[yummybomb]

Summary

On help.doordash.com, save_address told a signed-in account "The browser is not signed in to DoorDash." The dd_cx_logged_in cookie is only visible on www.doordash.com, and the sign-in check ran before the host check. The host is now checked first, so off-www pages get the existing "Run this on a www.doordash.com page..." answer. On www, a signed-out visit still gets not_signed_in, and a missing header address button still gets the wrong-page answer.

Tests

• Added a case for a help-host page where the sign-in cookie is not visible. It fails with the old order and passes with this change.
• node --test "tests/*.test.mjs": 4482 pass. node scripts/validate-registry.mjs: valid.

Live check (author, not independent QA)

Signed in, on help.doordash.com: the tool returned the wrong-page answer at session_check, with save_clicked: false. The status stays draft.