That makes sense. One part I'm still not clear on is how you accomplish a "restore" to fix the broken state of a process with a bitflip. Is it enough to simply copy all the shared state memory over as a block and jump into executing it? That seems like it would require the invariant that shared memory never references private memory, and I'm not sure how to statically enforce that.
You probably have hardware that watches ECC flags. For a correctable one-bit flip, it triggers a read-and-then-write. For a two-bit flip, it might just kill and restart the process, or reset the whole machine. As long as it doesn't happen too often, it's fine: the whole system (constellation and ground nodes) are designed to accommodate such events.
