Great, and ideally gravity can be used to move it. Remember, at Fukushima power to the pumps was lost.
Depending on a lack of incompetence in dangerous systems works until it doesn't. To the extent that these things can simply halt when incompetently managed, they should.
If anyone disagrees, I'd like to know why they think the next hundred years are going to be so much freer of political shortsightedness and corruption than the last hundred.
Sounds like a quite simple design indeed, and only one valve opening away from use?
Engineering a very resilient pond does not feel like as complex a problem as engineering highly complex cooling systems to be resilient.