A design review is not a place to admire a diagram. I have sat in reviews where the boxes and arrows were immaculate and the system still fell over in its first month, because the failure everyone missed was a vendor that answers in nine seconds instead of two hundred milliseconds.
So I stopped reviewing designs freeform. I ask the same six questions, in the same order, and I do not move on until each one has a concrete answer. The order matters. It puts the boring questions before the interesting ones, which is exactly where the risk lives.
The six questions
Why question three is the one
Teams plan for outages. Outages are dramatic, they have a status page, and everyone knows what to do. Degradation is quieter. A third party that normally answers in two hundred milliseconds starts taking six seconds, nothing throws an error, and every worker in the pool is busy waiting. The queue grows, the retries pile on top of the original load, and by the time an alert fires the system is doing nothing except making the problem worse.
In document processing this is routine. A bank statement takes as long as it takes, and the upstream vendor has a bad afternoon roughly once a quarter. So the answer has to exist before the incident: a timeout budget per hop, a circuit breaker that trips on latency and not only on errors, a bounded queue that sheds instead of swallowing, and a user-visible state that says the result is coming later rather than pretending it is coming now.
Resilience is a design-time decision. Everything you add after the first incident is a patch, and patches are how systems get complicated.
When the answer is missing
I do not reject the design. I write the unanswered question at the top of the document and send it back with a date. Nine times out of ten the second version is smaller than the first, because answering question three honestly usually removes a component rather than adding one.
The last thing I want is a review where I am the smartest person in the room. Six fixed questions mean the team can run the check without me, which is the only version of this that scales.