Flink guarantees exactly-once application state access/updates. There is no mention of exactly-once delivery anywhere and it is pretty much impossible to offer this for just any general sink. That does not exclude the possibility of offering a special-purpose transactional sink implementation in the future though (e.g. via external distributed locking/state reconciliation), just saying...