Item 1 (MEDIUM): Add image_upload_operation token cell with begin_image_upload/set_image_upload_if_current mirroring the geometry upload ownership pattern. handle_image_upload now uses the token guard at all four status transitions so a stale image completion cannot overwrite a newer image upload's status. Item 2 (LOW): Invalidate upload_operation and image_upload_operation tokens at resume_draft, discard_draft, and mount-hook resume alongside the existing preview_generations clears. Item 3 (HIGH): Loopback PDS fixture now derives distinct per-request CIDs from the request body (repo+collection+record hash) instead of returning one hard-coded CID. Lifecycle assertions rebuilt to independently derive expected CIDs from request bytes, assert pairwise-distinct CIDs, assert exactly 3 calls in part→model→thing order before dereference, and assert publish output strong refs match captured responses. Item 4 (MEDIUM): Stage matrix test now independently derives expected chunk blob CID from request bytes via test_blob, asserting both response CID and stored manifest CID equal it; expected offset/size derived from request-byte length, not response fields. Item 5 (LOW): Replace the redundant sync commit regression test with a unique invariant — mismatched-primary rejection via direct commit_generated_preview call without touching composition. Epic: PM-86 Task: PM-83