Oof, that burned-code scheme sounds like it has some painfully sharp UX edges if something goes awry in the new code resync portion.

But I'm guessing that's for serious security, where going to the guard shack is preferable to letting anyone unauthorized in?