It's a different class of non-determinism though. With
system_powerdown, you make a request to the guest. You don't know
whether the guest will comply with the request. The same level of
non-determinism exists with ballooning.
With system_reboot, you're taking an action (system_reset) and what's
not deterministic is whether you're taking that action based on what
someone requested on the monitor (system_reboot) verses whether you're
taking that action based on something the user did (shutdown). In the
later case, you're action is functionally incorrect.
Only if the shutdown from the user occurs in timeout period. So, yes,
it's still present, but the window of the behavior can be much
smaller.
I still think this is a reasonable approach even with that window.