The jail read gitea's container journal, which carries its sshd's lines, but matched only the web login. 167 ssh attempts an hour from the internet went unbanned. Two patterns, one per attempt: an unknown user, and a user sshd refuses; tested against a day of the real log, 946 matches and none on an accepted login.