I would make the ledger-posting crash window an explicit acceptance case: the ledger commits a balanced journal, but the consumer loses the acknowledgement and replays the event. The replay should return the same posting reference and create no second journal. A transaction reference alone needs an atomic uniqueness check at the posting boundary, not only deduplication in the message consumer.