You are right, it's potentially unsafe. The alternative is to have the site tasks set the last committed txnId and spHandle only during blocking join.