# Etappe 1a – WordPress-Basis: Inhalte, Menüs, Einstellungen – Implementation Plan > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. **Goal:** Claude kann über den OAuth-geschützten MCP-Server Seiten, Beiträge und Pods-Einträge generisch finden, lesen, anlegen und bearbeiten, ihren Status explizit steuern, Entwurfskopien anlegen und zurücktauschen, Revisionen nutzen, Menüs aufbauen und die freigegebenen WordPress-Einstellungen setzen – jede Änderung mit einheitlichem `ToolResult` und Protokolleintrag. **Architecture:** Neue Integration `WordPressIntegration` (immer verfügbar) liefert die Abilities; eine `ContentSchema` führt Feldquellen zusammen (Pods → registrierte Meta → Meta-Stichprobe), `FieldValidator`/`TermAssigner`/`PostWriter` validieren alles vor dem ersten Schreibzugriff (alles oder nichts). Querschnitt: `Errors` (JSON-Fehler mit `hint`), `ToolResult` (Spec §8.1), `Cursor`, `Rev`, `ChangeLog` (Tabelle `{prefix}lit_mcp_log`, täglicher Cron), `RequestContext` (Flag-Reset nach dem Request, Client-Name für das Protokoll). Etappe 1b (separater Plan) ergänzt Medien, Einstellungsseite, Expositions-Policy, Hinweise und Aufräumen. **Tech Stack:** PHP ≥ 8.1, WordPress 7.0 Abilities API, `wordpress/mcp-adapter` 0.5.0, `wp-media/mcp-oauth` 1.1.2, Pods 3.3.9 (optional), PHPUnit 9.6 + Brain Monkey + Mockery, phpcs (PSR-12 + WordPress-Security), DDEV. **Spec:** `docs/superpowers/specs/2026-09-25-wp-lit-mcp-design.md` (insb. §2, §4.3–4.5, §6.1, §6.2, §6.4, §6.5, §8.1–8.3, §9, §10, §11.3, §12 Etappe 1) **Folgeplan:** `docs/superpowers/plans/2026-09-25-etappe-1b-medien-admin.md` (Medien §6.3, Einstellungsseite §8.4, Expositions-Policy §4.3, Aufräumen, Hinweise). 1b setzt diesen Plan voraus. ## Global Constraints - Dateien ausschließlich im Plugin-Verzeichnis `/home/janniclas/Projekte/WordPress/wp-content/plugins/WP-LIT-MCP` anlegen oder ändern. Das installierte, inaktive Pods darf in DDEV für Integrationstests aktiviert werden (danach wieder deaktivieren); keine neuen Plugins installieren. - PHP ≥ 8.1, WordPress ≥ 6.9 (getestet mit 7.0.3); Plugin-Header `Tested up to: 7.0`. - Namespace `LIT\MCP\` → `src/`, PSR-4, eine Klasse pro Datei, PSR-12, höchstens 120 Zeichen pro Zeile; `composer lint` und `composer test` müssen nach jedem Task sauber sein. - Unit-Tests: PHPUnit 9.6 + Brain Monkey + Mockery über `LIT\MCP\Tests\Unit\TestCase`; Stubs für WP-Klassen in `tests/Stubs/` (in `tests/bootstrap.php` eingebunden). Funktionen, die `TestCase::setUp()` per `Functions\stubs()` vorbelegt (`wp_json_encode`, `is_wp_error`, `absint`, `wp_slash`, `wp_unslash`, `sanitize_text_field`), nie mit `Functions\expect()` prüfen – Brain Monkey verbietet Stub und Erwartung auf derselben Funktion. - Integrationstests laufen im DDEV-Container: `cd /home/janniclas/Projekte/WordPress && timeout 600 ddev exec bash wp-content/plugins/WP-LIT-MCP/tests/Integration/.sh`; WP-CLI über `timeout 120 ddev wp …`. - Ability-Namen `lit/-` → Tool-Namen `lit--`. Annotations exakt: Lese-Tools `readonly: true`; `destructive: true` nur für Löschen, Ersetzen, Austausch (Papierkorb, Kopie-Austausch, Revision wiederherstellen, Menübaum ersetzen); `idempotent` wie je Task angegeben. - Input- und Output-Schemas als JSON Schema 2020-12, nur mit Schlüsselwörtern, die `rest_validate_value_from_schema()` prüft (`type` inkl. Typ-Listen, `properties`, `required`, `items`, `enum`, `minimum`, `maximum`, `minLength`, `maxLength`, `pattern`, `minItems`, `maxItems`, `additionalProperties`). WordPress prüft Eingaben vor `execute()` und Ausgaben danach – eine Ausgabe, die nicht zum `outputSchema` passt, wird zum Fehler. - Fachliche Fehler ausschließlich über `LIT\MCP\Abilities\Errors` (Code `lit_
`, Nachricht = JSON `{code, message, hint, …}`), nie Stacktraces.
- Schreib-Tools ändern nie den Veröffentlichungsstatus; neue Einträge immer als Entwurf; Beiträge nur in den Papierkorb, nie endgültig löschen (einzige Ausnahme: Menüeinträge `nav_menu_item`, die WordPress selbst ohne Papierkorb löscht – Task 14).
- Tools mit `destructive: true` verlangen `confirm: true`, sonst `lit_confirm_required` ohne jede Änderung.
- Jede erfolgreiche Änderung schreibt einen Protokolleintrag (`ChangeLog::record`) und liefert `ToolResult` nach Spec §8.1; `revision_id` ist der Wiederherstellungspunkt **vor** der Änderung (oder `null`), `rev` der Hash des `post_content` danach (oder `null` bei Nicht-Beiträgen).
- Listen mit Cursor-Paginierung: `limit` 1–100 (Standard 20), `cursor` rein, `next_cursor` (oder `null`) raus.
- Keine Divi-Tools in dieser Etappe; Divi-Inhalte werden erkannt (`_et_pb_use_builder = on` oder `']);

