Thanks, I have been using Dualoptiboot and have experimented with the current OTA approach.
Two other factors I didn't mention originally that steer me towards a solution resembling Joe's:
1. I prefer not to have flash on every sensor node, given the power budget/assembly time/cost
2. I will be epoxy potting the nodes in order to weatherproof/condensation proof them for outdoor usage. This will render all of the programming pins inaccessible after initial configuration, so I'm looking for a system where an inadvertent programming error will be recoverable.
Jeff