> I'd also propose some initial startup magic that strongly advises immediately saving the image under a new
> name so that the original stays clean. I'm not *completely *convinced that this is required since it ought to be

I had the same thought when I made the first release-candidate with
read-only image and changes file.  That way a reminder warning is
produced on startup where the user can simply save as.  Intsead of
this warning we could simply produce the Save As dialog box (but with
the warning message) offering the user to simply enter their desired
name and press Enter or click Cancel to not.