more

cmd/order/main.go

@@ -102,11 +102,12 @@ func main() {
 		// event survives a broker outage or a crash after the state change.
 		box, err := outbox.Open(filepath.Join(dataDir, "outbox.log"))
 		if err != nil {
-			logger.Warn("outbox disabled: open failed", "err", err)
-		} else {
-			go box.Run(context.Background(), newRabbitPublisher(amqpURL), 5*time.Second, logger)
-			emitPub = box
+			// Durability-critical (same as the idempotency store): fail fast rather
+			// than silently publish events nowhere for the whole process lifetime.
+			log.Fatalf("open outbox: %v", err)
 		}
+		go box.Run(context.Background(), newRabbitPublisher(amqpURL), 5*time.Second, logger)
+		emitPub = box
 	}
 	freg := flow.NewRegistry()
 	flow.RegisterBuiltinHooks(freg)