/**
 * Validates a caller-supplied controller scratch base and returns its canonical path.
 *
 * Pioneer's own default is deliberately short and is never routed through here, so an absent
 * override leaves production allocation byte-identical. An override is held to the same
 * standard as a writable run directory: it must already exist as a real directory, and it must
 * not be a broad or protected system location, because the actor's write grants follow it.
 */
export declare function validateControllerScratchBase(requested: string, platform?: NodeJS.Platform): Promise<string>;
/**
 * Reports why a base cannot host the proxy bridge socket, or `undefined` when it can. Kept
 * separate from the filesystem checks so the byte budget is verifiable without a fixture whose
 * own location would dominate the measurement.
 */
export declare function controllerScratchSocketFailure(canonical: string, platform?: NodeJS.Platform): string | undefined;
/**
 * Adopts a scratch directory the controller just created, refusing a substitution.
 *
 * `realpath` alone would follow a symlink left in place of the created directory, so the entry
 * is inspected without following links first and its resolved path must be the path that was
 * created. Cheap belt-and-braces behind the base checks, because it closes the window even on a
 * sticky shared base where a rename is supposed to be impossible.
 */
export declare function adoptCreatedScratchDirectory(created: string): Promise<string>;
/**
 * Refuses a scratch base that sits inside a path the actor is granted.
 *
 * The controller creates and removes its `pir-*` tree under this base, so a base beneath a
 * source or read grant would write through a mount the actor is promised read-only, and would
 * hand the sandbox overlapping read-only and writable paths. A base that merely shares an
 * ancestor with a grant is fine: the scratch it generates is a sibling, not a child.
 */
export declare function assertScratchBaseOutsideGrants(base: string, actorVisiblePaths: readonly string[]): void;
//# sourceMappingURL=controller-scratch.d.ts.map