The 1200 Classics and the 1400e Enhanced PanelView terminals had a Config/Run keyswitch. I don't think there was a "remote" mode; you had to physically get to the back of the terminal to put it into configuration mode, then set it up to receive a download.
PV+ can actually accept a download of a new Runtime file while the current application is still running. I like that; it allows me to take an operator's request for change and download it, then I can just walk out, stop the application, open the new application, and let the operator check out the changes. If I name the new application something different from the old one, I can switch back and forth rapidly.
There is an option when you download a new *.MER file to "run application after download", which causes a reboot. This is what Paul wants to prevent, and I don't know of a way to do it.
I have set up systems where I use a Global Connection Tag to send the PanelView Plus system clock seconds to a tag in the ControlLogix, creating a de-facto runtime heartbeat. This lets me detect the absence of a PanelView terminal in runtime.
There may be some features in FT AssetCentre or the FT Security system that prevent unauthorized downloads to a PV+ except by a Security-approved user. I'll take a peek at that.