        $full = (new PostPresenter($schema))->full($post);

        self::assertTrue($full['divi']);
        self::assertNull($full['content']);
        self::assertNull($full['featured_image']);
        self::assertStringContainsString('lit-divi-outline', $full['hints'][0]);
        self::assertInstanceOf(stdClass::class, $full['terms']);
        self::assertInstanceOf(stdClass::class, $full['fields']);
    }

    public function testDiviIsAlsoDetectedFromBlockMarkup(): void
    {
        Functions\when('get_post_meta')->justReturn('');

        self::assertTrue(PostPresenter::usesDivi(new WP_Post(['post_content' => 'x  y'])));
        self::assertFalse(PostPresenter::usesDivi(new WP_Post(['post_content' => ''])));
    }
}
```

`tests/Unit/Integrations/WordPress/Content/ContentQueryAbilityTest.php`:
```php
allows('summary')->andReturnUsing(static fn (WP_Post $post): array => ['id' => $post->ID]);

        return new ContentQueryAbility(Mockery::mock(ContentSchema::class), $presenter);
    }

    public function testBuildsTheQueryAndPaginates(): void
    {
        Functions\when('current_user_can')->justReturn(true);
        Functions\expect('get_posts')->once()->with(Mockery::on(static function (array $args): bool {
            return $args['post_type'] === 'lit_person'
                && $args['post_status'] === ['draft']
                && $args['s'] === 'Anna'
                && $args['posts_per_page'] === 3
                && $args['offset'] === 4
                && $args['orderby'] === 'title'
                && $args['order'] === 'ASC'
                && $args['tax_query'] === [
                    'relation' => 'OR',
                    ['taxonomy' => 'category', 'field' => 'term_id', 'terms' => [4]],
                    ['taxonomy' => 'category', 'field' => 'slug', 'terms' => ['news']],
                ]
                && $args['meta_query'] === [['key' => 'level', 'compare' => '=', 'value' => 'senior']]
                && $args['date_query'] === [['after' => '2026-01-01', 'inclusive' => true]];
        }))->andReturn([new WP_Post(['ID' => 1]), new WP_Post(['ID' => 2]), new WP_Post(['ID' => 3])]);

        $result = $this->ability()->execute([
            'post_type' => 'lit_person',
            'status' => ['draft'],
            'search' => 'Anna',
            'taxonomy' => ['taxonomy' => 'category', 'terms' => [4, 'news']],
            'field' => ['key' => 'level', 'value' => 'senior'],
            'date_after' => '2026-01-01',
            'orderby' => 'title',
            'order' => 'asc',
            'limit' => 2,
            'cursor' => Cursor::encode(4),
        ]);

        self::assertSame([['id' => 1], ['id' => 2]], $result['items']);
        self::assertSame(6, Cursor::decode($result['next_cursor']));
    }

    public function testExistsFilterHasNoValueAndLastPageHasNoCursor(): void
    {
        Functions\when('current_user_can')->justReturn(true);
        Functions\expect('get_posts')->once()->with(Mockery::on(
            static fn (array $args): bool => $args['meta_query'] === [['key' => 'role', 'compare' => 'EXISTS']]
                && $args['post_status'] === ['publish', 'draft', 'pending', 'private', 'future']
        ))->andReturn([new WP_Post(['ID' => 1])]);

        $result = $this->ability()->execute(['post_type' => 'page', 'field' => ['key' => 'role', 'compare' => 'EXISTS']]);

        self::assertNull($result['next_cursor']);
    }

    public function testPostsTheUserCannotEditAreDropped(): void
    {
        Functions\when('current_user_can')->alias(static fn (string $cap, int $id = 0): bool => $id !== 2);
        Functions\when('get_posts')->justReturn([new WP_Post(['ID' => 1]), new WP_Post(['ID' => 2])]);

        $result = $this->ability()->execute(['post_type' => 'page']);

        self::assertSame([['id' => 1]], $result['items']);
    }

    public function testInvalidCursorIsRejected(): void
    {
        $result = $this->ability()->execute(['post_type' => 'page', 'cursor' => '???']);

        self::assertSame('lit_validation_failed', $result->get_error_code());
    }

    public function testPermissionNeedsAManagedTypeAndEditRights(): void
    {
        $schema = Mockery::mock(ContentSchema::class);
        $schema->allows('isManaged')->andReturn(false);
        $ability = new ContentQueryAbility($schema, Mockery::mock(PostPresenter::class));

        self::assertSame('lit_not_found', $ability->permission(['post_type' => 'secret'])->get_error_code());
    }
}
```

`tests/Unit/Integrations/WordPress/Content/ContentGetAbilityTest.php`:
```php
 5, 'post_type' => 'page']);
        Functions\when('get_post')->justReturn($post);
        Functions\when('current_user_can')->justReturn(true);
        $schema = Mockery::mock(ContentSchema::class);
        $schema->allows('isManaged')->andReturn(true);
        $presenter = Mockery::mock(PostPresenter::class);
        $presenter->expects('full')->with($post)->andReturn(['id' => 5]);
        $ability = new ContentGetAbility($schema, $presenter);

