A down database cannot corrupt your outbox. The transaction just doesn't happen: no row, no event, nothing half-written.
The worker resumes later. The consumer never acknowledged, so the broker redelivers.
It recovers on its own, until retention starts deleting things.
#distributedsystems
