AWS warns explicitly that event source mappings process each event at least once and that duplicates can occur, which is why it recommends making function code idempotent. Exactly-once is the guarantee people assume and the docs deny. At-most-once would mean silently losing records, which is not the model. And per-shard ordering is about sequence, not duplication — an ordered stream can still redeliver a record.
Official docs