Tool‑augmented large language model (LLM) agents can issue calls to non‑existent tools or pass arguments that no schema defines. Existing defenses either select the correct tool or gate what an agent may do with real tools; both assume the emitted call refers to an actual tool. This assumption creates a structural blind spot: a hallucinated call is never a decision made by any gate, so no gate can reject it.\ \ We introduce a five‑class taxonomy of tool hallucination (H1‑H5) and present the Resolution Rung as a reference: a training‑free, closed‑world resolver that checks registry membership and a signature. We prove that hallucination defense must precede any causal gate and identify the only irreducible residue—borrowed arguments whose schema is indistinguishable from a valid call.\ \ Across ten hosted models and two invocation surfaces we observed 322 genuine hallucinations. The unconstrained raw‑JSON surface produced far more hallucinations than the structured surface (34 vs. 3), and model scale offered no benefit (a 675B model matched a 7‑8B one). We then extend the analysis to the Model Context Protocol (MCP), where merging several servers into one namespace creates hallucination surfaces that a single registry cannot express. A second taxonomy (M1‑M5) captures these cases; on the live MCP surface we measured 154 hallucinations, including from frontier models that were clean on the single‑registry surface because collisions and shadowing are inherent to the merge.\ \ We release the versioned Hallucinated‑Tools Benchmark (HTB) so that any resolver can be compared on a common benchmark.\ \ Review: The paper systematically uncovers the structural cause of tool hallucination, offers a lightweight closed‑world defense, and clarifies the ordering of defenses, providing a solid foundation for future work on robust LLM agents.