handle_image_upload captured FieldTarget::Model(mi) / FieldTarget::Part(mi,pi) as numeric indices at spawn time. After the async upload completed, the success path called image_list_mut(&mut guard, target, is_cover) which used those indices directly. Removing or reordering any earlier model mid-flight compacts the Vec, so the image would attach to the wrong model or silently drop out of bounds. Fix mirrors the stage_file_into precedent (J6): resolve the target to a stable StableImageTarget identity BEFORE the first await — for Model(mi) capture the model's model_id; for Part(mi,pi) capture the containing model's model_id AND a stable part discriminator (resource_id preferred over upload_id over name). Post-await, re-find the model by model_id and the part by its discriminator via image_list_stable_mut; if the target is gone or mismatched, skip the attach cleanly (truthful status handling consistent with stage_file_into's discard). FieldTarget::Thing is unaffected (no numeric index). The synchronous oninput / onclick handlers that also use image_list_mut have no await gap and remain safe. Regression tests drive the production resolve_image_target + image_list_stable_mut seams through a controllable oneshot future at the upload gap (same pattern as the J7 async regression test): 1. Model target at index 1, remove model-a mid-flight → image lands on model-b by identity, not at stale index 1. 2. Target model removed mid-flight → no attach anywhere, truthful skip. 3. Part target, remove earlier model mid-flight → attach follows stable part discriminator to the correct part. 3b. Part target, containing model removed mid-flight → clean skip. Epic: PM-86 Task: PM-83