Function pamoja_updater_on_boot 

#[unsafe(no_mangle)]
pub unsafe extern "C" fn pamoja_updater_on_boot(
    updater: *mut PamojaUpdater,
    out_boot: *mut PamojaBoot,
) -> PamojaStatus

Decides what to run, and records that decision before returning it.

Call this once per boot, before jumping to an image. A staged image becomes pending here, so a device that resets before confirming reverts on the next call rather than trying a broken image forever.

Arguments

• updater - the updater.
• out_boot - receives the decision.

Returns

PamojaStatus::Ok on success, or a failure if there is nothing to fall back to.

Safety

updater must be a live handle from pamoja_updater_new, and out_boot must be writable.