use auto ref for assumeSafeAppend