TMS320F280041: "C28xx_CPU1: Warning: Failed unlocking device (zone 1) after reset." after securing DCSM zones, even after unlocking

I have a problem where I can't reprogram our F280041 part after setting up DCSM secure zone 1.  (Marking nearly everything secure)

C28xx_CPU1: GEL Output: ... DCSM Initialization Start ...
C28xx_CPU1: GEL Output: ... DCSM Initialization Done ...
C28xx_CPU1: Warning: Failed unlocking device (zone 1) after reset.
C28xx_CPU1: Warning: Failed unlocking device (zone 2) after reset.
C28xx_CPU1: Flash Programmer: Error erasing Sector 0. FMSTAT value = 1040. Operation Cancelled (0).
C28xx_CPU1: File Loader: Memory write failed: Unknown error

I found two previous threads about this error, but one the original poster ghosted and the second was solved with a private reply.

I've changed the passwords in the f280041.gel file.

The dcsm.asm and dcsm.cmd files are imported from a separate project I use specifically to create them.  Does CCS require a SysConfig-configured DCSM object to connect correctly?

The part is very difficult to connect to as well.  We have a custom bootloader in FLASH sectors 0 and 1, and in 2 seconds it boots the application.  Luckily we added a DCSM unlock command to the bootloader before finally starting testing with secure zones (receiving encrypted passwords from the PC app)... but even with that we have to cycle power, send the unlock command, and start trying to connect in CCS within 1 second.  I almost wonder if something in the startup process of the main application clears the passwords.  (Not from our code, something generated from CCS, in ROM, or part of the standard library?)  We "boot" by disabling interrupts, setting SP to 0x400, and jumping to the application start address (taken from the main application's 0x80000 trampoline).

I've opened a memory viewer window directly on the 0x78000 DCSM addresses and it appears the DCSM zone is getting locked (CSMKEY passwords cleared I suppose) directly before the "erasing flash" step, and the "DCSM Initialization Start/Done" part does not seem to run before it attempts to erase.

I've tried turning off or on all the "reset before" type options in the debug configuration, and even commenting out resets in the GEL file or adding password writes to the end of OnPreFileLoaded, etc with no affect.  We've since restored the GEL file to near-original (passwords in SetupDCSM still changed of course)

By the way, it will not be possible to just shift the DCSM linkpointer and make a new zone configuration... we're testing near the end of development and we've started using a linkpointer of all 0s already.  Besides, that wouldn't really solve the problem.

Edit: I suppose one solution would be to pull GPIO37 low externally and send a bootstream over SCIA with a 0x000A DCSM unlock command in it...   However, I'd really like to regain our ability to flash from CCS.

Edit^2: We were able to reprogram the bootloader by making a RAM-based bootloader bootloader.  Since the RAM is part of the secure zone, it was able to rewrite FLASH sectors 0 and 1.  I would still like to know if there's a way to just erase/program directly from CCS.