Design review before you write the service

Review this design before I build it: {{paste design or describe: what it does, data model, endpoints, dependencies, expected scale}}.

Attack it in this order:
1. FAILURE MODES — for each external dependency, what happens when it's slow, down, or returns garbage? Where does the failure propagate?
2. CONSISTENCY — what happens on partial failure, retry, or double-delivery? Is anything not idempotent that will be retried?
3. DATA — will the schema survive the second use case? What migration will hurt at 100× the data?
4. SCALE — what breaks first at 10× and at 100×, and is that acceptable?
5. OPERATIONS — how do I know it's broken before a customer tells me? What do I need to log, meter, and alert on?
6. SIMPLICITY — which component could be deleted entirely, and what would we lose?

End with: the three riskiest assumptions, the smallest version worth shipping first, and one thing I should decide before writing code.