We currently have a series of invariants to double check that the common point found during rollback makes sense in relation to other timestamps that we maintain in the system (like the stable timestamp and the commit point). However, we've seen situations in the past where these invariants trigger not due to a programmer error, but because of the way someone has made changes to the replica set (like not following proper procedure during a restore) that has put the set in a bad state. I suspect an fassert would be more fitting here.