docs: VM-C-ONE-PAGER single-page dual-ship printer CA unlock path

enable-printer-cas → build-full-msi → dual-ship-smoke → sign-dry-run → fill-manifest.

platform/windows/wix/DUAL-SHIP.md

@@ -4,7 +4,7 @@
 
 **Do not** thin or deprecate NSIS until the **thin-NSIS exit criteria checklist** (below) is fully checked — clean-VM gates, live Authenticode, silent/fleet proof, and site cutover (see [COMMERCIAL-INSTALLER-BACKLOG.md](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md), [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md)).
 
-**Related:** [Product-Full.wxs](Product-Full.wxs) · [SILENT_PROPS.md](SILENT_PROPS.md) · [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md) (printable A/B/C) · [`dual-ship-smoke.ps1`](../scripts/dual-ship-smoke.ps1) (offline checklist runner + optional local MSI/NSIS hash; **VM C blocked until CAs enabled**) · [`enable-printer-cas.ps1`](../scripts/enable-printer-cas.ps1) (uncomment deferred printer CAs in Product-Full for VM C) · [../installer-windows.nsi](../installer-windows.nsi) · [PACKAGING.md](../../../docs/PACKAGING.md) · site [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) (0.3.6 TBD rows) · [`fill-manifest-sha256.ps1`](../scripts/fill-manifest-sha256.ps1) (hash built MSI/NSIS → manifest row; no upload).
+**Related:** [Product-Full.wxs](Product-Full.wxs) · [SILENT_PROPS.md](SILENT_PROPS.md) · [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md) (printable A/B/C) · [**VM-C-ONE-PAGER.md**](VM-C-ONE-PAGER.md) (single page: enable-printer-cas → build-full-msi → dual-ship-smoke `-VerifyArtifacts` → sign-dry-run → fill-manifest) · [`dual-ship-smoke.ps1`](../scripts/dual-ship-smoke.ps1) (offline checklist runner + optional local MSI/NSIS hash; **VM C blocked until CAs enabled**) · [`enable-printer-cas.ps1`](../scripts/enable-printer-cas.ps1) (uncomment deferred printer CAs in Product-Full for VM C) · [../installer-windows.nsi](../installer-windows.nsi) · [PACKAGING.md](../../../docs/PACKAGING.md) · site [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) (0.3.6 TBD rows) · [`fill-manifest-sha256.ps1`](../scripts/fill-manifest-sha256.ps1) (hash built MSI/NSIS → manifest row; no upload) · OPEN-ISSUES [Issue 1](../../../../verae-2026-screens/OPEN-ISSUES.md) (Commercial MSI / notarize still left).
 
 ---
 
@@ -148,6 +148,8 @@ Interactive UI install is fine for smoke; `/qn` proves fleet syntax ([SILENT_PRO
 
