I'm recording this here in case someone else comes along and says "How does this work?" and wants to make it better.

The ET4's bootloader update occurs in two stages, the first of which is initiated by the UI. Which is to say, there's no "force" function. If an upgrade fails, you have to break out the ST link.

The way the upgrade works is that when you choose firmware from the UI's details, it calculates the MD5 hash of the firmware (ET4N.BIN) and then compares it to the hash (text) value in ET4N.TXT. If those match, it copies the file over to internal storage and resets.

The bootloader looks only at the internal storage (SDFat supports addressing devices as "0:/" and "1:/" for SD card and flash or SRAM or other storage.)

So that's why if things go south, you don't have a recovery story.

If someone wants to fix this, compile OpenBL with a start offset of 0x10000 (for compatibility) and then an upgrader firmware which will update the bootloader to OpenBL. That upgrader's firmware should be called ET4N.BIn and the md5 hash of it should be in ET4N.TXT. 

So OpenBL would become the bootloader, the patcher would basically exist only for updating the bootloader once, and afterwards OpenBL would allow disk based updates.

I detest this bootloader and don't have an ET4 so couldn't test it anyway.