The ProducerDefault method in the transaction component uses fire-and-forget Channel.Publish(), which only guarantees bytes were written to the TCP buffer — not that the broker received or persisted the message. This creates a silent data loss window: if the broker crashes between TCP accept and disk persistence, the producer believes the message was delivered when it was not. As a result, transactions currently become dependent on the Redis outbox mechanism to recover from these undetected losses, adding unnecessary coupling and latency to the critical path.
The most critical impact is on the balance/transaction/operations async path (send-bto-execute-async.go), where a false-positive success prevents the synchronous DB fallback from triggering, leading to silent data loss.
Proposed fix: Enable AMQP Publisher Confirms using PublishWithDeferredConfirmWithContext + DeferredConfirmation.WaitContext so the producer only returns success after the broker explicitly acknowledges receipt. Scope limited to the transaction component's producer.rabbitmq.go.