macos: Supported API to establish filesystem ACL absence?

I'm implementing a security-sensitive filesystem metadata verifier on macOS 27.0.1 (Apple Silicon, MacOSX27.0.sdk).

The verifier must distinguish three states:

1. ACL absent: Supported evidence establishes that the file or directory has no filesystem ACL.
2. ACL present: An ACL exists, including an empty ACL.
3. Unknown: The observation is ambiguous, unavailable, unsupported, or incomplete.

Only authoritative ACL absence is acceptable. All other states are rejected.

I'm investigating fstatx_np() with a filesec_t object, followed by filesec_query_property(security, FILESEC_ACL, &present).

My questions are:

1. Does this combination provide a supported API guarantee that a file or directory has no ACL when present is reported as false?
2. Can an unset FILESEC_ACL property be reliably distinguished from an omitted or unavailable ACL observation?
3. If this mechanism cannot establish absence, is there another supported descriptor-based macOS API that can?
4. Is there Apple documentation specifying these semantics, including relevant error and unsupported-operation behavior?

I am not treating an empty ACL entry list, an unset property, or a command-line display without ACL entries as proof of absence.

I'm seeking the native API contract so the verifier can fail closed whenever ACL absence is not authoritatively established.