It looks like when messages fail to process, the message is consumed and the offset moves on to the next message. We need to ensure every message is processed at least once, so we should only commit when everything has gone well. If there is ANY problem with a message, we must retry indefinitely.

Future note: This has an interesting impact on partition strategy. Any problem will hold up the entire partition, necessarily. One way to reduce this blast radius is to use more than one partition.