Which is better for exactly-once processing: idempotent producers or transactions, and why?

They solve different, narrower problems, so "better" depends on what's actually being protected - it isn't really a straight substitute-for-substitute comparison.

Idempotent, deduplicating producers protect against a single producer accidentally publishing the same message twice due to its own retries, for example after an ambiguous network timeout; they're cheap, low-overhead, and sufficient when the risk is purely "did my publish get double-sent."

Transactions protect a broader case: atomicity across multiple operations, especially the common consume-process-produce pattern spanning different topics or partitions, ensuring the whole set of produces and acknowledgments happens or none of it does - something producer-side deduplication alone cannot guarantee, since it has no awareness of related acknowledgments elsewhere.

In practice, use plain deduplication for simple single-topic publish reliability where overhead should stay minimal, and reach for transactions specifically when a processing step must atomically span multiple topics or combine consuming and producing into one all-or-nothing unit - reserving the extra coordination overhead for the cases that actually need it.