Safer enqueue

remove unsafe method calls, and catch some error to log
actually prefer to keep model dumb, so moving operational code out here.