boot_fd
These places are all safe, but it would catch bugs in the future more clearly to trip an assertion here.
ostree-boot-complete.service
ostree admin kargs edit-in-place