crypto.randomUUID exists only in a secure context, so an admin served over plain HTTP from a LAN host threw on every editor upload while the status line still said uploading. uploadRequestId falls back to a v4 UUID from crypto.getRandomValues, or a time and counter id when no crypto object exists.