fix(copy): remove proof and case-studies pages, point CTE upload copy to /ingest, label EPCIS as preview

README.md

@@ -6,7 +6,7 @@ RegEngine is an API-first traceability evidence platform for food supply chains.
 
 Inflow Workbench prepares data with preflight checks, readiness scores, a fix queue, and a commit gate. Optional Jev assistance suggests CSV column mappings and missing event types; deterministic validation and authenticated tenant boundaries remain authoritative.
 
-[Website](https://regengine.co) · [Public proof](https://regengine.co/proof) · [Verify a bundle](https://regengine.co/verify) · [Product description](docs/PRODUCT_DESCRIPTION.md) · [Python SDK](regengine/README.md)
+[Website](https://regengine.co) · [Verify a bundle](https://regengine.co/verify) · [Product description](docs/PRODUCT_DESCRIPTION.md) · [Python SDK](regengine/README.md)
 
 This is a pre-production application with deployed public proof surfaces. The capability inventory below describes checked-in implementation and release policy, not proof of customer adoption or live configuration.
 
@@ -381,7 +381,7 @@ RegEngine is proprietary, source-visible software — all rights reserved by Reg
 
 > **Before changing this repository's visibility**, work through [docs/security/PRE_PUBLIC_CHECKLIST.md](docs/security/PRE_PUBLIC_CHECKLIST.md). Confidential business material is currently tracked in-tree, and `git rm` removes it from `HEAD` only — every prior revision stays readable.
 
-Permissive exceptions — the public verifier tools are **Apache 2.0** (declared in [LICENSE](LICENSE)) so anyone can use, copy, and embed them: the `/proof` Merkle bundle verifier ([frontend/public/sdk/verify_chain.py](frontend/public/sdk/verify_chain.py)) and the `regengine-verify` per-record CLI ([regengine/verify_records.py](regengine/verify_records.py)). [Inflow Lab](https://github.com/regengine/inflow-lab), the integration simulator, is Apache 2.0 in its own repository for the same reason.
+Permissive exceptions — the public verifier tools are **Apache 2.0** (declared in [LICENSE](LICENSE)) so anyone can use, copy, and embed them: the Merkle bundle verifier ([frontend/public/sdk/verify_chain.py](frontend/public/sdk/verify_chain.py)) and the `regengine-verify` per-record CLI ([regengine/verify_records.py](regengine/verify_records.py)). [Inflow Lab](https://github.com/regengine/inflow-lab), the integration simulator, is Apache 2.0 in its own repository for the same reason.
 
 ## Contributing
 

docs/PRODUCT_DESCRIPTION.md

@@ -29,7 +29,7 @@ A browser verifier and a downloadable Python bundle verifier let reviewers inspe
 | Tenant-scoped records and tamper-evident chains | [Tenant authority](../services/shared/tenant_context.py), [canonical persistence](../services/shared/canonical_persistence/writer.py), [canonical chain verification](../services/shared/canonical_persistence/verification.py), [admin audit integrity](../services/admin/app/audit_integrity.py). See [persistence cutover](persistence/dual-write-cutover.md). |
 | FDA-oriented exports and request-response packages | Release-enabled: [FDA export](../services/ingestion/app/fda_export/router.py), [request workflow](../services/ingestion/app/request_workflow_router.py), [auditor API](../services/ingestion/app/auditor_router.py). |
 | Readiness assessments and recall reporting | Release-enabled: [readiness](../services/ingestion/app/readiness_router.py), [recall reports](../services/ingestion/app/recall_report.py). |
-| Public proof and recall-drill endpoint | [Proof page](https://regengine.co/proof), [browser verifier](https://regengine.co/verify), [verifier source](../frontend/public/sdk/verify_chain.py). Synthetic verification artifacts; the recall-drill endpoint currently returns no drill data. |
+| Bundle verifier and recall-drill endpoint | [Browser verifier](https://regengine.co/verify), [verifier source](../frontend/public/sdk/verify_chain.py). The recall-drill endpoint currently returns no drill data. |
 | Supplier manifest remediation and correction links | Implemented in [remediation](../services/ingestion/app/remediation/) and the [buyer dashboard](../frontend/src/app/remediation/page.tsx); excluded from the production router allowlist. Notification delivery also requires recipient/provider configuration. |
 | EPCIS JSON-LD export and broader recall simulations | Implemented in [EPCIS export](../services/ingestion/app/epcis_export.py) and [simulations](../services/ingestion/app/recall_simulations.py); these routers are experimental and excluded from the production allowlist. Public sample EPCIS downloads are a separate proof surface. |
 | Inbound email CSV ingestion | [Postmark integration](../services/ingestion/app/email_ingest/); excluded from the production allowlist, with no self-service provisioning UI. See [rollout notes](engineering/EMAIL_INGESTION.md). |
@@ -48,7 +48,7 @@ A browser verifier and a downloadable Python bundle verifier let reviewers inspe
 
