perf(db): default MDBX sync mode to safe-no-sync

Change the default MDBX sync mode from Durable to SafeNoSync,
removing per-commit fsync from the persistence hot path. This
can improve persistence commit latency by up to 10x.

SafeNoSync guarantees:
- Database structural integrity on any crash (no corruption)
- On power loss: last few uncommitted txs roll back to the
  previous steady commit; reth recovers by re-executing from peers
- On app crash: no data loss (OS flushes mmap pages)

Users can opt back into per-commit fsync with:
  --db.sync-mode=durable

Amp-Thread-ID: https://ampcode.com/threads/T-019c315b-638c-7719-a301-8af76a3a8213
Co-authored-by: Amp <amp@ampcode.com>

crates/node/core/src/args/database.rs

@@ -55,6 +55,12 @@ pub struct DatabaseArgs {
     #[arg(long = "db.max-readers")]
     pub max_readers: Option<u64>,
     /// Controls how aggressively the database synchronizes data to disk.
+    ///
+    /// Defaults to `safe-no-sync` which skips per-commit fsync for significantly faster
+    /// persistence. Database integrity is preserved on any crash; only the most recent
+    /// transactions may be lost on power failure (reth recovers these from peers on restart).
+    ///
+    /// Use `durable` for per-commit fsync if strict durability is required.
     #[arg(
         long = "db.sync-mode",
         value_parser = value_parser!(SyncMode),

crates/storage/db/src/implementation/mdbx/mod.rs

@@ -109,15 +109,20 @@ pub struct DatabaseArguments {
     /// performance. The available modes are:
     ///
     /// - [`SyncMode::Durable`]: Ensures all transactions are fully flushed to disk before they are
-    ///   considered committed.   This provides the highest level of durability and crash safety
-    ///   but may have a performance cost.
-    /// - [`SyncMode::SafeNoSync`]: Skips certain fsync operations to improve write performance.
-    ///   This mode still maintains database integrity but may lose the most recent transactions if
-    ///   the system crashes unexpectedly.
+    ///   considered committed. This provides the highest level of durability and crash safety but
+    ///   has a significant performance cost due to per-commit fsync.
+    /// - [`SyncMode::SafeNoSync`]: Skips fsync on commit to improve write performance. Database
+    ///   structural integrity is always maintained — a system crash cannot corrupt the database,
+    ///   but the most recent transactions since the last steady commit may be lost. On application
+    ///   crash (without OS/power failure), no data is lost because the OS eventually flushes dirty
+    ///   mmap pages.
     ///
-    /// Choose `Durable` if consistency and crash safety are critical (e.g., production
-    /// environments). Choose `SafeNoSync` if performance is more important and occasional data
-    /// loss is acceptable (e.g., testing or ephemeral data).
+    /// Defaults to `SafeNoSync` because reth's engine already handles recovery from lost
+    /// recent blocks (re-executing from peers on restart), making the durability trade-off
+    /// acceptable for the significant persistence throughput improvement (up to 10x faster
+    /// commit latency).
+    ///
+    /// Use `--db.sync-mode=durable` to opt into per-commit fsync if strict durability is required.
     sync_mode: SyncMode,
 }
 
@@ -142,7 +147,7 @@ impl DatabaseArguments {
             max_read_transaction_duration: None,
             exclusive: None,
             max_readers: None,
-            sync_mode: SyncMode::Durable,
+            sync_mode: SyncMode::SafeNoSync,
         }
     }
 

crates/storage/libmdbx-rs/src/flags.rs

@@ -6,10 +6,9 @@ use ffi::*;
 /// MDBX sync mode
 #[derive(PartialEq, Eq, Clone, Copy, Debug, Default)]
 pub enum SyncMode {
-    /// Default robust and durable sync mode.
+    /// Robust and durable sync mode.
     /// Metadata is written and flushed to disk after a data is written and flushed, which
     /// guarantees the integrity of the database in the event of a crash at any time.
-    #[default]
     Durable,
 
     /// Don't sync the meta-page after commit.
@@ -63,6 +62,7 @@ pub enum SyncMode {
     /// as without any no-sync flags. However, you should expect a larger process's work set
     /// and significantly worse a locality of reference, due to the more intensive allocation
     /// of previously unused pages and increase the size of the database.
+    #[default]
     SafeNoSync,
 
     /// Don't sync anything and wipe previous steady commits.