        self::assertTrue($ability->permission(['post_id' => 5]));
        self::assertSame(['id' => 5], $ability->execute(['post_id' => 5]));
    }

    public function testMissingPostIsNotFound(): void
    {
        Functions\when('get_post')->justReturn(null);
        $schema = Mockery::mock(ContentSchema::class);
        $ability = new ContentGetAbility($schema, Mockery::mock(PostPresenter::class));

        self::assertSame('lit_not_found', $ability->permission(['post_id' => 99])->get_error_code());
    }

    public function testOutputSchemaAllowsNullContentForDivi(): void
    {
        $ability = new ContentGetAbility(Mockery::mock(ContentSchema::class), Mockery::mock(PostPresenter::class));

        self::assertSame(['string', 'null'], $ability->outputSchema()['properties']['content']['type']);
        self::assertTrue($ability->isDirect());
    }
}
```

In `tests/Unit/Integrations/WordPress/WordPressIntegrationTest.php` die Konstante ersetzen:
```php
    private const EXPECTED = [
        'lit/content-types',
        'lit/content-query',
        'lit/content-get',
    ];
```

- [ ] **Step 2: Run – muss fehlschlagen**

Run: `composer test -- --filter 'PostPresenterTest|ContentQueryAbilityTest|ContentGetAbilityTest|WordPressIntegrationTest'`
Expected: FAIL.

- [ ] **Step 3: Implementierung**

`src/Integrations/WordPress/Content/PostPresenter.php`:
```php
 */
    public function summary(WP_Post $post): array
    {
        return [
            'id' => (int) $post->ID,
            'type' => (string) $post->post_type,
            'status' => (string) $post->post_status,
            'title' => (string) $post->post_title,
            'slug' => (string) $post->post_name,
            'parent' => (int) $post->post_parent,
            'date' => (string) $post->post_date,
            'modified' => (string) $post->post_modified,
            'url' => (string) get_permalink($post),
            'edit_url' => (string) get_edit_post_link($post->ID, 'raw'),
            'divi' => self::usesDivi($post),
        ];
    }

    /** @return array */
    public function full(WP_Post $post): array
    {
        $divi = self::usesDivi($post);

        return array_merge($this->summary($post), [
            'excerpt' => (string) $post->post_excerpt,
            'content' => $divi ? null : (string) $post->post_content,
            'menu_order' => (int) $post->menu_order,
            'author' => [
                'id' => (int) $post->post_author,
                'name' => (string) get_the_author_meta('display_name', (int) $post->post_author),
            ],
            'template' => (string) get_page_template_slug($post),
            'preview_url' => (string) get_preview_post_link($post),
            'terms' => JsonMap::of($this->terms($post)),
            'fields' => JsonMap::of($this->fields($post)),
            'featured_image' => $this->featuredImage($post),
            'rev' => Rev::of((string) $post->post_content),
            'hints' => $divi ? [self::DIVI_HINT] : [],
        ]);
    }

    public static function usesDivi(WP_Post $post): bool
    {
        return get_post_meta((int) $post->ID, '_et_pb_use_builder', true) === 'on'
            || str_contains((string) $post->post_content, '',
            'post_excerpt' => 'Kurz',
            'post_parent' => 2,
            'menu_order' => 3,
        ]);
    }

    public function testDuplicateCopiesContentMetaAndTermsAsDraft(): void
    {
        Functions\when('get_current_user_id')->justReturn(4);
        Functions\when('maybe_unserialize')->returnArg();
        Functions\expect('wp_insert_post')->once()->with($this->draftMatcher(), true)->andReturn(77);
        Functions\when('get_post_meta')->justReturn([
            '_edit_lock' => ['123:1'],
            '_et_pb_use_builder' => ['on'],
            'role' => ['Leitung'],
        ]);
        Functions\expect('add_post_meta')->once()->with(77, '_et_pb_use_builder', 'on');
        Functions\expect('add_post_meta')->once()->with(77, 'role', 'Leitung');
        Functions\when('get_object_taxonomies')->justReturn(['category']);
        Functions\when('wp_get_object_terms')->justReturn([4, 9]);
        Functions\expect('wp_set_object_terms')->once()->with(77, [4, 9], 'category', false);
        Functions\expect('update_post_meta')->once()->with(77, '_lit_mcp_copy_of', 5);

        self::assertSame(77, (new PostCloner())->duplicate($this->original()));
    }

    public function testDuplicateFailureThrows(): void
    {
        Functions\when('get_current_user_id')->justReturn(4);
        Functions\when('wp_insert_post')->justReturn(new WP_Error('x', 'kaputt'));

        $this->expectException(RuntimeException::class);

        (new PostCloner())->duplicate($this->original());
    }

    public function testReplaceOverwritesContentMetaAndTermsButKeepsTheOriginalsIdentity(): void
    {
        $copy = new WP_Post([
            'ID' => 77,
            'post_type' => 'page',
            'post_title' => 'Team (Kopie)',
            'post_content' => 'neu',
            'post_excerpt' => 'Neu kurz',
        ]);
        Functions\when('maybe_unserialize')->returnArg();
        Functions\expect('wp_update_post')->once()->with([
            'ID' => 5,
            'post_title' => 'Team',
            'post_content' => 'neu',
            'post_excerpt' => 'Neu kurz',
        ], true)->andReturn(5);
        Functions\when('get_post_meta')->alias(static fn (int $id) => $id === 5
            ? ['_edit_lock' => ['1'], 'role' => ['Alt'], 'city' => ['Trier']]
            : ['_lit_mcp_copy_of' => ['5'], 'role' => ['Neu']]);
        Functions\expect('delete_post_meta')->once()->with(5, 'role');
        Functions\expect('delete_post_meta')->once()->with(5, 'city');
        Functions\expect('add_post_meta')->once()->with(5, 'role', 'Neu');
        Functions\when('get_object_taxonomies')->justReturn(['category']);
        Functions\when('wp_get_object_terms')->justReturn([12]);
        Functions\expect('wp_set_object_terms')->once()->with(5, [12], 'category', false);

