All of the verify(ok) calls in mutable/document.cpp are intended to have the semantics of invariant. Since invariant is preferred over verify, they should be updated to call invariant instead.