When a new system image is installed the currently saved image is copied to the new image, and the default boot image is set to the new image.
If a user does not reboot right away new config changes are only written to the currently running image. It is not apparent that they are in a state where the config they just saved is not the config they will load upon next reboot.
I propose 2 notification prior to reboot in the appropriate cases.
A notification prior to reboot that the image that will be booted to differs from the currently running image.
An additional notification prior to reboot when the config that will be loaded does not match the config saved for the currently running image.