        (new PostCloner())->replace($this->original(), $copy);
    }

    private function draftMatcher(): \Mockery\Matcher\Closure
    {
        return \Mockery::on(static fn (array $data): bool => $data['post_status'] === 'draft'
            && $data['post_type'] === 'page'
            && $data['post_title'] === 'Team (Kopie)'
            && $data['post_content'] === ''
            && $data['post_parent'] === 2
            && $data['menu_order'] === 3
            && $data['post_author'] === 4);
    }
}
```

`tests/Unit/Integrations/WordPress/Status/PostDuplicateAbilityTest.php`:
```php
 5, 'post_type' => 'page', 'post_title' => 'Team']);
        Functions\when('get_post')->alias(static fn (int $id) => $id === 5
            ? $original
            : new WP_Post(['ID' => 77, 'post_type' => 'page', 'post_title' => 'Team (Kopie)']));
        Functions\when('current_user_can')->justReturn(true);
        Functions\when('get_post_type_object')->justReturn((object) ['cap' => (object) ['create_posts' => 'edit_pages']]);
        Functions\when('get_preview_post_link')->justReturn('https://kunde.de/?p=77&preview=true');
        Functions\when('get_edit_post_link')->justReturn('https://kunde.de/wp-admin/post.php?post=77&action=edit');
        $schema = Mockery::mock(ContentSchema::class);
        $schema->allows('isManaged')->andReturn(true);
        $cloner = Mockery::mock(PostCloner::class);
        $cloner->expects('duplicate')->with($original)->andReturn(77);
        Actions\expectDone('lit_mcp_after_save')->once()->with(77, 'lit/post-duplicate', ['post_id' => 5]);
        $log = Mockery::mock(ChangeLog::class);
        $log->expects('record')->with('lit/post-duplicate', 'page', '77', 'Kopie von "Team" (ID 5) angelegt')->andReturn(8);

        $result = (new PostDuplicateAbility($schema, $cloner, $log))->execute(['post_id' => 5]);

        self::assertSame([['id' => '77', 'type' => 'page', 'action' => 'created', 'label' => 'Team (Kopie)']], $result['changed']);
        self::assertSame(5, $result['original_id']);
        self::assertSame(8, $result['log_id']);
    }
}
```

`tests/Unit/Integrations/WordPress/Status/PostReplaceWithCopyAbilityTest.php`:
```php
original = new WP_Post(['ID' => 5, 'post_type' => 'page', 'post_title' => 'Team', 'post_status' => 'publish']);
        $this->copy = new WP_Post(['ID' => 77, 'post_type' => 'page', 'post_title' => 'Team (Kopie)', 'post_status' => 'draft']);
        Functions\when('get_post')->alias(fn (int $id) => $id === 5 ? $this->original : $this->copy);
        Functions\when('current_user_can')->justReturn(true);
        Functions\when('get_post_meta')->justReturn('5');
        Functions\when('get_permalink')->justReturn('https://kunde.de/team/');
        Functions\when('get_edit_post_link')->justReturn('https://kunde.de/wp-admin/post.php?post=5&action=edit');
    }

    private function ability(PostCloner $cloner, ChangeLog $log, bool $trash = true): PostReplaceWithCopyAbility
    {
        $schema = Mockery::mock(ContentSchema::class);
        $schema->allows('isManaged')->andReturn(true);

        return new PostReplaceWithCopyAbility($schema, $cloner, $log, static fn (): bool => $trash);
    }

    public function testRequiresConfirmation(): void
    {
        $cloner = Mockery::mock(PostCloner::class);
        $cloner->expects('replace')->never();

        $result = $this->ability($cloner, Mockery::mock(ChangeLog::class))->execute(['original_id' => 5, 'copy_id' => 77]);

        self::assertSame('lit_confirm_required', $result->get_error_code());
    }

    public function testCopyMustStemFromTheOriginal(): void
    {
        Functions\when('get_post_meta')->justReturn('12');
        $cloner = Mockery::mock(PostCloner::class);
        $cloner->expects('replace')->never();

        $result = $this->ability($cloner, Mockery::mock(ChangeLog::class))
            ->execute(['original_id' => 5, 'copy_id' => 77, 'confirm' => true]);

        self::assertSame('lit_validation_failed', $result->get_error_code());
    }

    public function testDisabledTrashIsRefusedBeforeAnyChange(): void
    {
        $cloner = Mockery::mock(PostCloner::class);
        $cloner->expects('replace')->never();

        $result = $this->ability($cloner, Mockery::mock(ChangeLog::class), false)
            ->execute(['original_id' => 5, 'copy_id' => 77, 'confirm' => true]);

        self::assertSame('lit_unsupported', $result->get_error_code());
    }

    public function testRevisionThenReplaceThenTrashTheCopy(): void
    {
        $order = [];
        Functions\expect('wp_save_post_revision')->once()->with(5)->andReturnUsing(static function () use (&$order) {
            $order[] = 'revision';
            return 900;
        });
        Functions\when('wp_get_post_revisions')->justReturn([900 => new WP_Post(['ID' => 900])]);
        $cloner = Mockery::mock(PostCloner::class);
        $cloner->expects('replace')->with($this->original, $this->copy)->andReturnUsing(static function () use (&$order): void {
            $order[] = 'replace';
        });
        Functions\expect('wp_trash_post')->once()->with(77)->andReturnUsing(static function () use (&$order): WP_Post {
            $order[] = 'trash';
            return new WP_Post(['ID' => 77]);
        });
        $log = Mockery::mock(ChangeLog::class);
        $log->expects('record')->with('lit/post-replace-with-copy', 'page', '5', Mockery::type('string'), 900)->andReturn(11);

