Two more minor ideas about the blitter:
Given that there is a new address range for registers ($DFF2xx?) should the "USEx" bits of bltcon0 be separated from the other bits (i.e. make them two registers)? With a Blipper implemented a list of cookie-cuts could transform to a list of copy (repaint) ops by changing the initial minterm.
Would it make sense to introduce "relative" addresses? I.e. having a base address register for a channel and then add whatever value written to the address registers to get the full address. I'm still thinking in reference to a Blipper and trying to re-use lists as much as possible.
If pairing the base with a max register you could get some pseudo-security/exception handling if that has any value. Also, just setting the base to 0 would make it identical to what it does today anyway.