fix(media_player): privacy bare-app identity outranks the channel-title fallback in the foreground tier (F3)

tests/test_command_routing.py

@@ -517,6 +517,37 @@ class TestChannelLeakGuard:
         assert np["title"] == "205"
 
 
+class TestPrivacyOrdering:
+    """F3: privacy mode outranks the channel fallback — identity stays the app."""
+
+    async def test_channel_number_never_leaks_in_privacy_mode(self, modules):
+        player, manager = _ladder_player(modules, foreground=TIVIMATE_PACKAGE)
+        player._entry.options["adb_store_app_info"] = False  # privacy on
+
+        player._last_channel = "101"
+        np = player._get_app_now_playing()
+
+        assert np["title"] == TIVIMATE_PACKAGE  # app identity, not the channel
+        assert np["title"] != "101"
+
+    async def test_channel_number_never_leaks_in_privacy_mode_with_last_known(self, modules):
+        from nsh.ha_adb_common import MediaSessionInfo
+
+        player, manager = _ladder_player(modules, foreground=TIVIMATE_PACKAGE)
+        player._entry.options["adb_store_app_info"] = False
+        manager._clock = lambda: 0.0
+        info = MediaSessionInfo(
+            package=TIVIMATE_PACKAGE, playing=True, title="Sky News"
+        )
+        manager._last_known[TIVIMATE_PACKAGE] = (info, 0.0)
+
+        player._last_channel = "101"
+        np = player._get_app_now_playing()
+
+        assert np["state"] == "playing"  # playback truth survives privacy
+        assert np["title"] == TIVIMATE_PACKAGE  # but identity stays the app
+
+
 class TestVolumeAndPowerLadder:
     async def test_volume_readout_from_protocol_push(self, modules):
         player, served, _intents = make_player(modules)