        $result = $this->ability($cloner, $log)->execute(['original_id' => 5, 'copy_id' => 77, 'confirm' => true]);

        self::assertSame(['revision', 'replace', 'trash'], $order);
        self::assertSame(900, $result['revision_id']);
        self::assertSame(['replaced', 'trashed'], array_column($result['changed'], 'action'));
    }
}
```

In `WordPressIntegrationTest` die Konstante ersetzen:
```php
    private const EXPECTED = [
        'lit/content-types',
        'lit/content-query',
        'lit/content-get',
        'lit/content-create',
        'lit/content-update',
        'lit/post-publish',
        'lit/post-unpublish',
        'lit/post-schedule',
        'lit/post-trash',
        'lit/post-duplicate',
        'lit/post-replace-with-copy',
    ];
```

- [ ] **Step 2: Run – muss fehlschlagen**

Run: `composer test -- --filter 'PostCloner|PostDuplicate|PostReplaceWithCopy|WordPressIntegrationTest'`
Expected: FAIL.

- [ ] **Step 3: Implementierung**

`src/Integrations/WordPress/Status/PostCloner.php`:
```php
 (string) $original->post_type,
            'post_status' => 'draft',
            'post_title' => sprintf('%s (Kopie)', $original->post_title),
            'post_content' => (string) $original->post_content,
            'post_excerpt' => (string) $original->post_excerpt,
            'post_parent' => (int) $original->post_parent,
            'menu_order' => (int) $original->menu_order,
            'comment_status' => (string) $original->comment_status,
            'ping_status' => (string) $original->ping_status,
            'post_password' => (string) $original->post_password,
            'post_author' => get_current_user_id(),
        ]), true);

        if ($copyId instanceof WP_Error || (int) $copyId === 0) {
            $reason = $copyId instanceof WP_Error ? $copyId->get_error_message() : 'unknown';
            throw new RuntimeException('Copy could not be created: ' . $reason);
        }

        $copyId = (int) $copyId;
        $this->copyMeta((int) $original->ID, $copyId);
        $this->copyTerms($original, $copyId);
        update_post_meta($copyId, self::COPY_OF_META, (int) $original->ID);

        return $copyId;
    }

    /** @throws RuntimeException */
    public function replace(WP_Post $original, WP_Post $copy): void
    {
        $result = wp_update_post(wp_slash([
            'ID' => (int) $original->ID,
            'post_title' => (string) preg_replace('/ \(Kopie\)$/u', '', (string) $copy->post_title),
            'post_content' => (string) $copy->post_content,
            'post_excerpt' => (string) $copy->post_excerpt,
        ]), true);
        if ($result instanceof WP_Error) {
            throw new RuntimeException('Original could not be updated: ' . $result->get_error_message());
        }

        foreach (array_keys((array) get_post_meta((int) $original->ID)) as $key) {
            if (! in_array((string) $key, self::SKIP_META, true)) {
                delete_post_meta((int) $original->ID, (string) $key);
            }
        }

        $this->copyMeta((int) $copy->ID, (int) $original->ID);
        $this->copyTerms($copy, (int) $original->ID);
    }

    private function copyMeta(int $from, int $to): void
    {
        foreach ((array) get_post_meta($from) as $key => $values) {
            if (in_array((string) $key, self::SKIP_META, true)) {
                continue;
            }

            foreach ((array) $values as $value) {
                add_post_meta($to, (string) $key, wp_slash(maybe_unserialize($value)));
            }
        }
    }

    private function copyTerms(WP_Post $from, int $to): void
    {
        foreach (get_object_taxonomies((string) $from->post_type) as $taxonomy) {
            $ids = wp_get_object_terms((int) $from->ID, $taxonomy, ['fields' => 'ids']);
            if (is_array($ids)) {
                wp_set_object_terms($to, array_map('intval', $ids), $taxonomy, false);
            }
        }
    }
}
```

`src/Integrations/WordPress/Status/PostDuplicateAbility.php`:
```php
 'object',
            'properties' => ['post_id' => ['type' => 'integer', 'minimum' => 1]],
            'required' => ['post_id'],
            'additionalProperties' => false,
        ];
    }

    public function outputSchema(): ?array
    {
        return ToolResult::schema(['original_id' => ['type' => 'integer']], ['original_id']);
    }

    public function annotations(): array
    {
        return ['readonly' => false, 'destructive' => false, 'idempotent' => false];
    }

    public function isDirect(): bool
    {
        return false;
    }

    public function permission(array $input): bool|WP_Error
    {
        $post = $this->load($input);

        return $post instanceof WP_Error ? $post : true;
    }

    public function execute(array $input): mixed
    {
        $original = $this->load($input);
        if ($original instanceof WP_Error) {
            return $original;
        }

        $copyId = $this->cloner->duplicate($original);
        do_action('lit_mcp_after_save', $copyId, $this->name(), $input);

