Aligned language models are designed to refuse harmful requests, yet a simple one-line prefill ("Sure, here is") can strip this refusal. We investigate the mechanisms behind this failure. The harmful representation remains intact: when prompts flip to compliance, a linear probe reads harm levels as high as those of refused prompts (0.91-0.98), while behavioral refusal drops to chance levels. This behavior is consistent across four models and three families (1.5-3.8B, and 14B). Thus, refusal operates as a shallow, response-site computation. We localize the failure to an early window: a dose-matched position control indicates that the first half of the response is sufficient to break the refusal, while the latter half is nearly inert. Three causal probes converge on this window, where restoring the harm direction partially re-engages refusal. Injecting the model's own refuse-state can reverse the jailbreak (74%, held-out). Additionally, knocking out the early response's attention to the prefill, while maintaining attention elsewhere, selectively collapses the harmful continuation. A base-model control identifies the mechanism: the same knockout specifically collapses the continuation prefill even in a non-safety-tuned base model (64% to 25% harmful content vs a matched control's 64%, replicated at 7B). The prefill's grip is thus attributed to generic autoregressive conditioning rather than safety-specific suppression, and