fix: complete DS_UNSAFE_FAST_FSYNC rename; drop concluded contention-investigation doc

.changeset/unsafe-fast-fsync-rename.md

@@ -0,0 +1,5 @@
+---
+"@electric-ax/durable-streams-server-rust": patch
+---
+
+Complete the `DS_BENCH_FAST_FSYNC` → `DS_UNSAFE_FAST_FSYNC` rename in `wal/segment.rs`. The previous rename missed the WAL segment's copy of the check — the fsync that gates append acks — so the documented `DS_UNSAFE_FAST_FSYNC` name had no effect on WAL-mode write latency (macOS bench/experimentation only; never set in production).

packages/durable-streams-rust/CARDINALITY_1M.md

@@ -1,7 +1,7 @@
 # 1M-stream cardinality fixes — findings + results (2026-07-02)
 
-Follow-up to `WRITE_BOTTLENECKS_1M.md` (bottleneck #2: stream cardinality) and
-`CONTENTION_INVESTIGATION.md`. Server commit: `662b0c845` on
+Follow-up to the write-bottleneck and WAL-contention investigations
+(bottleneck #2: stream cardinality). Server commit: `662b0c845` on
 `perf/combined-t1a-t1c-t2a`. **Outcome: 1M streams reaches 1,114,644 ops/s on a
 16 vCPU `c4d-standard-16-lssd` (ladder unsaturated), and the 500k→1M degradation at
 equal load is −17% (was a cliff).**

packages/durable-streams-rust/src/wal/segment.rs

@@ -133,19 +133,19 @@ impl FileSegment {
 /// preserves the ORIGINAL F_FULLFSYNC errno in context — the fallback's errno
 /// alone would mislead durability diagnostics. (Shared by `seal_to` and
 /// `FileSegment::fdatasync`; mirrors `store::barrier_fsync`.)
-/// BENCH-ONLY: whether `DS_BENCH_FAST_FSYNC` requests plain `fsync` over
+/// BENCH-ONLY: whether `DS_UNSAFE_FAST_FSYNC` requests plain `fsync` over
 /// `F_FULLFSYNC` on macOS. Read once and cached. Mirrors the gate in
 /// `store::barrier_fsync`.
 #[cfg(target_os = "macos")]
 fn fast_fsync_enabled() -> bool {
     use std::sync::OnceLock;
     static ON: OnceLock<bool> = OnceLock::new();
-    *ON.get_or_init(|| std::env::var_os("DS_BENCH_FAST_FSYNC").is_some())
+    *ON.get_or_init(|| std::env::var_os("DS_UNSAFE_FAST_FSYNC").is_some())
 }
 
 #[cfg(target_os = "macos")]
 fn macos_full_fsync(fd: libc::c_int) -> io::Result<()> {
-    // BENCH-ONLY (`DS_BENCH_FAST_FSYNC`): plain `fsync` instead of the
+    // BENCH-ONLY (`DS_UNSAFE_FAST_FSYNC`): plain `fsync` instead of the
     // `F_FULLFSYNC` drive barrier so the committer's hot fsync is cheap on a RAM
     // disk and the per-shard LOCK becomes the bottleneck (the Linux+NVMe regime
     // this build studies). NOT power-loss durable; never set in production. See