        $copy = get_post($copyId);
        $copyTitle = $copy instanceof WP_Post ? (string) $copy->post_title : '';
        $postType = (string) $original->post_type;
        $summary = sprintf('Kopie von "%s" (ID %d) angelegt', $original->post_title, $original->ID);
        $logId = $this->log->record($this->name(), $postType, (string) $copyId, $summary);

        return ToolResult::ok(sprintf('%s: Entwurf ID %d.', $summary, $copyId))
            ->changed((string) $copyId, $postType, 'created', $copyTitle)
            ->logId($logId)
            ->urls((string) get_preview_post_link($copyId), (string) get_edit_post_link($copyId, 'raw'))
            ->with('original_id', (int) $original->ID)
            ->toArray();
    }

    /** @param array $input */
    private function load(array $input): WP_Post|WP_Error
    {
        $post = PostGuard::editable($input['post_id'] ?? null, $this->schema);
        if ($post instanceof WP_Error) {
            return $post;
        }

        $type = PostGuard::postType((string) $post->post_type, $this->schema, 'create_posts');

        return $type instanceof WP_Error ? $type : $post;
    }
}
```

`src/Integrations/WordPress/Status/PostReplaceWithCopyAbility.php`:
```php
trashEnabled = $trashEnabled
            ?? static fn (): bool => ! defined('EMPTY_TRASH_DAYS') || (bool) EMPTY_TRASH_DAYS;
    }

    public function name(): string
    {
        return 'lit/post-replace-with-copy';
    }

    public function label(): string
    {
        return 'Kopie ins Original übernehmen';
    }

    public function description(): string
    {
        return 'Übernimmt Titel, Inhalt, Felder/Meta und Begriffe einer mit lit-post-duplicate erstellten Kopie '
            . 'ins Original. ID, URL, Status und Menüeinträge des Originals bleiben; vorher entsteht eine '
            . 'Revision des Originals, die Kopie kommt danach in den Papierkorb. Erst nach Rückfrage mit '
            . 'confirm: true aufrufen.';
    }

    public function inputSchema(): array
    {
        return [
            'type' => 'object',
            'properties' => [
                'original_id' => ['type' => 'integer', 'minimum' => 1],
                'copy_id' => ['type' => 'integer', 'minimum' => 1],
                'confirm' => ['type' => 'boolean'],
            ],
            'required' => ['original_id', 'copy_id'],
            'additionalProperties' => false,
        ];
    }

    public function outputSchema(): ?array
    {
        return ToolResult::schema();
    }

    public function annotations(): array
    {
        return ['readonly' => false, 'destructive' => true, 'idempotent' => false];
    }

    public function isDirect(): bool
    {
        return false;
    }

    public function permission(array $input): bool|WP_Error
    {
        $pair = $this->load($input);

        return $pair instanceof WP_Error ? $pair : true;
    }

    public function execute(array $input): mixed
    {
        $pair = $this->load($input);
        if ($pair instanceof WP_Error) {
            return $pair;
        }

        [$original, $copy] = $pair;
        $originalId = (int) $original->ID;
        $copyId = (int) $copy->ID;

        if (($input['confirm'] ?? false) !== true) {
            return Errors::confirmRequired(sprintf(
                'Inhalt von "%s" (ID %d) durch die Kopie ID %d ersetzen und die Kopie in den Papierkorb legen?',
                $original->post_title,
                $originalId,
                $copyId
            ));
        }

        $copyOf = (int) get_post_meta($copyId, PostCloner::COPY_OF_META, true);
        if ($copy->post_type !== $original->post_type || $copyOf !== $originalId) {
            return Errors::invalidInput(
                'Die Kopie gehört nicht zu diesem Original.',
                ['copy_id' => sprintf('keine mit lit-post-duplicate erstellte Kopie von %d', $originalId)],
                'Kopie mit lit-post-duplicate aus diesem Original erstellen.'
            );
        }

        if (! ($this->trashEnabled)()) {
            return Errors::unsupported(
                'Der Papierkorb ist deaktiviert (EMPTY_TRASH_DAYS = 0); die Kopie würde endgültig gelöscht. '
                    . 'Nichts wurde geändert.',
                'Den Austausch in WordPress manuell durchführen.'
            );
        }

        $revisionId = RevisionPoint::capture($originalId);
        $this->cloner->replace($original, $copy);
        wp_trash_post($copyId);
        do_action('lit_mcp_after_save', $originalId, $this->name(), $input);

        $title = (string) preg_replace('/ \(Kopie\)$/u', '', (string) $copy->post_title);
        $postType = (string) $original->post_type;
        $summary = sprintf('Kopie ID %d in "%s" (ID %d) übernommen', $copyId, $title, $originalId);
        $logId = $this->log->record($this->name(), $postType, (string) $originalId, $summary, $revisionId);

        $statusNote = sprintf('; Status bleibt %s, Kopie liegt im Papierkorb.', $original->post_status);

        return ToolResult::ok($summary . $statusNote)
            ->changed((string) $originalId, $postType, 'replaced', $title)
            ->changed((string) $copyId, $postType, 'trashed', (string) $copy->post_title)
            ->revisionId($revisionId)
            ->logId($logId)
            ->urls((string) get_permalink($originalId), (string) get_edit_post_link($originalId, 'raw'))
            ->toArray();
    }

    /**
     * @param array $input
     * @return array{0: WP_Post, 1: WP_Post}|WP_Error
     */
    private function load(array $input): array|WP_Error
    {
        $original = PostGuard::editable($input['original_id'] ?? null, $this->schema, 'original_id');
        if ($original instanceof WP_Error) {
            return $original;
        }

