Trace-Channel Leakage: A Single-Step Failure Primitive and Sink-Tap Diagnostic for Trace-Emitting Agents

Trace-emitting reasoning models expose a separate trace channel before the final answer, but agent stacks often apply safety filters and schema validation only to the final output while retaining raw generations in logs, trace stores, or context buffers. We study this mismatch as a single-step trace-sink failure primitive for agentic AI. We give an operational definition, triggering preconditions, and a falsifiable composition hypothesis, then reproduce the primitive in a controlled ReAct setting with synthetic canaries. On a memorized-canary vignette, a verbose-log sink retains canary text on 93.3% of bio-mode probes; an empty-trace SFT control, where the canary is never inserted into the trace body during training, still relocates 26.7%, indicating inference-time trace relocation rather than only memorized trace supervision. On 136 public-domain canonical-text probes, R1-Distill-Qwen models show non-trivial overlap in the trace channel separate from the output, so output-only audits undercount reproduced text. We package the resulting protocol as RAMA, a reasoning-aware memorization audit with a sink-tap addendum for agent stacks. The work is a diagnostic and failure primitive, not a mitigation, aimed at making agent trace failures reproducible and auditable.