios): bind export cancellation to the originating download

Ignore late picker callbacks that no longer match the active download. Add an Apple-platform regression; Swift formatting, parsing and seven portable policy tests pass locally, but the new WKWebView regression requires Xcode and has not run here.

ios/Sources/BrowserModel.swift

@@ -103,7 +103,8 @@ final class BrowserModel: NSObject, ObservableObject, WKNavigationDelegate, WKUI
         authentication = WebDestination(url: url)
     }
 
-    func removeDownload() {
+    func removeDownload(expected: URL? = nil) {
+        if let expected, download?.url != expected, downloadLocation != expected { return }
         download = nil
         if let location = downloadLocation {
             try? FileManager.default.removeItem(at: location.deletingLastPathComponent())

ios/Sources/ContentView.swift

@@ -155,7 +155,7 @@ struct ContentView: View {
             AuthenticationView(destination: destination.url, model: browser)
         }
         .sheet(item: $browser.download) { file in
-            ExportView(url: file.url) { browser.removeDownload() }
+            ExportView(url: file.url) { browser.removeDownload(expected: file.url) }
         }
     }
 

ios/Tests/BrowserModelTests.swift

@@ -13,6 +13,18 @@ final class BrowserModelTests: XCTestCase {
         XCTAssertFalse(model.web.isInspectable)
     }
 
+    @MainActor
+    func testLateExportCancellationDoesNotEraseAnotherServersDownload() {
+        let model = BrowserModel()
+        let previous = URL(fileURLWithPath: "/old-selection.txt")
+        let current = URL(fileURLWithPath: "/new-selection.txt")
+        model.download = WebDestination(url: current)
+        model.removeDownload(expected: previous)
+        XCTAssertEqual(model.download?.url, current)
+        model.removeDownload(expected: current)
+        XCTAssertNil(model.download)
+    }
+
     @MainActor
     func testServerErasureReplacesHistoryContext() async {
         let model = BrowserModel()