Consistent with historical semantics, the destination format will
be incomplete but valid if the copy fails. It must be cleared with
es_format_Clean() even in case of error (as before).

Also add a few assertions against invalid formats.