 ## VM C — MSI printer CA (still left / blocked until CAs enabled)
 
+**One-pager (commands only):** [VM-C-ONE-PAGER.md](VM-C-ONE-PAGER.md) — enable-printer-cas → build-full-msi → dual-ship-smoke `-VerifyArtifacts` → sign-dry-run → fill-manifest. Still left tracked as [OPEN-ISSUES Issue 1](../../../../verae-2026-screens/OPEN-ISSUES.md).
+
 Default tree keeps deferred CAs **commented** (`DEFERRED_PRINTER_CAS:OFF` markers). Enable when ready for VM C:
 
 ```powershell
@@ -289,6 +291,8 @@ Do **not** put PFX bytes or passwords in git. Do not upload the PFX as a workflo
 | CI unsigned MSI workflow | [../../../.github/workflows/windows-msi.yml](../../../.github/workflows/windows-msi.yml) |
 | Silent properties | [SILENT_PROPS.md](SILENT_PROPS.md) |
 | Printable VM A/B/C checklist | [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md) |
+| VM C command one-pager | [VM-C-ONE-PAGER.md](VM-C-ONE-PAGER.md) |
+| OPEN-ISSUES Issue 1 (still left) | [../../../../verae-2026-screens/OPEN-ISSUES.md](../../../../verae-2026-screens/OPEN-ISSUES.md) |
 | Offline dual-ship smoke (print + optional hash) | [../scripts/dual-ship-smoke.ps1](../scripts/dual-ship-smoke.ps1) |
 | Enable deferred printer CAs (VM C prereq) | [../scripts/enable-printer-cas.ps1](../scripts/enable-printer-cas.ps1) |
 | Sign/notary draft | [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md) |

platform/windows/wix/VM-C-ONE-PAGER.md

@@ -0,0 +1,45 @@
+# VM C one-pager — enable CAs → MSI → smoke → sign dry-run → manifest
+
+**Issue 1** commercial MSI path for clean-VM **C** (printer CA parity). Narrative: [DUAL-SHIP.md](DUAL-SHIP.md). Printable A/B/C ticks: [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md). Still left: [OPEN-ISSUES Issue 1](../../../../verae-2026-screens/OPEN-ISSUES.md) (Commercial MSI / notarize).
+
+**From repo root on Windows** (Go + WiX v3 `candle`/`light` on PATH). HelperVersion **0.3.6** unless `VERSION=` override.
+
+```powershell
+# 1) Enable deferred printer CAs in Product-Full.wxs (default tree is OFF)
+powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\enable-printer-cas.ps1 -Status
+powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\enable-printer-cas.ps1
+
+# 2) Rebuild elevated full MSI (StageFull → candle/light)
+powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\build-full-msi.ps1
+
+# 3) Offline dual-ship smoke + local artifact existence/hash (does not install/drive VM)
+powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\dual-ship-smoke.ps1 -VerifyArtifacts
+
+# 4) Authenticode dry-run only (find signtool; verify unsigned; print cmds — no secrets, no sign)
+powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\sign-dry-run.ps1
+
+# 5) SHA-256 → DOWNLOADS-MANIFEST rows (no upload; paste TBD only after CDN)
+powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\fill-manifest-sha256.ps1 `
+  -Path .\platform\windows\wix\out\VeraePrintStamp-windows-amd64-0.3.6.msi
+# optional NSIS leg:
+#   -Path .\dist\VeraePrintStamp-windows-amd64-0.3.6-setup.exe, .\platform\windows\wix\out\...
+```
+
+| Step | Script | Does | Does **not** |
+|------|--------|------|----------------|
+| 1 | `enable-printer-cas.ps1` | Unwrap `DEFERRED_PRINTER_CAS` body | Build, install, dual-ship pass |
+| 2 | `build-full-msi.ps1` | StageFull + MSI under `wix/out/` | Authenticode; exit 1 if WiX missing |
+| 3 | `dual-ship-smoke.ps1 -VerifyArtifacts` | Print A/B/C; hash local MSI/NSIS | Drive a VM; replace clean-VM C sign-off |
+| 4 | `sign-dry-run.ps1` | `signtool verify` + print sign templates | Live sign / org secrets |
+| 5 | `fill-manifest-sha256.ps1` | Print SHA256SUMS / MD rows | Upload or edit site files |
+
+**Then on clean VM C** (checklist § VM C): default elevated MSI (or `VERAE_SKIP_PRINTERS=0`) → files + IPP/`127.0.0.1:8631` + **Verae Print Helper** task + one-page PDF stamp (receipt/CID ≠ jobId) → uninstall clean. Parity with VM A required.
+
+**Rules**
+
+- Enabling CAs + rebuilding is **not** dual-ship complete — [DUAL-SHIP.md](DUAL-SHIP.md) thin-NSIS exit **A–D** still open.
+- NSIS stays **primary** until live Authenticode + VM C sign-off + site cutover.
+- Hold / jobId is never evidence.
+- Re-disable CAs for files-only tree: `enable-printer-cas.ps1 -Disable`.
+
+**Still left (Issue 1):** org secrets for live CI sign; live notary (macOS); clean-VM **C** sign-off; paste real digests after upload — see [OPEN-ISSUES](../../../../verae-2026-screens/OPEN-ISSUES.md) row 1 · [PUBLISH-DIGESTS.md](../../../docs/PUBLISH-DIGESTS.md) · [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md).

platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md

@@ -81,6 +81,8 @@ UI install is fine for smoke; `/qn` proves fleet syntax.
 
 ## VM C — MSI printer CA (still left / blocked until CAs enabled)
 
+**Command one-pager:** [VM-C-ONE-PAGER.md](VM-C-ONE-PAGER.md) (enable-printer-cas → build-full-msi → dual-ship-smoke `-VerifyArtifacts` → sign-dry-run → fill-manifest). Narrative: [DUAL-SHIP.md](DUAL-SHIP.md). Still left: [OPEN-ISSUES Issue 1](../../../../verae-2026-screens/OPEN-ISSUES.md).
+
 **Prerequisites:** enable deferred CAs in `Product-Full.wxs` via [`../scripts/enable-printer-cas.ps1`](../scripts/enable-printer-cas.ps1) (or manually unwrap `DEFERRED_PRINTER_CAS:OFF` markers); rebuild MSI. `dual-ship-smoke.ps1` prints **VM C BLOCKED** while markers are disabled — enabling is not a dual-ship pass.
 
 | # | Step | Result / notes | ☐ |