WAL is not fsynced on commit by default — committed transactions can be lost on power loss #4330

Affected version: 26.4.2 (confirmed still present in 26.5.1)
Component: com.arcadedb.GlobalConfiguration / com.arcadedb.engine.TransactionManager

Summary

TX_WAL_FLUSH defaults to 0 ("no flush"). commit() writes to the OS page cache and returns success without fsyncing the WAL or the data pages. OS write-back can also re-order so data pages reach disk before the WAL, violating the WAL-before-data invariant.

Code

engine/com/arcadedb/GlobalConfiguration.java:196–198

TX_WAL_FLUSH("arcadedb.txWalFlush", SCOPE.DATABASE,
    "Flushes the WAL on disk at commit time. It can be 0 = no flush, "
    + "1 = flush without metadata and 2 = full flush (fsync)",
    Integer.class, 0),                                  // ← default 0

Impact

ArcadeDB is not crash-safe out of the box. In a Raft cluster a leader can acknowledge a write, crash, come back as a follower and silently roll back the last commit, diverging from the cluster state.

Suggested fix

Default to 1 (fdatasync) or 2 (full fsync). Surface a SEVERE startup log when TX_WAL_FLUSH == 0 in production mode.
Document the perf/durability trade-off prominently.