Cross-shard transactional atomicity

A sharded transactional store (sharded by user_id) needs to support transactions that span two shards: a money transfer where the sender and receiver hash to different shards and the debit + credit must be atomic (both or neither), at 20k transfers/sec. Single-shard transactions are cheap and common; cross-shard ones are the minority but must be correct. Design how cross-shard atomicity is achieved, how you minimize how often you pay that cost, and the failure mode of the chosen protocol plus how you bound it.