Function is_determinized_syscall 

pub fn is_determinized_syscall(sysno: Sysno) -> bool

Returns whether the audited runtime policy classifies sysno as Determinized — that is, Detcore either models the syscall with a handler or applies an explicit deterministic refusal policy to it.

This is the complement of the refusal boundary below. A backend that executes guest syscalls outside handle_syscall_event needs BOTH: the refusal set tells it which syscalls to answer with a fixed errno, and this predicate tells it which syscalls Detcore claims to determinize at all. Running a Determinized syscall natively is a determinism hole even when it is not in the refusal set, because the modelling that makes it deterministic lives in a handler the backend never entered.