The user application is loaded first. With SYSTEM_THREAD(ENABLED) the user firmware continues to run during download. After download completes, the device resets.
If there is a required Device OS, bootloader, softdevice, or NCP upgrade, these are done. At this point, the device is in safe mode (breathing magenta) and the user firmware will not run again until all dependencies are met. There will be a reboot after each part is received.
All OTA transfers are done into a holding area. If the download fails, it will be repeated. Also, in the very unlikely case the download is corrupted and the CRC check fails, the download is discarded and downloaded again.
Exception: On Gen 3 devices with Device OS 3.0.0 and later, in some cases a combined update can be done. Both the system part and user part are sent in a single transfer together. After reboot, both are loaded which allows the device to resume executing user firmware again much more quickly, with only a single reset.
Also on Gen 3 devices with Device OS 3.0.0 and later, downloads are resumable. If the connection is lost during the download, it will proceed at the point it stopped in the next download attempt. With earlier versions of Device OS it would start over from the beginning again.