sync::Once, per instance

[sfackler]

It’s almost certainly just because it was more “obviously correct” during the initial implementation. We should be able to relax it.