Review this PR like the reviewer everyone respects

Review the diff below as a senior engineer on this codebase would.

Order your review by what actually matters:
1. CORRECTNESS — logic errors, off-by-one, unhandled nulls, wrong error semantics, race conditions, transaction boundaries.
2. SAFETY — auth checks, input trust, injection, secrets, PII in logs, missing tenant scoping.
3. DATA — migrations that lock, missing indexes, N+1 queries, unbounded result sets.
4. INTERFACES — breaking changes for callers, backwards compatibility, API contract drift.
5. TESTS — what's untested that would break silently. Name the specific missing test cases.
6. MAINTAINABILITY — only if it's a real cost, not style preference.

For each finding: severity (blocker / should-fix / nit), the exact line, why it matters concretely, and the suggested change. End with a one-paragraph verdict and the single question I should ask the author.

DIFF:
{{paste diff}}