I do something similar, but I decided that three jars were pointless. I have a -user jar, which contains everything and a -server jar that I use for deployment which contains everything, except source, in shared/server.
So your hotfix, then would be for the -server.jar instead of the -user.jar. The -user jar is only needed during client side and GWT compile.
To enforce the separation and reduce the possibility of unneeded serializers, I also have a common extensive rpc.blacklist that blacklists everything in a .client. package. There are a few exceptions to this list though, because GWT does not enforce its own client/shared/server convention in some of the older code for RPC And Servlets so there is some serializable RPC things and exceptions in the client packages that are needed if you want to do remote logging or RPC.