Function is_strict_only_deterministic_refusal_syscall 

pub fn is_strict_only_deterministic_refusal_syscall(sysno: Sysno) -> bool

Returns whether sysno is refused by the default fail-closed policy but forwarded under the explicit compatibility opt-out. The legacy strict_only name is retained for API compatibility.