The issue as described to me by Boris is that if a caller to Render modifies the returned BsonDocument then a subsequent call to Render returns the modified BsonDocument.

This could be resolved by clarifying ownership rules of the mutable BsonDocument. Only the owner of the BsonDocument should modify it.

Most likely this would mean that that BsonDocumentSearchDefinition should own the BsonDocument, which in turn means that callers to Render should not modify the returned BsonDocument because they don't own it. However, such a rule can't be enforced at compile time because BsonDocument is mutable.

Alternatively, BsonDocumentSearchDefinition could make a defensive copy of the BsonDocument before returning it from Render (and possibly in the constructor as well to protect the document even further). This approach would be safe but involves more memory allocations.