diff --git a/FABRIC-3.6.md b/FABRIC-3.6.md
index 86a9ef56..b09f707c 100644
--- a/FABRIC-3.6.md
+++ b/FABRIC-3.6.md
@@ -163,9 +163,41 @@ it has simply not been attempted.)*
 **Gate:** all three architectures boot to `zuse)ok>`, `stadium_conserved()` true, no
 `UNKNOWN WORD`.
 
-- [ ] **0.1** — Establish Category A reachability by §XXII.2's three routes (boot path, tooling,
+- [x] **0.1** — Establish Category A reachability by §XXII.2's three routes (boot path, tooling,
       baked capsule directory). **Never by grep alone.**
       *Check:* a written list naming the route that proves each entry dead.
+      2026-09-19 · investigation only, no code changed. Checked by all three routes — a boot-path
+      trace of `init.4th`/`hera`/`hermes/init.4th`/`artemis/init.4th` for any `EXEC`/`S" name"`
+      load, an experiments/tools/docs invocation search, and confirming presence in the baked
+      capsule directory doesn't by itself make a name reachable if nothing constructs it at
+      runtime:
+
+      | Candidate | Boot path | Tooling/experiments/docs | Verdict |
+      |---|---|---|---|
+      | `capsules/common/msg.4th` | zero `EXEC`/load sites in any boot-loaded capsule | zero invocations; its only two words `HERMES-ACK`/`HERMES-NACK` have zero callers anywhere; `messaging.4th` block 5033's own comment: "common:msg.4th's HERMES-ACK/NACK indirection is retired" | **DEAD** |
+      | `capsules/process.4th` | zero `EXEC` sites anywhere | zero invocations; its four words `SPAWN`/`PAUSE`/`RESUME`/`KILL-VM` have zero callers outside the file itself | **DEAD** |
+      | `SPAWN-EVENT` (constant, `messaging.4th`) | N/A — a constant, only ever defined, never read by name | zero invocations by name anywhere | **DEAD** |
+
+      Both files are present in the baked capsule directory (`mkcapsule` build log: `[p]
+      common:msg.4th`, `[p] process.4th`) — noted per §XXII.2 that presence alone proves
+      nothing; it only means nothing constructs either name at runtime to reach them, which the
+      other two routes confirm.
+
+      finding: `EVENT-EMIT`/`EVENT-WAIT`/`EVENT-DRAIN` (`messaging.4th`, Category B, staying)
+      have one caller beyond `process.4th` that §XXXIII.3 missed — `tools/hermes_smoke.sh` calls
+      all three directly. This does not make them live: the script is already broken on its own
+      terms, referencing `capsules/core/init.4th` and `build/amd64/standard/starforth`, neither
+      of which exists in this repo, and calling the pre-rename `CD-INIT` word (`messaging.4th`
+      block 5033 renamed it to `MSG-CD-INIT`) — it cannot currently execute. Task 0.3's plan
+      stands unchanged; recorded because §XXXIII.3's "only other reference is `MANIFEST.md`"
+      was itself an undercount of exactly the kind §XXII.2 warns about, even though the
+      conclusion survives.
+
+      finding: `PAUSE-EVENT`/`RESUME-EVENT`/`KILL-EVENT` (`messaging.4th`) are exactly as
+      dead-by-name as `SPAWN-EVENT` — zero references anywhere outside their own definition;
+      `process.4th`'s calls pass bare numeric literals (`1`/`2`/`3`/`4`), never the constant
+      names. Task 0.4 only names `SPAWN-EVENT`; not expanding its scope here, but flagging that
+      the other three meet the identical bar for whoever picks up Category A stripping next.
 - [ ] **0.2** — Strip `capsules/common/msg.4th`. *Check:* 3-arch boot; lint clean.
 - [ ] **0.3** — Strip `capsules/process.4th` (takes `EVENT-EMIT`/`-WAIT`/`-DRAIN` with it,
       §XXXIII.3). *Check:* 3-arch boot; lint clean.