Three seams that a production host pushed on, all of them filed as gaps
before they were built.

- Declared subprocess tools (`.basis/tools.json`) — ADR-0012's second binding,
  held since rev 5 for a concrete use case and shipped against one: a host
  routing operations through `spawn`'s command mode, base64-encoding arguments
  to survive shell quoting. The model fills a schema; there is no shell on the
  path.
- `ApprovalRequest` carries the call's side-effect level, so a policy can be
  written about what a call does rather than which tools are installed.
- `RunReport`'s error carries the failure's source chain, which `Display`
  alone drops for errors that only classify themselves.