fix: never publish a missed schedule, refuse trashed posts, fail on meta read errors

- PostGuard::editable() refuses trashed entries unless the caller opts in
  (content-get, revisions-list, post-trash); publish/schedule/unpublish/update/
  restore/duplicate/replace now refuse them.
- PostGuard::statusStable(): content-update, revision-restore and
  replace-with-copy refuse a future post whose date has passed (any save would
  publish it); the content-update rollback and PostCloner row writes re-check.
- PostCloner::ownMeta() treats a failed SELECT as an error; replace() reads the
  copy before its first write.
- replace-with-copy needs create_posts (backup clone) and reports backup_id in
  write_failed/partial_write.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/WordPress/Content/ContentGetAbilityTest.php

@@ -29,6 +29,19 @@ final class ContentGetAbilityTest extends TestCase
         self::assertSame(['id' => 5], $ability->execute(['post_id' => 5]));
     }
 
+    public function testATrashedPostCanStillBeRead(): void
+    {
+        $post = new WP_Post(['ID' => 5, 'post_type' => 'page', 'post_status' => 'trash']);
+        Functions\when('get_post')->justReturn($post);
+        Functions\when('current_user_can')->justReturn(true);
+        $schema = Mockery::mock(ContentSchema::class);
+        $schema->allows('isManaged')->andReturn(true);
+        $presenter = Mockery::mock(PostPresenter::class);
+        $presenter->expects('full')->with($post)->andReturn(['id' => 5]);
+
+        self::assertSame(['id' => 5], (new ContentGetAbility($schema, $presenter))->execute(['post_id' => 5]));
+    }
+
     public function testMissingPostIsNotFound(): void
     {
         Functions\when('get_post')->justReturn(null);

tests/Unit/Integrations/WordPress/Content/ContentUpdateAbilityTest.php

@@ -61,6 +61,32 @@ final class ContentUpdateAbilityTest extends TestCase
         );
     }
 
+    public function testATrashedPostIsRefused(): void
+    {
+        $this->post->post_status = 'trash';
+        Functions\expect('wp_update_post')->never();
+
+        $result = $this->ability(Mockery::mock(PostWriter::class))
+            ->execute(['post_id' => 5, 'rev' => Rev::ofPost($this->post), 'title' => 'Neu']);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+    }
+
+    public function testAMissedScheduleIsRefusedBecauseSavingWouldPublish(): void
+    {
+        $this->post->post_status = 'future';
+        $this->post->post_date_gmt = gmdate('Y-m-d H:i:s', time() - 600);
+        Functions\expect('wp_update_post')->never();
+        Functions\expect('wp_save_post_revision')->never();
+
+        $result = $this->ability(Mockery::mock(PostWriter::class))
+            ->execute(['post_id' => 5, 'rev' => Rev::ofPost($this->post), 'title' => 'Neu']);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertArrayHasKey('post_id', $result->get_error_data()['fields']);
+        self::assertStringContainsString('lit/post-schedule', $result->get_error_data()['hint']);
+    }
+
     public function testStaleRevIsRejectedWithoutWriting(): void
     {
         Functions\expect('wp_update_post')->never();
@@ -254,6 +280,30 @@ final class ContentUpdateAbilityTest extends TestCase
         self::assertSame(['post_name' => 'team', 'ID' => 5], $updates[1]);
     }
 
+    public function testTheRollbackNeverRewritesARowWhoseScheduleHasPassedMeanwhile(): void
+    {
+        [$writer, $input] = $this->failingWriter(['post_name' => 'unser-team']);
+        $post = $this->post;
+        $updates = [];
+        Functions\when('wp_update_post')->alias(static function (array $data) use (&$updates, $post): int {
+            $updates[] = $data;
+            // The entry turned into a missed schedule while the call ran (e.g. edited in WordPress).
+            $post->post_status = 'future';
+            $post->post_date_gmt = gmdate('Y-m-d H:i:s', time() - 5);
+            return 5;
+        });
+        Functions\when('wp_revisions_enabled')->justReturn(true);
+        Functions\expect('wp_restore_post_revision')->never();
+        $log = Mockery::mock(ChangeLog::class);
+        $log->expects('recordPartial');
+
+        $failure = $this->executeExpectingFailure($writer, $input, $log);
+
+        self::assertFalse($failure->rolledBack);
+        self::assertCount(1, $updates);
+        self::assertStringContainsString('publish', $failure->getMessage());
+    }
+
     public function testAnIncompleteRollbackIsAPartialWriteAndLogged(): void
     {
         [$writer, $input] = $this->failingWriter(['post_title' => 'Unser Team'], false);