Apply profile compatibility gate using effective menu visibility

oci/src/proxmenux_oci/catalog_refresh.py

@@ -167,11 +167,13 @@ def filter_compatible_recipes(root, directory, previous):
     candidate = Catalog(Path(root), catalog_dir=directory)
     old = Catalog(Path(root), catalog_dir=previous)
     old_items = {item["id"]: item for item in old.load_index()["applications"]}
+    effective_items = {item["id"]: item for item in candidate.load_index()["applications"]}
     index = json.loads((directory / "index.json").read_text())
     accepted = []
     old_fingerprints = None
     for item in index["applications"]:
-        if item.get("hidden") or not item.get("automatic_install_candidate"):
+        effective = effective_items[item["id"]]
+        if effective.get("hidden") or not effective.get("automatic_install_candidate"):
             accepted.append(item)
             continue
         template = candidate._compose_item(item)

oci/tests/test_catalog_refresh.py

@@ -97,6 +97,18 @@ class CatalogRefreshTests(unittest.TestCase):
         status.recipes = refresh.visible_recipes(catalog)
         self.assertIn("New applications since your last visit: 0", status.describe())
 
+    def test_compatibility_gate_uses_effective_menu_visibility(self):
+        self.add_app()
+        self.future_profile("sample-added")
+        index = json.loads(self.files["index.json"])
+        added = next(x for x in index["applications"] if x["id"] == "sample-added")
+        added.update(hidden=True, automatic_install_candidate=False)
+        self.files["index.json"] = json.dumps(index).encode()
+        # The app template makes this stale index entry visible/installable;
+        # use the same rule as Catalog.load_index(), not the raw index flags.
+        self.sync()
+        self.assertNotIn("sample-added", refresh.visible_recipes(Catalog(self.root)))
+
     def test_incompatible_existing_app_retains_complete_previous_contract(self):
         self.sync()
         old = Catalog(self.root).compose(self.item["id"])