Dell's PowerStoreOS 5.0.0.x notes include fixes and known behavior around file metro, reprotect, unplanned failover, and capacity alerts after a non-disruptive upgrade. They expose an important distinction: an NDU can complete successfully while the recovery topology is not ready for the next real failure.
Why it matters in production
The precheck should map appliance model, current and target code, file and block services, metro sessions, witness and network dependencies, replication state, snapshots, hosts, multipathing, and available capacity. Upgrade eligibility depends on topology, not only the version shown in the manager.
A runbook needs checkpoints before, during, and after each node or appliance transition. Preserve configuration and health evidence, monitor host I/O and replication, define pause criteria, and keep vendor support information ready. Do not dismiss unexpected alerts until capacity and telemetry have been independently verified.
Validation must include planned and, where safely rehearsed, unplanned failover behavior, session recovery, reprotect, host access, snapshot operations, and monitoring. Testing only steady-state I/O misses the feature that justified metro replication in the first place.
Practical takeaway
The practical conclusion is that non-disruptive describes the upgrade mechanism, not the full service outcome. Close the change only when applications remain reachable and the replication pair can fail over and protect again. Recovery readiness needs its own acceptance criteria.