The first rollout put the cookie bypass rule above the cache rule, as the runbook said to, and signed-in requests were served the cached anonymous page. Cloudflare applies the last matching rule for each setting. Fold the cookie exclusion into the cache rule's expression so order stops mattering, and explain the symptom in the verify step. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Va5eMEmWEnjMXBsBob5FDW