 ## Talking-track opener
 
-RegEngine turns supplier and ERP records into traceability evidence for food businesses. Import records, identify missing or inconsistent CTEs and KDEs, resolve issues, and assemble FDA-oriented exports with verifiable audit evidence. Inflow Workbench prepares the data; RegEngine stores and verifies the evidence. Inspect the synthetic examples at [regengine.co/proof](https://regengine.co/proof) and check a bundle at [regengine.co/verify](https://regengine.co/verify).
+RegEngine turns supplier and ERP records into traceability evidence for food businesses. Import records, identify missing or inconsistent CTEs and KDEs, resolve issues, and assemble FDA-oriented exports with verifiable audit evidence. Inflow Workbench prepares the data; RegEngine stores and verifies the evidence. Check a bundle at [regengine.co/verify](https://regengine.co/verify).
 
 ## Maintenance rule
 

docs/security/PRE_PUBLIC_CHECKLIST.md

@@ -72,6 +72,6 @@ it reactively at flip time.**
 
 - `REPO_PURPOSE.md` — the scope these files fall outside of.
 - `SECURITY.md` — reporting and disclosure posture.
-- The public proof surface (`/proof`, `/verify`) already provides
+- The public verifier (`/verify`) already provides
   transparency and audit **without** requiring source visibility. It is the
   reason the README's public-repository claim sounded plausible.

frontend/README.md

@@ -15,7 +15,7 @@ See the [product description](../docs/PRODUCT_DESCRIPTION.md) for capability ava
 | Buyer manifest remediation and correction actions | [remediation](src/app/remediation/) — requires the remediation API, which is excluded from the production allowlist |
 | Recall reporting and audit views | [recall report](src/app/dashboard/recall-report/), [audit](src/app/audit/) |
 | Email-code/passkey login, invitations, and API keys | [login](src/app/login/), [invite acceptance](src/app/accept-invite/), [API keys](src/app/api-keys/) |
-| Public synthetic proof, bundle verification, and recall drill | [proof](src/app/proof/), [verify](src/app/verify/) |
+| Bundle verification and recall drill | [verify](src/app/verify/), [recall drills](src/app/dashboard/recall-drills/) |
 | Product documentation and developer portal | [docs](src/app/docs/), [developer portal](src/app/developer/portal/) |
 
 Jev assistance is optional. Suggestions are visible for review; automatic application defaults off. See the [Jev guide](../docs/engineering/JEV_HEADER_MAPPING.md) for configuration, evidence, and data-sharing defaults.

frontend/src/__tests__/pages/empty-states-3554.test.ts

@@ -0,0 +1,66 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { CAPABILITY_REGISTRY, STATUS_LABELS } from '@/lib/customer-readiness';
+
+const read = (p: string) => readFileSync(resolve(process.cwd(), p), 'utf8');
+
+describe('#3554 empty states and hidden sample artifacts', () => {
+    it('export-jobs and integrations show No data yet with CSV upload and JSON events API next steps', () => {
+        for (const page of ['src/app/dashboard/export-jobs/page.tsx', 'src/app/integrations/page.tsx']) {
+            const src = read(page);
+            expect(src).toContain('title={NO_DATA_YET}');
+            expect(src).toMatch(/href="\/ingest"/);
+            expect(src).toMatch(/href="\/docs\/api"/);
+        }
+    });
+
+    it('support pages render Not set for empty channel fields', () => {
+        for (const page of ['src/app/settings/support/page.tsx', 'src/app/trust/support/page.tsx']) {
+            const src = read(page);
+            expect(src).toContain('channel.responseWindow || NOT_SET');
+            expect(src).toContain('channel.notes || NOT_SET');
+        }
+    });
+
+    it('labels the EPCIS capability as Preview', () => {
+        const epcis = CAPABILITY_REGISTRY.find((item) => item.id === 'epcis');
+        expect(epcis?.name).toBe('GS1 EPCIS 2.0 (Preview)');
+        expect(epcis && STATUS_LABELS[epcis.status]).toBe('Preview');
+    });
+
+    it('no longer publishes the made-up proof samples', () => {
+        expect(existsSync(resolve(process.cwd(), 'public/proof/fsma-204-sample.csv'))).toBe(false);
+        expect(existsSync(resolve(process.cwd(), 'public/proof/epcis-sample.jsonld'))).toBe(false);
+    });
+
+    it('hides /proof/transformation and drops every link to it', () => {
+        expect(read('src/app/proof/transformation/page.tsx')).toContain('notFound()');
+        expect(existsSync(resolve(process.cwd(), 'src/app/proof/transformation/opengraph-image.tsx'))).toBe(false);
+        expect(read('src/app/sitemap.ts')).not.toContain('/proof/transformation');
+        expect(read('src/app/walkthrough/page.tsx')).not.toContain('/proof/transformation');
+    });
+
+    it('removes the public proof zips', () => {
+        for (const f of ['public/proof/audit-bundle.zip', 'public/proof/audit-bundle-tampered.zip']) {
+            expect(existsSync(resolve(process.cwd(), f))).toBe(false);
+        }
+    });
+
+    it('security page shows No data yet instead of illustrative verifier output', () => {
+        const src = read('src/app/security/page.tsx');
+        expect(src).not.toContain('Sample · illustrative');
+        expect(src).toContain('title={NO_DATA_YET}');
+    });
+
+    it('CTE pages ask for the user\'s own file, not a sample', () => {
+        const src = read('src/app/fsma-204/[cte]/page.tsx');
+        expect(src).not.toContain('Upload a sample');
+        // After merging main (#3557 retired /sandbox), the closing CTA copy comes from
+        // sandboxCta().blurb, which asks for the user's own records and links /ingest.
+        expect(src).toContain('{cta.blurb}');
+        expect(src).not.toContain('sandbox and get an instant');
+        expect(src).not.toContain('data to the sandbox');
+        expect(src).toMatch(/data to\{" "\}\s*<Link href="\/ingest\?tab=file"[^>]*>RegEngine<\/Link>/);
+    });
+});

