fix: invert visibility priority so hidden wins over visible in limitation merge (#234)

inc/objects/class-limitations.php

@@ -327,9 +327,17 @@ protected function merge_recursive(array &$array1, array &$array2, $should_sum =
 				} elseif (isset($array1[ $key ]) && is_numeric($array1[ $key ]) && is_numeric($value) && $should_sum && ! $is_unlimited) {
 					$array1[ $key ] = ((int) $array1[ $key ]) + $value;
 				} elseif ('visibility' === $key && isset($array1[ $key ]) && $should_sum) {
+					/*
+					 * Hidden takes priority over visible: if any source restricts
+					 * visibility to 'hidden', the item must be hidden. A product or
+					 * membership that marks a plugin/theme as hidden should always
+					 * override a default of 'visible'.
+					 *
+					 * Priority: hidden (1) > visible (0)
+					 */
 					$key_priority = [
-						'hidden'  => 0,
-						'visible' => 1,
+						'visible' => 0,
+						'hidden'  => 1,
 					];
 
 					$array1[ $key ] = $key_priority[ $value ] > $key_priority[ $array1[ $key ] ] ? $value : $array1[ $key ];

tests/WP_Ultimo/Managers/Limitation_Manager_Test.php

@@ -15,7 +15,7 @@
 use WP_Ultimo\Models\Site;
 use WP_Ultimo\Database\Sites\Site_Type;
 
 class Limitation_Manager_Test extends \WP_UnitTestCase {
 
 	use Manager_Test_Trait;
 
@@ -29,28 +29,28 @@
 	 */
 	protected function create_test_customer(): Customer {
 
 		$user_id = self::factory()->user->create([
 			'role' => 'subscriber',
 		]);
 
 		$customer = new Customer([
 			'user_id' => $user_id,
 		]);
 		$customer->set_skip_validation(true);
 		$customer->save();
 
 		return $customer;
 	}
 
 	protected function get_manager_class(): string {
 		return Limitation_Manager::class;
 	}
 
 	protected function get_expected_slug(): ?string {
 		return null;
 	}
 
 	protected function get_expected_model_class(): ?string {
 		return null;
 	}
 
@@ -139,7 +139,7 @@
 
 		$manager = $this->get_manager_instance();
 
 		add_filter('wu_limitations_get_object_type', function ($model, $object_model) {
 			if ($object_model instanceof \stdClass) {
 				return 'custom_type';
 			}
@@ -1791,8 +1791,8 @@
 		$merged = $base->merge($override_data);
 
 		$plugin = $merged->plugins->{'akismet/akismet.php'};
-		// visible has higher priority than hidden
-		$this->assertEquals('visible', $plugin->visibility);
+		// hidden has higher priority than visible — restrictions take precedence (fix for issue #234)
+		$this->assertEquals('hidden', $plugin->visibility);
 	}
 
 	// ---------------------------------------------------------------