This ensure capacity call does not match the number of
appendAssumeCapacity() calls that follow it. Fix this.

This was discovered due to hitting the assertion failure in
appendAssumeCapacity() while building river.

I'm not sure how to isolate a minimal reproducer for a test.