__Host- cookie is invalid
A cookie name starts with __Host- but it is not Secure, it sets Domain, or Path is not /.
Why it matters
Browsers reject a __Host- cookie that breaks those rules, so the cookie is not stored.
What to do
Set Secure and Path=/ and omit Domain, or rename the cookie.
Reference
Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.