Tool identity is linearly readable from the residual stream of a fully-open base model, even when generation fails

We show that the identity of the correct tool for a function-calling request is linearly decodable from the penultimate-layer residual stream of Apertus-8B — an unaligned, fully open-data base model — even on requests where the model fails to generate a correct call. On BFCL v3 (all 8 single-turn categories, n=2351), strict AST generation accuracy is 50.2%, while a leave-one-out cosine readout of tool identity from the residual stream reaches 95.0% on eligible queries, a within-run gap of +44.8 pp. Stratifying by failure mode, the readout holds at 91–94% on the two large failure strata (tool-selection and format failures). Within the tool-selection stratum specifically, the cosine readout outperforms a Wu-style tool-name baseline by +6.1 pp (91.2% vs. 85.1%) — recovering correct tool identity where generation actively selects the wrong tool — with no meaningful gap on format failures (94.4% vs. 96.2%), establishing orthogonal signal beyond output-surface matching. This replicates the wu2026tool residual-readout effect on the first model whose entire pretraining corpus is public, establishing the instrumentation we use in a companion checkpoint-emergence study (Preprint B). We are explicit about what this run cannot show: true empty-generation failures are essentially absent under our prompt (n=1), so the strongest form of the claim — that identity is encoded when the model generates nothing — remains untested here.