The implementation shows that this is safe but it would be more correct to assert == 1 (like update/finalize do)