Exactly-once charge execution

Design the charge-execution service for a payments platform that must move money exactly once per user-initiated charge, even though the upstream payment-processor API can time out (you don't know if the charge went through), the client retries on network errors, and your own workers can crash mid-flight. Throughput is ~5k charges/sec. Explain how you achieve effective exactly-once semantics end to end and what 'exactly once' really means here.