Durable decision with crash recovery Diagram

Durable first

The request is framed, checksummed and fsynced before anything else
Raw append is not durability: framing plus CRC plus force plus recovery is
A truncated tail is discarded; a corrupt record never applies

Decide once

The decision is taken once and stored before any output publishes
Restart re-reads the decision; it never re-decides on new balances
Reserved funds sit in a pending ledger: visible, never vanished

No atomic commit

Each shard's leader owns its leg; no 2PC spans shards
Partial publish recovers by replay; destinations dedup on the same ID
Final convergence is not atomic visibility: readers may see legs land separately