Activation-based jailbreak defenses rest on a fixed assumption: a successful jailbreak leaves an internal trace stable enough across attacks for one probe to catch new ones. We show it fails in mixture-of-experts language models. Within an attack, routing makes the jailbreak legible: router logits distinguish compliance from refusal, and a few experts carry the signal. But the signature does not survive across attacks. A routing probe trained on three attacks performs at chance on a held-out fourth (pooled leave-one-attack-out balanced accuracy 0.52, 95 percent CI [0.50, 0.61]). Controls on two dense models show near-chance residual-stream transfer to held-out roleplay, so the failure is not specific to MoE routing. Nor is it an artifact of separable regions of activation space: the comply-versus-refuse direction itself shifts across attacks at every network depth. One systematic trace remains in the compliance state’s effective dimensionality, but it is a signature of shape, not location, beyond directional probes. Across six open-weight MoE models and four jailbreak attacks, in routing and residual streams alike, the jailbroken state is legible and locally structured within each attack, yet its location is attack-specific. Reading activations alone cannot be assumed to catch a jailbreak the probe was not built for.