The update window is a budget
An enterprise SSD rarely gets a maintenance window. The host NVMe driver applies a fixed timeout to admin commands and its own retry and failover logic to I/O. If activation overruns that budget, the layer above does not see "updating" — it sees a missing device. So exactly one quantity matters: the interval between the controller ceasing to accept new commands and becoming serviceable again must stay within what the host tolerates.
Download and activation are separate acts
The new image is written block by block into the spare bank, then signature-checked against the Secure Boot chain of trust. Up to this point the running firmware is untouched; a failed check simply discards a candidate. Only activation switches the boot pointer. NVMe defines several commit actions — replace without activating, replace and activate on next reset, activate immediately — and the real difference between them is when the risk is taken. Major version jumps normally require reset-based activation, because reset-free activation demands binary compatibility of internal data structures.
What the handover actually involves
Reset-free activation is not "swap the program and keep running". The controller must stop enqueueing, drain outstanding commands, flush the power-loss-protected write buffer, then reload the mapping table, bad-block table, SMART and telemetry counters in a form the new firmware understands. Counter semantics are the usual trap: if a new build redefines a statistic while reusing the old persistent slot, the SMART curve jumps inexplicably after the update — and monitoring systems alarm on exactly that.
Rollback has preconditions
Rollback is only safe while the persistent layout has not changed irreversibly. The workable approach is a format revision stamped into the header of the mapping table and journal region; if older firmware finds a revision above what it recognises, it refuses to mount and stays read-only rather than parsing under the old layout. Silent misinterpretation is far worse than an explicit refusal. That rule also shapes release cadence: any build that alters persistent layout ships on its own and is flagged one-way.
Part of the product baseline
Online update and rollback sit in JH Semiconductor's enterprise feature baseline alongside PLP, end-to-end protection, NVMe-MI and telemetry. The CORE 7 J750/J770 are at product-definition/EVT stage; the update flow and its firmware regression suite are being built in step, so every externally released build traces back to a defined test set.