Function resolve_commit 

pub fn resolve_commit<F>(
    store: &PdfSaveTokenStore,
    token: &str,
    target_path: Option<String>,
    read_current_source_for_recheck: F,
) -> Result<(String, Vec<u8>, PdfCommitResult), PdfEditError>
where
    F: FnOnce(&str) -> Result<Vec<u8>, PdfEditError>,

Resolves and consumes token, returning the bytes to write and the commit result — but performs no filesystem I/O itself beyond what read_current_source_for_recheck does. read_current_source_for_recheck is called only for a same-path Save (§10.3: “Same-path Save rechecks source SHA immediately before atomic replacement”) and must return the current on-disk bytes at source_path, compared against the SHA-256 recorded when the token’s candidate was staged ([SaveTokenRecord::source_sha256]). Kept filesystem-free otherwise so token lifecycle (expiry/replay/conflict) is directly unit-testable.

“Same path” here is string equality, which a path alias (/tmp/./memo.pdf, a hard link, a case variant on a case-insensitive volume) defeats. A host that touches the filesystem should call resolve_commit_with with a real file-identity comparison; crate::commit::commit_pdf_save does.