import { type MetalExec, type MetalProvisionProfile } from './metal-provision';
/** Aggregate boundary for every QEMU service on one physical host. */
export declare function metalGuestSliceUnit(profile: MetalProvisionProfile): string;
/** Keep host daemons and interactive sessions off every guest CPU. */
export declare function metalHousekeepingDropIn(profile: MetalProvisionProfile, kind: 'slice' | 'scope'): string;
/**
 * Persist and activate the host/guest cgroup boundary.
 *
 * Existing ForgeZero guests are never silently moved: changing a service's
 * Slice requires a restart, so an old QEMU still under system.slice makes this
 * operation fail before host restrictions are applied. The operator can then
 * drain and restart it deliberately.
 */
export declare function applyMetalIsolation(profile: MetalProvisionProfile, exec?: MetalExec): Promise<void>;