jailbreak

The guardrail judged the message, not the conversation

Crescendo reaches a forbidden answer through turns that each look harmless. A per-message filter scores every one of them clean, because the violation exists only in the sequence.