Reasoning large language models that produce explicit chains of thought are a new jailbreak surface: an adversary who shapes intermediate reasoning can hijack safety deliberation and elicit harmful answers the same model would refuse in a single forward pass. Defenses inherited from chat-style alignment monitor only the final response and intervene after the model has already committed to an unsafe trajectory. We argue that defending reasoning models requires looking inside the thinking phase itself, and we show that the refusal direction, previously characterized as a single linear direction in chat models, in fact evolves along the reasoning trajectory: sharp at onset, slowly drifting during long deliberation, and on hijacked traces collapsing at an identifiable step well before any harmful token is emitted. We propose RsMon, a step-level refusal-subspace monitor that tracks the projection of intermediate hidden states onto a calibrated refusal subspace and triggers a minimally invasive geometric intervention once drift exceeds a learned threshold. The monitor is purely inference-time, requires no retraining, and is compatible with any open-weight reasoning model. On three open reasoning models, five attack families, and four utility benchmarks, RsMon cuts mean attack success from 80.1% to 19.2%, a 4.2× reduction, while keeping MATH-500, GPQA-Diamond, and HumanEval pass@1 within 0.7 absolute points of the undefended baseline. The same monitor produces a step-resolved diagnostic that pinpoints when and in which layer safety deliberation breaks down. Our code is available at https://github.com/llmnjust-afk/RsMon.