        $copy = PostGuard::editable($input['copy_id'] ?? null, $this->schema, 'copy_id');
        if ($copy instanceof WP_Error) {
            return $copy;
        }

        if (! current_user_can('delete_post', (int) $copy->ID)) {
            return Errors::forbidden('Keine Berechtigung, die Kopie in den Papierkorb zu legen.');
        }

        return [$original, $copy];
    }
}
```

`src/Integrations/WordPress/WordPressIntegration.php`: Imports ergänzen
```php
use LIT\MCP\Integrations\WordPress\Status\PostCloner;
use LIT\MCP\Integrations\WordPress\Status\PostDuplicateAbility;
use LIT\MCP\Integrations\WordPress\Status\PostReplaceWithCopyAbility;
```
und in `abilities()` vor dem `return` `$cloner = new PostCloner();` ergänzen sowie nach `new PostTrashAbility(...)` einfügen:
```php
            new PostDuplicateAbility($this->schema, $cloner, $this->log),
            new PostReplaceWithCopyAbility($this->schema, $cloner, $this->log),
```

- [ ] **Step 4: Run – muss bestehen**

Run: `composer test && composer lint`
Expected: PASS (lange Zeilen für phpcs umbrechen).

- [ ] **Step 5: Commit**

```bash
git add src/Integrations/WordPress tests/Unit/Integrations/WordPress
git -c user.name="Jan-Niclas Loosen" -c user.email="janniclas@loosen-it.de" commit -m "feat: draft copies and replace-with-copy

Co-Authored-By: Claude Opus 5.5 (1M context) 
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7"
```

---

### Task 12: Revisionen – `lit/revisions-list`, `lit/revision-restore`

**Files:**
- Create: `src/Integrations/WordPress/Revisions/RevisionsListAbility.php`, `src/Integrations/WordPress/Revisions/RevisionRestoreAbility.php`
- Modify: `src/Integrations/WordPress/WordPressIntegration.php`, `tests/Unit/Integrations/WordPress/WordPressIntegrationTest.php`
- Test: `tests/Unit/Integrations/WordPress/Revisions/RevisionsListAbilityTest.php`, `tests/Unit/Integrations/WordPress/Revisions/RevisionRestoreAbilityTest.php`

**Interfaces:**
- Consumes: `PostGuard`, `RevisionPoint`, `Cursor`, `Rev`, `ChangeLog`, `ToolResult`, `Errors`.
- Produces:
  - `RevisionsListAbility`: `__construct(ContentSchema $schema)`; `lit/revisions-list`, Input `{post_id, limit?, cursor?}`, Output `{post_id, items: list<{id, date, author{id,name}, title, autosave, excerpt}>, next_cursor}`; indirekt; readonly.
  - `RevisionRestoreAbility`: `__construct(ContentSchema $schema, ChangeLog $log)`; `lit/revision-restore`, Input `{revision_id, confirm}`; indirekt; `destructive: true`, idempotent; sichert den aktuellen Stand vorher als Revision (`revision_id` im Ergebnis = dieser Wiederherstellungspunkt); Status unverändert.

- [ ] **Step 1: Failing Tests**

`tests/Unit/Integrations/WordPress/Revisions/RevisionsListAbilityTest.php`:
```php
justReturn(new WP_Post(['ID' => 5, 'post_type' => 'page']));
        Functions\when('current_user_can')->justReturn(true);
        Functions\when('get_the_author_meta')->justReturn('Jan');
        Functions\when('wp_is_post_autosave')->alias(static fn ($post): bool => $post->ID === 811);
        Functions\when('wp_strip_all_tags')->alias(static fn (string $text): string => strip_tags($text));
        Functions\expect('wp_get_post_revisions')->once()->with(5, ['posts_per_page' => 3, 'offset' => 0])->andReturn([
            812 => new WP_Post(['ID' => 812, 'post_title' => 'Team', 'post_content' => 'Neu', 'post_author' => '2']),
            811 => new WP_Post(['ID' => 811, 'post_title' => 'Team', 'post_content' => 'Auto', 'post_author' => '2']),
            810 => new WP_Post(['ID' => 810, 'post_title' => 'Team', 'post_content' => 'Alt', 'post_author' => '2']),
        ]);
        $schema = Mockery::mock(ContentSchema::class);
        $schema->allows('isManaged')->andReturn(true);

        $result = (new RevisionsListAbility($schema))->execute(['post_id' => 5, 'limit' => 2]);

        self::assertSame(5, $result['post_id']);
        self::assertSame([812, 811], array_column($result['items'], 'id'));
        self::assertSame('Neu', $result['items'][0]['excerpt']);
        self::assertTrue($result['items'][1]['autosave']);
        self::assertSame(['id' => 2, 'name' => 'Jan'], $result['items'][0]['author']);
        self::assertSame(2, Cursor::decode($result['next_cursor']));
    }
}
```

`tests/Unit/Integrations/WordPress/Revisions/RevisionRestoreAbilityTest.php`:
```php
alias(static fn (int $id) => match ($id) {
            810 => new WP_Post(['ID' => 810, 'post_type' => 'revision', 'post_parent' => 5, 'post_date' => '2026-09-20 10:00:00']),
            5 => new WP_Post(['ID' => 5, 'post_type' => 'page', 'post_title' => 'Team', 'post_status' => 'publish', 'post_content' => 'alt']),
            default => null,
        });
        Functions\when('current_user_can')->justReturn(true);
    }

    private function ability(ChangeLog $log): RevisionRestoreAbility
    {
        $schema = Mockery::mock(ContentSchema::class);
        $schema->allows('isManaged')->andReturn(true);

        return new RevisionRestoreAbility($schema, $log);
    }

    public function testNonRevisionIdIsNotFound(): void
    {
        self::assertSame('lit_not_found', $this->ability(Mockery::mock(ChangeLog::class))->permission(['revision_id' => 5])->get_error_code());
    }

    public function testRequiresConfirmation(): void
    {
        Functions\expect('wp_restore_post_revision')->never();