frontend/src/__tests__/pages/pre-revenue-copy.test.ts

@@ -13,7 +13,6 @@ const PUBLIC_FILES = [
     'src/app/compare/repositrak/page.tsx',
     'src/app/supplier-compliance/page.tsx',
     'src/app/tools/roi-calculator/components/ROICalculatorClient.tsx',
-    'src/app/case-studies/page.tsx',
     'src/app/developers/page.tsx',
     'src/app/status/page.tsx',
 ];
@@ -59,10 +58,4 @@ describe('pre-revenue public copy', () => {
         expect(page).toContain('Pricing is temporarily unavailable');
         expect(page).toContain('What does the Founding rate include?');
     });
-
-    it('states pre-revenue status plainly on the case study disclosure', () => {
-        expect(read('src/app/case-studies/page.tsx')).toContain(
-            'RegEngine is pre-revenue; self-serve access is in staged rollout.',
-        );
-    });
 });

frontend/src/__tests__/pages/proof-trust-copy.test.tsx

@@ -56,10 +56,10 @@ describe('public proof-bundle trust copy', () => {
         }
     });
 
-    it('/proof states the checks do not authenticate the issuer', () => {
+    it('/proof shows the empty state instead of artifacts', () => {
         const text = renderedText(<ProofPage />);
 
-        expect(text).toMatch(/do not authenticate the issuer/i);
+        expect(text).toMatch(/no public artifacts are published yet/i);
 
         for (const claim of UNBACKED_AUTHENTICITY_CLAIMS) {
             expect(text).not.toMatch(claim);

frontend/src/__tests__/public-site-fixes.test.tsx

@@ -158,14 +158,7 @@ describe('public site launch-blocker fixes', () => {
         });
     });
 
-    it('labels synthetic validation honestly in the footer', () => {
-        expect(MARKETING_FOOTER_PRODUCT_LINKS).toContainEqual({
-            label: 'Product Validation',
-            href: '/case-studies',
-        });
-        expect(MARKETING_FOOTER_PRODUCT_LINKS).not.toContainEqual({
-            label: 'Case Studies',
-            href: '/case-studies',
-        });
+    it('keeps the hidden case-studies route out of the footer', () => {
+        expect(MARKETING_FOOTER_PRODUCT_LINKS.map((link) => link.href)).not.toContain('/case-studies');
     });
 });

frontend/src/app/admin/page.tsx

@@ -311,7 +311,7 @@ export default function AdminPage() {
                       title="API Key Created Successfully"
                       className="mt-4"
                     >
-                      <p>Save this key now - it won&apos;t be shown again!</p>
+                      <p>Save this key now. It won&apos;t be shown again!</p>
                       <div className="mt-2 flex items-center gap-2">
                         <code className="min-w-0 flex-1 break-all rounded-md border border-re-border-subtle bg-re-surface-inset p-2 font-mono text-[0.8125rem] text-re-text-primary">
                           {copiedKey}

