In reading order.
Inflow is a modular monolith whose modules agree on their boundaries and disagree about everything inside them - a four-project onion next to a single feature-sliced assembly. Part 1 of a series reading the money-moving half of the estate.
Inflow's Wallet has no balance column - the balance is a fold over the transfer ledger, computed the same way on the write side and the read side. It is the best decision in the module, and it costs more than it looks.
Inflow's Amount value object rejects anything above one million, and the wallet balance is an Amount. Two legal credits of six hundred thousand leave a wallet that can still take money in and can never be read or spent again.
Wallet.TransferFunds mutates a second aggregate root inside the first one's method - the textbook DDD violation, committed for a good reason. The reason survives the domain layer and does not survive the handler.
Each half of an Inflow transfer stores a referenceId in its metadata. On both legs that reference is the leg's own id - so the two halves of a transfer cannot be joined from the data they persist.
Inflow's Wallet guards its transfers behind a private HashSet and then exposes a public setter for it. Assigning an empty list zeroes any balance with no exception, no version bump and no trace - and Entity Framework never needed the setter.
Inflow's aggregate root increments its Version at most once per instance lifetime. As a concurrency token that is correct; as a version number it is a lie - and the one unit test that touches it documents the latch instead of catching it.
Inflow models money as an Amount that wraps a bare decimal and a Currency that lives beside it on the entity. The two never travel together, nothing rounds, and the column is unconstrained numeric.
Wallets is four projects, Payments is one, and the same author wrote both in the same week. Three claims are usually made for the extra assemblies - one is true and verifiable in XML, one is weaker than it looks, and one is provably false.
Wallets abstracts its queries behind a storage interface that returns aggregates and maps in memory. Payments injects the DbContext and projects in SQL. On the read path the layered module is the slower and more coupled one.
A single Guid minted at sign-up becomes a user, a customer, a payments customer, a wallet owner and a saga id - four Postgres schemas, five field names, zero foreign keys and nothing that declares the equality.
Locking a customer flips a flag in three of the four modules that hold one. Wallets has Lock and Unlock methods on its Owner entity and nothing in the estate ever calls them - so the module that moves money is the module that never hears.
Inflow's withdrawal flow is a three-module round trip with a compensating branch and no saga class. The correlation between the halves is a magic string declared three times and a JSON blob written by hand on one side and deserialised on the other.
Inflow's one real saga has four compensation methods and no message that can ever trigger them. Its state lives in memory, its ordering rests on an undocumented property of a background service, and its failure mode is a denied bonus recorded as success.
Inflow has nine tests, all in one module, and the most interesting one asserts a defect as if it were the specification. The honest retrospective on five modules, four architectures and what the estate actually teaches.