doordash.com: check the host before sign-in in save_address

domains/doordash.com/save_address.js

@@ -189,8 +189,10 @@
     try {
       step = "session_check";
       let s = await read();
+      // The sign-in cookie is only visible on www.doordash.com, so the host is checked first.
+      if (s.host !== "www.doordash.com") return fail("unknown", "Run this on a www.doordash.com page that shows the header address button. Nothing was changed.");
       if (!s.signedIn) return fail("not_signed_in", "The browser is not signed in to DoorDash.");
-      if (s.host !== "www.doordash.com" || !s.header) return fail("unknown", "Run this on a www.doordash.com page that shows the header address button. Nothing was changed.");
+      if (!s.header) return fail("unknown", "Run this on a www.doordash.com page that shows the header address button. Nothing was changed.");
       if (s.challenge) return fail("captcha_or_challenge", s.challenge);
 
       step = "dialog";

registry.json

@@ -1605,7 +1605,7 @@
       ],
       "status": "draft",
       "last_verified": null,
-      "notes": "kind cdp: DoorDash address autocomplete only responds to trusted key events in the search field (lib/input.js), and the suggestion, label and Save controls are clicked with trusted input. Draft, no independent QA. Live on 2026-10-02 with one office address: the first source closed the dialog by clicking during its opening animation (address_not_found with no suggestions), and the second misread a details field mid-re-render. Both stopped before Save. The final source then added the address (office type, business name, Work label) with one Save and confirmed it in the header and the saved-address list. A repeat run took the selected_existing path without Save, but that address was already current, so switching between several saved addresses is unverified. Also unverified: suite and instructions fields, Save errors, challenges, and other address types.",
+      "notes": "kind cdp: DoorDash address autocomplete only responds to trusted key events in the search field (lib/input.js), and the suggestion, label and Save controls are clicked with trusted input. Draft, no independent QA. Live on 2026-10-02 with one office address: the first source closed the dialog by clicking during its opening animation (address_not_found with no suggestions), and the second misread a details field mid-re-render. Both stopped before Save. The final source then added the address (office type, business name, Work label) with one Save and confirmed it in the header and the saved-address list. A repeat run took the selected_existing path without Save, but that address was already current, so switching between several saved addresses is unverified. Also unverified: suite and instructions fields, Save errors, challenges, and other address types. On 2026-10-27 a signed-in run on help.doordash.com returned not_signed_in, because the sign-in cookie is only visible on www.doordash.com; the host is now checked first, and the same run returns the wrong-page answer with nothing changed.",
       "provenance": {
         "qa_agent": null
       }

tests/doordash-save-address.test.mjs

@@ -132,6 +132,8 @@ test("a search field that loses the query stops before choosing", async () => {
 test("signed out and off-site pages are refused", async () => {
   assert.equal((await harness({ initial: { signedIn: false } }).run()).error_kind, "not_signed_in");
   assert.equal((await harness({ initial: { host: "help.doordash.com", header: null } }).run()).error_kind, "unknown");
+  // Off www the sign-in cookie is not visible, so a signed-in account must still get the wrong-page answer.
+  assert.equal((await harness({ initial: { host: "help.doordash.com", header: null, signedIn: false } }).run()).error_kind, "unknown");
 });
 
 test("the Save guard prevents a repeat", async () => {