I build the parts of a system that are not allowed to be wrong.

A module's internals are not exported, so reaching into them does not compile. Architecture that lives in a wiki is a suggestion; architecture that fails the build is a rule. Tests over the dependency graph cover what the build cannot see — layering direction, framework leakage, and which package is allowed to know that a vendor SDK exists at all.

A currency-aware value object that refuses cross-currency arithmetic and rounds only when you hand it a rounding mode. Allocation is lossless: split a sum three ways and all of it is still there. The Tunisian dinar has three decimal places — exactly the kind of detail a double loses quietly, in production, at the end of a month.

No “commit, then send”. Domain events go into an outbox inside the caller's transaction and leave from there: at-least-once, with backoff and a dead-letter queue. That makes every handler idempotent by obligation rather than by hope — a redelivered event must not dispatch a second nurse.

Ten states, every transition tested — including the ones that must throw. The test I care about is not “the happy path works”, it is “nothing can get stuck”. A request that quietly stays where it is, is a person nobody visits.

Append-only, hash-chained, and bound to the transaction that caused it. An audit entry cannot survive a rolled-back action, and cannot exist without one. Invariants like this belong in the database as well as the code, so they hold against a psql session and not only against our own services.