build_append() is now public and JS validation is separate