How to guarantee an OTA check before shutdown?

Firmware
10

I already have this code in use, which is supposed to block the turn-off from occurring. The problem is that the firmware_update event doesn’t come in until AFTER the shutdown has begun.

I am checking for it before shutting down.

void firmware_update_handler(system_event_t event, int status) {
  switch(status) {
    case firmware_update_begin:
      gFirmwareUpdateStatus = FW_UPDATING;
      appLog.info("Firmware update beginning event was triggered.");
      break;
    case firmware_update_progress:
      gFirmwareUpdateStatus = FW_UPDATING;
      appLog.info("Firmware update progress event was triggered.");
      break;
    case firmware_update_complete:
      gFirmwareUpdateStatus = FW_DONE;
      appLog.info("Firmware update complete event was triggered.");
      break;
    case firmware_update_failed:
      gFirmwareUpdateStatus = FW_DONE;
      appLog.error("Firmware update failed event was triggered.");
      break;
    default:
      appLog.warn("Unknown firmware_update_handler status %i", status);
      break;
  }
}

  0000016685 [app] TRACE: loop() gLoopState=ST_TURNING_OFF
  0000016690 [app] TRACE: turnOff()
* 0000016693 [app] INFO: Firmware wait/check started with status FW_NONE
* 0000016700 [app] INFO: Firmware wait/check done with status FW_NONE
  0000016696 [comm.protocol] INFO: rcv'd message type=13
  0000016832 [comm.protocol] INFO: rcv'd message type=13
  0000016961 [comm.protocol] INFO: Received TIME response: 1570750344
  0000016961 [comm.protocol] INFO: rcv'd message type=12
  0000017088 [comm.protocol] INFO: rcv'd message type=13
  0000017225 [comm.protocol] INFO: Sending 'S' describe message
  0000017431 [comm.dtls] INFO: session cmd (CLS,DIS,MOV,LOD,SAV): 4
  0000017440 [comm.dtls] INFO: session cmd (CLS,DIS,MOV,LOD,SAV): 3
  0000017440 [comm.protocol] INFO: rcv'd message type=1
  0000017795 [comm.protocol] INFO: Sending 'A' describe message
  0000017941 [comm.dtls] INFO: session cmd (CLS,DIS,MOV,LOD,SAV): 4
  0000017941 [comm.dtls] INFO: session cmd (CLS,DIS,MOV,LOD,SAV): 3
  0000017947 [comm.protocol] INFO: rcv'd message type=1
  0000020706 [app] INFO: Turning off after a 3 second log flush delay--MARK.
* 0000020712 [app] INFO: Firmware update beginning event was triggered.

Versus if I slap a 10 second delay in front of the update check before turnoff (a highly undesirable thing), this happens:

* 0000029426 [app] INFO: Firmware wait/check started with status FW_UPDATING
  0000029427 [app] INFO: Firmware update progress event was triggered.
  0000029433 [app] INFO: Firmware update progress event was triggered.
  ...
  0000049053 [comm] INFO: Update done 44
  0000049263 [comm] INFO: Waiting for Confirmed messages to be sent.
  0000049264 [app] INFO: Firmware update complete event was triggered.
* 0000049270 [app] INFO: Firmware wait/check done with status FW_DONE
  0000050269 [comm] INFO: All Confirmed messages sent: client(yes) server(yes)
  0000050270 [comm.protocol] INFO: rcv'd message type=6
  0000050271 [app] INFO: Restart event occurred!!!
  0000050280 [app] INFO: Restart event occurred!!!

This works in a same or similar way on system firmware 1.0.1 and 1.2.1