> On restart after a "crash" is it really so
> difficult for the GUI to iterate its list of programs and signal them to
> redraw/invalidate?
This is indeed how I have in mind to implement restart. The problem is that once you build redraw/invalidate into the GUI you tend to start using it for other purposes, and it becomes a potential covert channel.
shap