Maybe your button should only allow "load this asdf system". Then every code you use as a patch is a system that can be checked in -- hopefully just the same as you'd have in a fresh image, though sometime you need special magic (unintern, fmakunbound, etc.) to upgrade a live system that you don't need in a dead one.
international-lisp-conference.org does precisely that (the "button" being a backdoor URL).
- nick