TODO(dborowitz): This is only public because callers expect validation to
happen before updating any refs, and they are still updating refs manually.
Make private once we have migrated ref updates into this class.