An event stream retains an ordered log within each partition. Consumers can replay it from a checkpoint, which supports recovery and new derived views. Partition order doesn't create a total order across every customer, and a checkpoint doesn't make an external side effect happen exactly once. Define the ordering key and the boundary of each guarantee.
A consumer can update its database and crash before saving the next offset. On replay, it must recognize the event or commit its result and checkpoint together. An email provider sits outside that transaction, so it still needs idempotency or reconciliation. You'll select partition keys, keep replay deterministic, and distinguish a stream's retention window from the historical data a rebuilt consumer needs.