Name the failure the .env cannot fix

Compose passes only what its environment block names, so a docker-compose.yml
from before OIDC ignores the whole section in .env — and the boot log stays
silent, because a server with none of the variables set has nothing to report.
That combination reads as "I filled everything in and nothing happened", so it
belongs in the table with the command that settles it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

readme.md

@@ -274,7 +274,9 @@ secret and the authorization code travel to it.
 
 | Symptom | Cause |
 | --- | --- |
+| Nothing on the sign-in screen, and the boot log says nothing about OIDC at all | the variables never reached the container. Compose passes only what its `environment:` block names — a `docker-compose.yml` on the server that predates this feature ignores the whole `.env` section. Check with `docker compose exec inknote-server env \| grep INKNOTE_OIDC`; if that is empty, copy the current `docker-compose.yml` over and `docker compose up -d` |
 | Nothing on the sign-in screen | one of the four is unset — see the boot log |
+| Still the old sign-in screen after an update | the app is installed as a PWA and its service worker is serving the shell it had. Close every tab (or the installed app) and open it again |
 | Back at the sign-in screen saying the provider could not be reached | the **server container** cannot resolve or reach the issuer. Your browser reaching it proves nothing: behind a reverse proxy those are different networks. `docker compose exec inknote-server sh -c 'wget -qO- $INKNOTE_OIDC_ISSUER/.well-known/openid-configuration'` |
 | The provider refuses before InkNote is involved | the callback URL there is not exactly `<public url>/api/auth/oidc/callback` |
 | "That sign-in took too long" | more than ten minutes between pressing the button and finishing, or the server restarted in between — pending sign-ins are held in memory on purpose |