cancelPending

Removes only pending local state. Any record already accepted by a provider remains discoverable and can be deleted separately; cancellation never silently destroys a recovery copy.