The wal: :none ack path: publish one verified envelope to every sink its source declares, in the request process, and answer only once each has confirmed.

All sinks publish concurrently, and the whole set runs under one deadline, direct_publish_timeout_ms (default 8 000 ms, under the provider's own timeout). A sink that fails, crashes, or misses the deadline is a 503 with Retry-After, and the provider retries. Sinks that already confirmed keep their copy, so the retry is a second hook with a second id — the same at-least-once contract a provider retry after a lost ack has always had here, and the reason consumers dedupe on the idempotency key.

There is no retry policy and no dead-letter queue in this mode: the provider is the retry, and the broker is the durable store.