Exactly-once payment processing

Design an ordered, exactly-once payment-event processor that consumes 'charge', 'refund', and 'capture' events for merchant accounts off a partitioned log. Events for the same merchant+order must be applied in order; a duplicate or out-of-order apply must never double-charge or refund more than was captured. The processor writes to a ledger DB and emits downstream payout events. Producers and consumers can crash and retry at any point. How do you guarantee per-partition ordering and effectively-exactly-once application across crashes?