Cinderella: hardening, and a short pause on feature updates ☕ (Less visible work this round, and more of the kind that matters) A privacy fix worth disclosing. SimpleX groups have a private thread between a member and the admins, separate from the public conversation. We found that those private messages arrived through the same event as ordinary group messages, and nothing in the capture pipeline distinguished them. Two had already been captured. Neither was ever published, and both have been deleted. The fix is a whitelist rather than a filter: only what is provably a public group message reaches the archive, and anything else fails closed, including message types that do not exist yet. A missing archive entry is recoverable. A published private conversation is not. An audit of silent failure. Several problems this month shared one shape: an error caught, converted into a state that looked ordinary, and nobody told. A dead API key that read as no key. Images withheld with no error. So we went looking on purpose, classified all 114 caught errors in the codebase, and found nine real cases where something could fail invisibly. The worst was on the consent path. If deleting a member's message in the group failed, the error went to a log file and the archive kept the message published. Cross-referencing production showed it has never actually happened, all six group deletions applied correctly, but it was possible from the day the code was written. A failed deletion is now retried automatically until it succeeds or an operator is told. Video links play in the archive. A YouTube link renders as a card you can play in place. Nothing loads from any third party until you click: the thumbnail is fetched once server-side and served from our own domain, so opening the archive produces no external requests at all. Groundwork for what comes next. There is now a durable job queue underneath everything. Unglamorous, but it is what makes automatic categorisation possible without background work blocking the bot. Measured with two thousand jobs queued, an interactive reply is claimed in the same time as with an empty queue. Alongside it, a write-ahead log for incoming events. SimpleX delivers each event exactly once and never re-sends it, so a handler that fails loses that message permanently, with no record it existed. Recording events before processing them makes that recoverable. It also explains the sixteen failed file receipts that have been flagged since the early days: file events were recorded but never retried, and the relays expire files after about forty eight hours. Next two days: the local AI. We are standing up the self-hosted model that will drive categorisation and the media gallery, running on our own hardware rather than a third-party API, so conversations never leave infrastructure we control. That work happens off to the side, so expect fewer updates here until it is running. Normal service resumes after. https://github.com/saschadaemgen/cinderella