As per shutdown and update job in Google Dataflow with PubSubIO + message guarantees the pub/sub source for dataflow does not ack messages until they have been reliably persiste
I believe Dataflow automatically gives the behavior you want. We will not ack PubSub messages until we have finished processing them with your ParDo's and persisted the results.