'Exactly-once' is one of distributed systems' most-abused phrases. In specific contexts it's real and well-defined. Spread across multiple systems with side effects, it's effectively unachievable. Knowing the boundary keeps you out of trouble.
Within Kafka
Idempotent producer + transactional writes = exactly-once within Kafka (per producer session). Topic A → topic B via Kafka Streams with EOS = exactly-once. Real, well-tested.
Across systems
Kafka → Postgres exactly-once requires 2PC or 'transactional outbox'. Outbox: write to a Postgres table in the same transaction as your business write; separate process publishes to Kafka. Works in practice.
Side effects
Send an email, charge a credit card, call an external API — these can't be undone. Exactly-once needs idempotency keys at the side-effect layer. The system can guarantee at-most-once or at-least-once delivery, but exactly-once execution requires the receiver to dedupe.