Document DIG_NODE_FORWARD_ON_MISS — the default-OFF forwarded-ask gate, its ~1,360-dial cost and its disclosure radius #75

Task

docs.dig.net documents the on-miss behaviour without the new DIG_NODE_FORWARD_ON_MISS switch, so a
reader learns about one opt-in amplification gate and not the other. Sibling change to dig-node PR #258.

Parent: https://github.com/DIG-Network/dig_ecosystem/issues/3128

Where

• docs/protocol/peer-network.md:806 — documents DIG_NODE_ON_MISS=fetch
• 13 locale copies at i18n/*/…/peer-network.md:697

What changed upstream

dig-node 0.128.0 adds the forwarded availability ask: on a miss, a node also asks its connected pool
peers, recursively. It ships behind DIG_NODE_FORWARD_ON_MISS, default OFF, and unset, empty, falsy
and unrecognised values all fail closed — a typo cannot enable it.

Why an operator needs this documented, and why it is not just a new flag

The numbers are the reason. One admitted 64 KiB frame produces up to ~1,360 outbound dials and ~1,360
DHT walks across the network (16 → 64 → 256 → 1024 over four hops), sustained ~340 asks/s per attacker
identity. And MAX_CONCURRENT_FORWARDED_ASKS bounds concurrency, not the aggregate — the 1,360 still
happen, serialized, and every downstream node has its own independent limit.

An operator turning this on is volunteering their node's bandwidth and their peers'. Documenting the
flag without that figure would be worse than not documenting it, because it reads as a performance toggle.

Also document the privacy consequence, in the SPEC's own words rather than softened: enabling it means
a miss discloses the requested triple to "up to ~1,360 nodes, none of which the requestor chose, contacted,
or can enumerate", and the disclosure happens on a miss — precisely when the requestor has not yet
decided to contact any holder. Two real limits belong beside it: the requestor's identity is not carried
past the first hop, and nothing is retained. Neither may be presented as anonymity — a peer is free to
log what it was asked, and nothing prevents that.

Scope

Document DIG_NODE_FORWARD_ON_MISS beside DIG_NODE_ON_MISS: default OFF, fail-closed on unrecognised
values, the amplification figure, the disclosure radius, and the two limits with the anonymity caveat.
Update the source page and all 13 locales — a locale left behind is a user reading the old behaviour
as current (§4.3).

Constraints

docs.dig.net is self-contained and authoritative: no reference to internal files, issue numbers, or
SPEC.md — state the facts directly (§4.3). Audience is the operator deciding whether to enable it.

Evidence

The rendered page in every locale, and confirmation the default is stated as OFF everywhere.