Which Set-Cookie header will a browser accept for a cookie named __Host-sid on https://app.example.com?

The browser accepts __Host-sid=abc; Secure; Path=/. The __Host- prefix has four rules:
• The cookie must have Secure.
• It must be set from a secure (HTTPS) origin.
• It must have Path=/.
• It must have no Domain attribute. This locks the cookie to the exact host.

"__Host-sid=abc; Secure; Path=/; Domain=example.com" is the tempting wrong answer. Everything else is right, but Domain=example.com breaks the rule. "__Host-sid=abc; Path=/; HttpOnly" fails because Secure is missing. "__Host-sid=abc; Secure; Path=/account" fails because the path is narrower than /.