Mutable BSON mostly uses Status codes to return errors upstream, however there are some open questions about what to do for cases where this is not possible, or for which the error indicates a fundamental abuse of the API (e.g. calling a method on a non-OK Element, which is arguably much like dereferencing an invalid shared pointer). Currently, these fundamental cases are handled with 'verify', but this is not ideal, as verify a) can't be tested, and b) doesn't provide much context. We need to determine whether these verify calls should be masserts, dasserts, fasserts, or removed.