Function read_pending 

pub fn read_pending() -> Result<Option<PendingUpgrade>>

Read pending.json if present. Absent file → Ok(None). Corrupt JSON returns an error so callers can delete it and retry; apply_pending_upgrade does exactly that.