same recovery mechanism as when the Crowdstrike OTA goes wrong