refactor: PostRow::update and PostGuard::assertNoMissedSchedule (M5)

- PostRow::update(id, columns, failure) / ::save(): the slashed wp_update_post of
  internal row writes, refusals as RuntimeException '<failure>: <why>'. Used by
  ContentUpdate::restoreRow, PostCloner::updateRow, MediaMetaWriter apply/restore.
- PostGuard::assertNoMissedSchedule(postId, message) replaces the re-read + check in
  ContentUpdate::restoreRow, PostCloner and DiviSaver::restore (DiviSaver keeps its
  own kses window; M4).
- PostCloner::restore uses Rollback::attempt.
Log messages unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/Integrations/WordPress/Content/ContentUpdateAbility.php

@@ -13,6 +13,7 @@ use LIT\MCP\Abilities\WriteFailed;
 use LIT\MCP\ChangeLog\ChangeLog;
 use LIT\MCP\Integrations\WordPress\PostChangeResult;
 use LIT\MCP\Integrations\WordPress\PostGuard;
+use LIT\MCP\Integrations\WordPress\PostRow;
 use LIT\MCP\Integrations\WordPress\RevisionPoint;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use RuntimeException;
@@ -269,10 +270,10 @@ final class ContentUpdateAbility implements Ability
         }
 
         // Both restore paths save through wp_update_post(), which would publish a missed schedule.
-        $current = get_post((int) $post->ID);
-        if ($current instanceof WP_Post && PostGuard::missedSchedule($current)) {
-            throw new RuntimeException('Post row not restored: saving it now would publish a missed schedule.');
-        }
+        PostGuard::assertNoMissedSchedule(
+            (int) $post->ID,
+            'Post row not restored: saving it now would publish a missed schedule.'
+        );
 
         $fromRevision = array_values(array_intersect(array_keys($before), self::REVISIONED));
         if ($revisionId !== null && $fromRevision !== [] && wp_revisions_enabled($post)) {
@@ -286,10 +287,6 @@ final class ContentUpdateAbility implements Ability
             return;
         }
 
-        $result = wp_update_post(wp_slash(array_merge($before, ['ID' => (int) $post->ID])), true);
-        if ($result instanceof WP_Error || ! $result) {
-            $message = $result instanceof WP_Error ? $result->get_error_message() : 'unknown error';
-            throw new RuntimeException('Post row could not be restored: ' . $message);
-        }
+        PostRow::update((int) $post->ID, $before, 'Post row could not be restored');
     }
 }

src/Integrations/WordPress/PostGuard.php

@@ -6,6 +6,7 @@ namespace LIT\MCP\Integrations\WordPress;
 
 use LIT\MCP\Abilities\Errors;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
+use RuntimeException;
 use WP_Error;
 use WP_Post;
 
@@ -83,6 +84,21 @@ final class PostGuard
         return $time !== false && $time <= time() + self::PUBLISH_WINDOW;
     }
 
+    /**
+     * For internal writes (rollbacks, clone rows): wp_update_post() would publish a missed
+     * schedule (see missedSchedule()), so the entry is re-read and such a save is refused.
+     * $message is the internal log text of the RuntimeException.
+     *
+     * @throws RuntimeException
+     */
+    public static function assertNoMissedSchedule(int $postId, string $message): void
+    {
+        $post = get_post($postId);
+        if ($post instanceof WP_Post && self::missedSchedule($post)) {
+            throw new RuntimeException($message);
+        }
+    }
+
     /**
      * Refuses a write that would change the status as a side effect (spec §2: status is only
      * changed on explicit request) – currently a missed schedule, which any save would publish.

src/Integrations/WordPress/PostRow.php

@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Integrations\WordPress;
+
+use RuntimeException;
+use WP_Error;
+
+/**
+ * Internal writes of post-row columns through wp_update_post() (slashed, WP_Error mode):
+ * rollbacks, clone rows, media metadata. Refusals become RuntimeExceptions with an internal
+ * message for the PHP error log. Callers that could hit a scheduled entry check
+ * PostGuard::assertNoMissedSchedule() first.
+ */
+final class PostRow
+{
+    /**
+     * @param array<string, mixed> $columns Column => value (unslashed).
+     * @param string               $failure Log text; the exception reads "<failure>: <why>".
+     * @throws RuntimeException When WordPress refuses the save.
+     */
+    public static function update(int $id, array $columns, string $failure): void
+    {
+        $refusal = self::save($id, $columns);
+        if ($refusal !== null) {
+            throw new RuntimeException($failure . ': ' . $refusal);
+        }
+    }
+
+    /**
+     * The save itself, for callers that must react before throwing.
+     *
+     * @param array<string, mixed> $columns
+     * @return string|null Why WordPress refused (WP_Error message or "unknown error"), null when saved.
+     */
+    public static function save(int $id, array $columns): ?string
+    {
+        $result = wp_update_post(wp_slash(array_merge($columns, ['ID' => $id])), true);
+        if ($result instanceof WP_Error) {
+            return $result->get_error_message();
+        }
+
+        return $result ? null : 'unknown error';
+    }
+}

src/Integrations/WordPress/Status/PostCloner.php

@@ -4,8 +4,10 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\WordPress\Status;
 
+use LIT\MCP\Abilities\Rollback;
 use LIT\MCP\Abilities\WriteFailed;
 use LIT\MCP\Integrations\WordPress\PostGuard;
+use LIT\MCP\Integrations\WordPress\PostRow;
 use RuntimeException;
 use Throwable;
 use WP_Error;
@@ -143,14 +145,7 @@ class PostCloner
             'meta' => fn () => $this->replaceMeta($postId, $snapshot['meta']),
             'terms' => fn () => $this->setTerms($postId, $snapshot['terms']),
         ];
-        $failures = [];
-        foreach (array_intersect_key($steps, array_flip($parts)) as $step) {
-            try {
-                $step();
-            } catch (Throwable $e) {
-                $failures[] = $e->getMessage();
-            }
-        }
+        $failures = Rollback::attempt(...array_values(array_intersect_key($steps, array_flip($parts))));
 
         if ($failures !== []) {
             throw new RuntimeException('Restore incomplete: ' . implode('; ', $failures));
@@ -225,11 +220,7 @@ class PostCloner
     private function updateRow(int $postId, array $columns): void
     {
         $this->assertNoMissedSchedule($postId);
-        $result = wp_update_post(wp_slash(array_merge(['ID' => $postId], $columns)), true);
-        if ($result instanceof WP_Error || ! $result) {
-            $message = $result instanceof WP_Error ? $result->get_error_message() : 'unknown error';
-            throw new RuntimeException(sprintf('Post %d could not be updated: %s', $postId, $message));
-        }
+        PostRow::update($postId, $columns, sprintf('Post %d could not be updated', $postId));
     }
 
     /**
@@ -239,13 +230,10 @@ class PostCloner
      */
     private function assertNoMissedSchedule(int $postId): void
     {
-        $post = get_post($postId);
-        if ($post instanceof WP_Post && PostGuard::missedSchedule($post)) {
-            throw new RuntimeException(sprintf(
-                'Post %d not written: saving it now would publish a missed schedule.',
-                $postId
-            ));
-        }
+        PostGuard::assertNoMissedSchedule(
+            $postId,
+            sprintf('Post %d not written: saving it now would publish a missed schedule.', $postId)
+        );
     }
 
     /**