docs(witness-network): fix the operator-usability findings (/health drift, registry framing, retired links)

content/docs/witness-network/operators/deploy-for-real.md

@@ -15,6 +15,7 @@ The same templates the first-party quorum runs ship in `deploy/witness/`.
 helm install acme-w1 ./deploy/witness/helm \
   --set image.digest=sha256:<digest> \
   --set seed.existingSecret=acme-w1-seed \
+  --set registry.url=https://network.auths.dev \
   --set anchorStore.size=10Gi
 ```
 

content/docs/witness-network/operators/get-listed.md

@@ -7,7 +7,7 @@ order: 6
 lastReviewed: "2026-07-20"
 ---
 
-The [public directory](https://auths.dev/network) lists conformant witnesses with
+The [public directory](https://explorer.auths.dev) lists conformant witnesses with
 the facts principals pick sets by. Listing has one bar: pass the harness.
 
 ## Submit

content/docs/witness-network/operators/monitor-your-node.md

@@ -15,20 +15,21 @@ curl -s localhost:3333/build
 ```
 
 ```output
-{"status":"ok","roles":["anchor","kel","cosign"],"witness":"acme-w1"}
-{"version":"0.1.12","running_digest":"sha256:…","attestation":{…}}
+{"status":"ok","witness_did":"did:key:z6Mk…","first_seen_count":0,"receipt_count":0}
+{"version":"0.1.16","running_digest":"sha256:…","attestation":{…}}
 ```
 
 `/build` is the node's **signed** statement of which binary it runs — checked
 against the digest you deployed.
 
 ## The console
 
-Open your node in the network console at
-[auths.dev/network](https://auths.dev/network) → **node**. It reads `/health`
-and `/build` and re-verifies the signed payloads **in your browser** with the
-published WASM verifier. The node is treated as an untrusted data source;
-trust comes from the in-browser check, never the connection.
+Open your node in the explorer at
+[explorer.auths.dev](https://explorer.auths.dev) — point it at your own node
+with `?witness=<your-node-url>` on any member page. It reads the public GETs and
+re-verifies the signed payloads **in your browser** with the published WASM
+verifier. The node is treated as an untrusted data source; trust comes from the
+in-browser check, never the connection.
 
 ## Container healthcheck
 

content/docs/witness-network/operators/prove-conformance.md

@@ -13,8 +13,11 @@ Drive your live node through the published suite:
 cargo xtask witness-conformance --url http://127.0.0.1:3333
 ```
 
+The first run compiles the `xtask` crate — expect a few minutes of Rust build
+before any output; subsequent runs are instant.
+
 ```output
-witness-conformance: live endpoint http://127.0.0.1:3333 passed 4/4 transport checks
+witness-conformance: live endpoint http://127.0.0.1:3333 passed 4/4 transport checks — certified did:key:z6Mk…
 ```
 
 Emit the machine-readable vectors to drive your own harness (or a node you built

content/docs/witness-network/operators/run-a-node.md

@@ -7,16 +7,19 @@ order: 1
 lastReviewed: "2026-07-20"
 ---
 
-**Before you start:** Docker, and a local copy of the parties' public identity
-registry (see [Keep the registry synced](/witness-network/operators/keep-the-registry-synced)).
+**Before you start:** just Docker. A fresh witness boots on an empty registry
+and grows as it receipts events — you only need the parties' registry once you
+want to *anchor for* them (see [Keep the registry synced](/witness-network/operators/keep-the-registry-synced)).
 
 ```bash
 git clone https://github.com/auths-dev/auths
 cd auths/deploy/witness
 
 export WITNESS_SEED=$(openssl rand -hex 32)   # this IS your identity — keep it
-export WITNESS_REGISTRY=/path/to/registry     # required; mounted read-only
 export WITNESS_NAME=acme-w1
+# Optional — where to keep the parties' registry (defaults to ./registry beside
+# the compose file). Sync it before you expect to anchor for those parties.
+export WITNESS_REGISTRY=./registry
 
 docker compose up -d
 ```
@@ -28,7 +31,7 @@ curl -s localhost:3333/health
 ```
 
 ```output
-{"status":"ok","roles":["anchor","kel","cosign"],"witness":"acme-w1"}
+{"status":"ok","witness_did":"did:key:z6Mk…","first_seen_count":0,"receipt_count":0}
 ```
 
 Your **member key** is printed at first boot — that's what principals add to
@@ -64,8 +67,12 @@ witness-node serve --roles anchor,kel,cosign --bind 0.0.0.0:3333 \
 
 **If it fails:**
 
-- *`set WITNESS_REGISTRY…`* — compose requires it; there is no default.
-- *a role refuses to start* — that role's required config is missing. The node
-  fails closed with a named error rather than serving a half-configured witness.
+- *anchors 404 though `/health` is green* — the node is up but hasn't synced the
+  parties' registry, so it can't resolve their keys yet. Sync it (see [Keep the
+  registry synced](/witness-network/operators/keep-the-registry-synced)); a
+  fresh node is "up" before it's "useful" for a given party.
+- *a role refuses to start* — a role whose config is genuinely missing fails
+  closed with a named error (e.g. the `registry` role needs the `git` binary on
+  PATH), rather than serving a half-configured witness.
 
 **Next:** [Deploy for real](/witness-network/operators/deploy-for-real).

content/docs/witness-network/reference/anchor-api.md

@@ -47,7 +47,9 @@ curl https://w1.example.com/v1/anchor/<seed-id>
 
 ## `GET /health`
 
-Liveness. `200` with the served roles and witness name.
+Liveness. `200` with `{status, witness_did, first_seen_count, receipt_count}`
+(the KEL role's shape; an anchor-only node returns `{up, roles, witness_name}`).
+`witness_did` is the node's member key — the value principals add to their set.
 
 ## `GET /build`
 

content/docs/witness-network/reference/witness-node-cli.md

@@ -48,6 +48,7 @@ distroless image where no HTTP tooling exists.
 | `anchor` | Spend-anchor acceptance and reads | `--data-dir`, `--registry` |
 | `kel` | Receipt witnessing for key histories | `--data-dir` |
 | `cosign` | Transparency-log checkpoint cosigning | `--data-dir` |
+| `registry` | Serve the held `refs/auths/*` read-only over git smart-HTTP (the node is its own resolution surface) | `--registry`, `git` on PATH |
 
 All roles share one identity seed, one data dir, and one hardening envelope. A
 role whose requirements aren't configured **refuses to start with a named

content/docs/witness-network/users/choose-your-witnesses.md

@@ -32,7 +32,7 @@ strongest witness in your set is one your counterparty or regulator runs.
 
 ## Find operators
 
-- **[The public directory](https://auths.dev/network)** — conformant witnesses
+- **[The public directory](https://explorer.auths.dev)** — conformant witnesses
   with their operator facts and live status.
 - **[Run one yourself](/witness-network/operators/run-a-node)** — a fine first
   member, a bad only member.