Hopefully fix some bugs.

functions

@@ -209,7 +209,7 @@ fn-ga-apply-list-change() {
     dokku_log_verbose "auth service is not running; changes apply when it starts"
     return 0
   fi
-  if ! fn-ga-service-has-app-mount; then
+  if ! fn-ga-service-reads-app-lists; then
     dokku_log_info1 "recreating the auth service so it can read per-app lists"
     fn-ga-service-start
     return 0
@@ -615,12 +615,19 @@ fn-ga-service-running() {
   [[ "$(docker container inspect -f '{{.State.Running}}' "$GOOGLE_AUTH_SERVICE_NAME" 2>/dev/null)" == "true" ]]
 }
 
-# True when the running container has the per-app config mount. A container
-# started by an older version of this plugin will not, and would silently
-# ignore per-app lists.
-fn-ga-service-has-app-mount() {
-  docker container inspect -f '{{range .Mounts}}{{println .Destination}}{{end}}' \
-    "$GOOGLE_AUTH_SERVICE_NAME" 2>/dev/null | grep -qxF "$GOOGLE_AUTH_APP_CONFIG_MOUNT"
+# True when the running container can actually read per-app lists. That takes
+# both halves: the bind mount, and the environment variable pointing at it.
+# Either one alone makes the service ignore every per-app list and fall back to
+# the global one — silently, and in the permissive direction — so both are
+# checked. A container started by an older version of this plugin has neither;
+# one recreated from a stale service.env has the mount without the variable.
+fn-ga-service-reads-app-lists() {
+  local inspected
+  inspected="$(docker container inspect \
+    -f '{{range .Mounts}}mount={{println .Destination}}{{end}}{{range .Config.Env}}env={{println .}}{{end}}' \
+    "$GOOGLE_AUTH_SERVICE_NAME" 2>/dev/null)" || return 1
+  grep -qxF "mount=$GOOGLE_AUTH_APP_CONFIG_MOUNT" <<<"$inspected" || return 1
+  grep -qxF "env=GOOGLE_AUTH_APP_CONFIG_DIR=$GOOGLE_AUTH_APP_CONFIG_MOUNT" <<<"$inspected"
 }
 
 fn-ga-write-env-file() {