frontend/src/app/blog/fsma-204-cte-kde-guide/page.tsx

@@ -424,7 +424,7 @@ export default function CTEKDEGuidePage() {
 
           <Card variant="inset" padding="spacious" className="mb-8">
             <p className="text-re-text-secondary mb-4">
-              Ready to implement FSMA 204 traceability in your business? See how RegEngine handles CTE/KDE capture, validation, and EPCIS-oriented export workflows.
+              Ready to implement FSMA 204 traceability in your business? See how RegEngine handles CTE/KDE capture, validation, and EPCIS-oriented export workflows (Preview).
             </p>
             <div className="flex flex-col flex-wrap gap-3 sm:flex-row">
               <Button asChild size="lg">

frontend/src/app/blog/regengine-vs-spreadsheets-traceability/page.tsx

@@ -172,7 +172,7 @@ export default function RegEngineVsSpreadsheets() {
                 <ul className="space-y-2 text-re-text-secondary text-sm">
                   <li>• One-click query: search by product name, date range, lot code, or customer</li>
                   <li>• Instant results: within seconds, see all matching transactions</li>
-                  <li>• Export workflow: data can be organized into FDA-oriented sortable records and EPCIS 2.0 where buyer workflows require it</li>
+                  <li>• Export workflow: data can be organized into FDA-oriented sortable records and EPCIS 2.0 (Preview) where buyer workflows require it</li>
                   <li>• Traceability links: immediate source and recipient are already linked in the system</li>
                   <li>• One-click export: generate a complete, review-ready report in minutes</li>
                   <li>• Total time: 5-30 minutes from request to delivery. You exceed the requirement.</li>

frontend/src/app/case-studies/page.tsx

@@ -1,58 +1,6 @@
-import type { Metadata } from 'next';
-import Link from 'next/link';
-import { ArrowRight } from 'lucide-react';
-import { Button } from '@/components/ui/button';
-import { Card } from '@/components/ui/card';
-import { Container } from '@/components/layout/container';
-import { PageHeader } from '@/components/layout/page-header';
-
-export const metadata: Metadata = {
-    title: 'Product Validation | RegEngine',
-    description:
-        'RegEngine product validation. No published validation study yet; run the workflow on your own data.',
-    keywords:
-        'FSMA 204, traceability validation, food safety, CTE validation, FDA compliance, RegEngine',
-  openGraph: {
-    title: 'Product Validation | RegEngine',
-    description: 'No published validation study yet; run the RegEngine workflow on your own data.',
-    url: 'https://regengine.co/case-studies',
-    type: 'article',
-  },
-};
+import { notFound } from 'next/navigation';
 
+// Hidden until a real, named-customer case study exists.
 export default function CaseStudy() {
-    return (
-        <div className="bg-re-surface-base text-re-text-primary">
-            <Container as="section" width="marketing" className="py-12 sm:py-16">
-                <PageHeader
-                    size="hero"
-                    title="Product validation"
-                    description="RegEngine is pre-revenue. There is no published validation study with customer or production data yet."
-                    className="mb-0 border-b-0 pb-0"
-                />
-                <Card padding="spacious" className="mt-10 max-w-[68ch]">
-                    <p className="font-mono text-label uppercase text-re-text-muted">Validation data</p>
-                    <h2 className="mt-2 text-heading text-re-text-primary">No data yet</h2>
-                    <p className="mt-3 text-ui text-re-text-secondary">
-                        RegEngine is pre-revenue; self-serve access is in staged rollout. We do not
-                        publish invented metrics. When a validation study runs against real
-                        workloads, the results will appear here. Until then, the honest way to evaluate
-                        RegEngine is to run it on your own supply chain data.
-                    </p>
-                    <div className="mt-6 flex flex-col gap-3 sm:flex-row">
-                        <Button asChild size="lg">
-                            <Link href="/signup" className="no-underline">
-                                Run Your Own Validation <ArrowRight className="h-4 w-4" strokeWidth={1.75} aria-hidden="true" />
-                            </Link>
-                        </Button>
-                        <Button asChild variant="secondary" size="lg">
-                            <Link href="/tools/ftl-checker" className="no-underline">
-                                Test with Your Data
-                            </Link>
-                        </Button>
-                    </div>
-                </Card>
-            </Container>
-        </div>
-    );
+    notFound();
 }

frontend/src/app/controls/page.tsx

@@ -282,7 +282,7 @@ export default function MyControlsPage() {
                 >
                   <option value="FSMA 204">FSMA 204</option>
                   <option value="FDA CTE">FDA CTE</option>
-                  <option value="EPCIS 2.0">EPCIS 2.0</option>
+                  <option value="EPCIS 2.0">EPCIS 2.0 (Preview)</option>
                   <option value="GS1">GS1</option>
                 </select>
               </Field>