Crash-Only Software and Recursive Microreboots