use format as a simple recovery tester

Add a simple test of recovery -- on timed runs, the monitor thread optionally indirects through a NULL and core dumps, then we verify the object.