Flight Control has tested signed Zephyr firmware updates on a Raspberry Pi Pico W, including the failure path. MCUboot, the bootloader that chooses which image starts, writes an update to a second flash slot, checks its signature, and tries it once. If the new firmware cannot reconnect and report its status, the next boot returns to the previous image.
The physical-board run covered a full image, recovery from an image that could not reach the service, and an 8.6-kilobyte delta for a 734-kilobyte image. It also found a real platform defect: Zephyr 4.3.2 dropped flash writes shorter than one page on the Pico's chip. The project carries the upstream fix as a pinned patch, which is exactly the kind of fault a desktop-only update test would miss.
Remote update systems should be judged by the bad image they survive. Before shipping this path, a device team should repeat the test while removing power and network access at different points, then verify that the board either resumes the update or boots the last confirmed image.