Cross-shard transfers

Design account-to-account transfers in a banking core where accounts are sharded across many database partitions (by account id), and a single transfer can move money between two accounts on different shards. ~9,000 transfers/sec. The transfer must be atomic (both legs apply or neither), durable, and exactly-once under client retries. Describe how you make a cross-shard debit+credit atomic without a single global lock and how you handle a coordinator crash mid-transfer.