fix(protocol): canonical relay endpoint is wss://relay.dig.net:443, not :9450

[MichaelTaylor3d]

What changed

This is the user-visible leg of #1218 and the highest-value row on it. The peer-network protocol page told both humans and agents that the default relay endpoint is wss://relay.dig.net:9450:

• docs/protocol/peer-network.md:417 — "The default endpoint is DIG_RELAY_URL = wss://relay.dig.net:9450", naming the canonical constant explicitly
• docs/protocol/peer-network.md:548 — the network_info response example returning the same
• the identical two lines in all 13 i18n/ locale copies
• scripts/dig-spec.mjs:773 and the generated static/openrpc-node.json:354 — the RelayStatus.url description in the published OpenRPC document, which is precisely the machine entry point an agent reads to learn which endpoint to dial (CLAUDE.md §6.2)

Nothing answers on :9450 from outside. The relay.dig.net NLB has exactly a :443 TLS listener and a :3478 UDP listener; :9450 is the relay's internal container port behind that NLB. A shipped page instructing a dial to a closed port is a documented failure, not a stale comment.

30 occurrences across 16 files -> 0. Version 0.17.0 -> 0.17.1.

The 84 remaining 9450 mentions are CORRECT — do not "finish the job"

git grep -Ic 9450 still returns 84 hits, and every one must stay. They are six distinct lines x 14 locales, all about running your own relay:

• By default it listens on port **9450** ... health check on **9451**
• --listen [::]:9450 / dig-relay serve --listen 0.0.0.0:9450 --health-listen 0.0.0.0:9451
• DIG_RELAY_URL=wss://your-relay-host:9450
• | `DIG_RELAY_URL` | `wss://relay.example.com:9450` | Use a specific relay (e.g. your own). |

A relay you host yourself has no NLB in front of it, so it both binds and is dialled on :9450. The sweep's premise ("a hardcoded :9450 is drifted") applies only to the canonical hosted relay.dig.net. Sweeping these would break every self-hosting reader's setup.

That is why the replacement was anchored on the literal relay.dig.net:9450 rather than on 9450.

Blast radius checked

Content repo — no symbols, so no call-graph radius. The diff is 16 files, 30 insertions, 30 deletions, and every added line contains relay.dig.net:443 (git diff -U0 | grep '^+' | grep -vc 'relay.dig.net:443' -> 0), so nothing else moved. All three touched file types were confirmed LF before editing, so no CRLF flip inflated the diff or destroyed blame.

Nearby values deliberately untouched by the anchored pattern: [2001:db8::7]:9444 and 203.0.113.7:9444 on line 546 are RFC 3849 / RFC 5737 documentation addresses with peer ports, not relay endpoints.

Cross-repo coherence (§1.3b)

The OpenRPC description here is the same sentence as RelayStatus::url's doc in dig-rpc-protocol, which generates the canonical OpenRPC document. Both are corrected in this sweep, so the published spec and the crate that generates it agree:

• dig-rpc-protocol PR docs: add the window.chia provider reference for integrating developers #14 (doc + 2 conformance vectors)
• dig-relay-protocol PR Internationalize docs.dig.net into 14 languages (Docusaurus native i18n) #6 (normative SPEC)
• dig-relay PR docs(run-a-node): dig-node control panel user guide (cache/LRU, pairing, live status) #30 (README + DESIGN)
• dig-constants PR docs(digstore): clarify macOS raw-binary install, real self-updater, and canonical publish flow #15 (stale comments beside the source-of-truth constant)

Verification

• static/openrpc-node.json re-parsed after editing: valid JSON
• node --check scripts/dig-spec.mjs: syntax OK
• scripts/dig-spec.mjs and its generated static/openrpc-node.json were changed together, so the committed output still matches its source

Refs https://github.com/DIG-Network/dig_ecosystem/issues/1218

[MichaelTaylor3d]

Correctness gate (eco#1218 relay-port sweep), round 1.

Verdict: PASS.

Measured on head a46ab8ddbc5e8fa5e9483ff1a801ccce78bcb61d, reproduced independently rather than taken from the PR body:

                                 base  head
docs/protocol/peer-network.md      2     0
scripts/dig-spec.mjs               1     0
static/openrpc-node.json           1     0
  x 13 locale copies of peer-network.md
                          total   30     0

Generator and generated artifact moved together. scripts/dig-spec.mjs produces static/openrpc-node.json, and both carry the edit — so the next dig-spec run will not silently reintroduce :9450 into the published OpenRPC document. That is the failure this pair would otherwise have.

The retained 84 are real, and I checked them rather than accepting the category. Every remaining hit in this repo is in docs/run-a-node/run-a-relay.md and its 13 locale copies — 6 per file:

• :46 wss://relay.example.com:9450 — example self-hosted URL
• :68 "By default it listens on port 9450" — the operator's own listener
• :73 DIG_RELAY_URL=wss://your-relay-host:9450 — the reader's own relay
• :79, :96 --listen 0.0.0.0:9450 / --listen [::]:9450 — bind flags
• :108 --listen default table row

The discriminator is sound, and empirically complete for this repo. Anchoring on the host-qualified relay.dig.net:9450 rather than the bare 9450 is the right call, and I checked for the inverse failure — a MANAGED-relay client endpoint written without the host, which the anchor would miss. There are none: run-a-relay.md mentions the managed relay at :33, :45 and :151 and in every case writes the bare host relay.dig.net with no port at all. grep -c 'relay\.dig\.net:9450' run-a-relay.md returns 0.

So the lane's third category (self-hosted-relay guidance, where :9450 genuinely IS the client endpoint) is correct and correctly scoped. A blind sweep of the bare 9450 here would have told every self-hosting operator to bind a port their own relay does not listen on.

Two non-gating observations, which I am resolving myself — neither blocks this PR:

1. The 13 locale copies of peer-network.md contain ENGLISH prose, not translations. Pre-existing, not introduced here, and the sweep correctly applied the same edit to each so nothing got worse. Worth a separate ticket for the i18n backlog, not this PR's problem.
2. run-a-relay.md:151 says the public relay.dig.net runs behind a load balancer terminating TLS — which is exactly consistent with the :443 NLB story this sweep encodes. No drift.

Line endings unchanged on all 17 files (CR=0 base and head). 0.17.0 -> 0.17.1 patch is correct for a docs-only change.