Due to behavior described in SERVER-48327, the WT "all_durable" snapshot can move backward from ghost timestamps on primaries. Multi-document transactions with readConcern "snapshot" use the kAllDurableSnapshot ReadSource, which reads at the WT all_durable* timestamp.

If a ghost timestamp is used by a concurrent operation, an operation may observe all_durable moving backward after waiting for it to advance from a call to waitForAllEarlierOplogWritesToBeVisible. This means that a transaction with a readConcern "afterClusterTime: T" may read at a timestamp less than T.

I believe we can fix this by making all readers of all_durable go through getAllDurableTimestamp, which tracks and only returns the highest seen timestamp, preventing callers from seeing all_durable move backward.

*: all_durable is calculated as the minimum of (highest committed timestamp, oldest active timestamped transaction - 1)