/**
 * A token that distinguishes the process CURRENTLY holding `pid` from any later
 * process that inherits the same number, or null when this platform will not
 * tell us. Null is never a match — it means the caller must decide how to fail.
 *
 * Called at spawn and again on every liveness check, so cost matters: Linux is a
 * file read, macOS one `ps` (~2 ms), and Windows a WMI/CIM query — the one that
 * is genuinely expensive, and the reason a Windows READ is allowed to settle for
 * bare liveness.
 */
export declare function readProcIdentity(pid: number): string | null;
/**
 * How a captured identity relates to the one read just now.
 *
 * `unverifiable` is the load-bearing third answer: a token either side of the
 * comparison that cannot be parsed — a record written by the pre-canonical
 * format still on disk, a truncated or hand-edited value — proves NOTHING about
 * the process, and must never be allowed to masquerade as a mismatch. A false
 * mismatch is a confident "gone", and "gone" is what releases GPU locks and
 * refuses cancels; "unverifiable" merely holds. Tokens of different KINDS are
 * also unverifiable rather than a mismatch. Ticks vs an instant kind can only
 * meet across a platform change or a corrupted record; `epoch:` vs `utc:` meets
 * on EVERY macOS machine on the first upgrade past the zone fix, under every
 * job that is still running — the recorded `epoch:` was minted by a local-time
 * inversion whose value may be skewed by a zone change or a DST-ambiguous hour,
 * so agreeing or disagreeing with a zone-free `utc:` probe proves nothing
 * either way. Holding those jobs until their pid itself dies is the whole point
 * of the kind split: mismatching them would re-release a live job's GPU lock —
 * the defect — for exactly the population the fix protects.
 */
export declare function compareProcIdentity(captured: string, current: string): "match" | "mismatch" | "unverifiable";