#17274: Apply filtering only on merged capabilities

java/src/org/openqa/selenium/grid/node/relay/RelaySessionFactory.java

@@ -164,7 +164,7 @@ public Either<WebDriverException, ActiveSession> apply(CreateSessionRequest sess
               "New session request capabilities do not " + "match the stereotype."));
     }
 
-    capabilities = capabilities.merge(filterRelayCapabilities(stereotype));
+    capabilities = filterRelayCapabilities(capabilities.merge(stereotype));
 
     LOG.info("Starting session for " + capabilities);
 

java/test/org/openqa/selenium/grid/node/relay/RelaySessionFactoryTest.java

@@ -223,4 +223,69 @@ void remoteResponseOverridesStereotypeSePrefixedCaps() {
     // Remote response value should win over stereotype (merge overlays remote on top)
     assertThat(sessionCaps.getCapability("se:downloadsEnabled")).isEqualTo(false);
   }
+
+  @Test
+  void requestedAppiumApplicationWinsOverBrowserName() {
+    String fakeSessionId = UUID.randomUUID().toString();
+
+    // Remote returns its own se:downloadsEnabled value
+    Map<String, Object> responsePayload =
+        Map.of(
+            "value",
+            Map.of(
+                "sessionId",
+                fakeSessionId,
+                "capabilities",
+                Map.of(
+                    "platformName", "android",
+                    "se:downloadsEnabled", false)));
+
+    Route route =
+        Route.post("/session")
+            .to(
+                () ->
+                    req -> {
+                      HttpResponse response = new HttpResponse();
+                      response.setStatus(200);
+                      response.setContent(Contents.asJson(responsePayload));
+                      return response;
+                    });
+
+    PassthroughHttpClient.Factory clientFactory = new PassthroughHttpClient.Factory(route);
+    Tracer tracer = DefaultTestTracer.createTracer();
+
+    Capabilities stereotype =
+        new ImmutableCapabilities(
+            "browserName", "chrome",
+            "platformName", "android",
+            "se:downloadsEnabled", true);
+
+    RelaySessionFactory factory =
+        new RelaySessionFactory(
+            tracer,
+            clientFactory,
+            Duration.ofSeconds(300),
+            URI.create("http://localhost:4723"),
+            null,
+            "",
+            stereotype);
+
+    Capabilities requestCaps =
+        new ImmutableCapabilities(
+            "appium:app", "http://localhost/app.apk",
+            "platformName", "android");
+
+    CreateSessionRequest sessionRequest =
+        new CreateSessionRequest(Set.of(Dialect.W3C), requestCaps, Map.of());
+
+    Either<WebDriverException, ActiveSession> result = factory.apply(sessionRequest);
+
+    assertThat(result.isRight()).isTrue();
+    ActiveSession session = result.right();
+    Capabilities sessionCaps = session.getCapabilities();
+
+    // Remote response value should win over stereotype (merge overlays remote on top)
+    assertThat(sessionCaps.getCapability("appium:app")).isEqualTo("http://localhost/app.apk");
+    assertThat(sessionCaps.getCapability("browserName")).isEqualTo(null);
+  }
 }