Exactly-once ledger posting consumer

Design a ledger-posting consumer that reads money-movement commands from a partitioned queue (at-least-once delivery, possible reordering across partitions, occasional duplicates) and applies each as a balance change exactly once. ~15,000 commands/sec. A duplicate must not double-post; an out-of-order pair (capture before its authorize) must not corrupt the balance. How do you make application exactly-once and order-tolerant?