        $result = $this->ability(Mockery::mock(ChangeLog::class))->execute(['revision_id' => 810]);

        self::assertSame('lit_confirm_required', $result->get_error_code());
    }

    public function testSavesTheCurrentStateThenRestores(): void
    {
        $order = [];
        Functions\expect('wp_save_post_revision')->once()->with(5)->andReturnUsing(static function () use (&$order) {
            $order[] = 'backup';
            return 813;
        });
        Functions\when('wp_get_post_revisions')->justReturn([813 => new WP_Post(['ID' => 813])]);
        Functions\expect('wp_restore_post_revision')->once()->with(810)->andReturnUsing(static function () use (&$order): int {
            $order[] = 'restore';
            return 5;
        });
        Functions\when('get_preview_post_link')->justReturn('https://kunde.de/team/');
        Functions\when('get_edit_post_link')->justReturn('https://kunde.de/wp-admin/post.php?post=5&action=edit');
        $log = Mockery::mock(ChangeLog::class);
        $log->expects('record')->with('lit/revision-restore', 'page', '5', Mockery::type('string'), 813)->andReturn(12);

        $result = $this->ability($log)->execute(['revision_id' => 810, 'confirm' => true]);

        self::assertSame(['backup', 'restore'], $order);
        self::assertSame(813, $result['revision_id']);
        self::assertSame('restored', $result['changed'][0]['action']);
        self::assertStringContainsString('2026-09-20 10:00:00', $result['summary']);
    }
}
```

In `WordPressIntegrationTest` die Konstante um `'lit/revisions-list', 'lit/revision-restore'` (nach `'lit/post-replace-with-copy'`) ergänzen:
```php
    private const EXPECTED = [
        'lit/content-types',
        'lit/content-query',
        'lit/content-get',
        'lit/content-create',
        'lit/content-update',
        'lit/post-publish',
        'lit/post-unpublish',
        'lit/post-schedule',
        'lit/post-trash',
        'lit/post-duplicate',
        'lit/post-replace-with-copy',
        'lit/revisions-list',
        'lit/revision-restore',
    ];
```

- [ ] **Step 2: Run – muss fehlschlagen**

Run: `composer test -- --filter 'Revision|WordPressIntegrationTest'`
Expected: FAIL.

- [ ] **Step 3: Implementierung**

`src/Integrations/WordPress/Revisions/RevisionsListAbility.php`:
```php
 'object',
            'properties' => array_merge(
                ['post_id' => ['type' => 'integer', 'minimum' => 1]],
                Cursor::inputProperties()
            ),
            'required' => ['post_id'],
            'additionalProperties' => false,
        ];
    }

    public function outputSchema(): ?array
    {
        return [
            'type' => 'object',
            'properties' => [
                'post_id' => ['type' => 'integer'],
                'items' => [
                    'type' => 'array',
                    'items' => [
                        'type' => 'object',
                        'properties' => [
                            'id' => ['type' => 'integer'],
                            'date' => ['type' => 'string'],
                            'author' => ['type' => 'object'],
                            'title' => ['type' => 'string'],
                            'autosave' => ['type' => 'boolean'],
                            'excerpt' => ['type' => 'string'],
                        ],
                        'required' => ['id', 'date', 'author', 'title', 'autosave', 'excerpt'],
                    ],
                ],
                'next_cursor' => ['type' => ['string', 'null']],
            ],
            'required' => ['post_id', 'items', 'next_cursor'],
        ];
    }

    public function annotations(): array
    {
        return ['readonly' => true, 'destructive' => false, 'idempotent' => true];
    }

    public function isDirect(): bool
    {
        return false;
    }

    public function permission(array $input): bool|WP_Error
    {
        $post = PostGuard::editable($input['post_id'] ?? null, $this->schema);

        return $post instanceof WP_Error ? $post : true;
    }

    public function execute(array $input): mixed
    {
        $post = PostGuard::editable($input['post_id'] ?? null, $this->schema);
        if ($post instanceof WP_Error) {
            return $post;
        }

        $offset = Cursor::decode(isset($input['cursor']) ? (string) $input['cursor'] : null);
        if ($offset === null) {
            return Cursor::invalid();
        }

        $limit = Cursor::limit($input['limit'] ?? null);
        $revisions = wp_get_post_revisions((int) $post->ID, ['posts_per_page' => $limit + 1, 'offset' => $offset]);
        $page = Cursor::page(array_values(is_array($revisions) ? $revisions : []), $limit, $offset);

        return [
            'post_id' => (int) $post->ID,
            'items' => array_map(fn (WP_Post $revision): array => $this->item($revision), $page['items']),
            'next_cursor' => $page['next_cursor'],
        ];
    }

    /** @return array */
    private function item(WP_Post $revision): array
    {
        $text = trim((string) preg_replace('/\s+/u', ' ', wp_strip_all_tags((string) $revision->post_content)));

        return [
            'id' => (int) $revision->ID,
            'date' => (string) $revision->post_date,
            'author' => [
                'id' => (int) $revision->post_author,
                'name' => (string) get_the_author_meta('display_name', (int) $revision->post_author),
            ],
            'title' => (string) $revision->post_title,
            'autosave' => (bool) wp_is_post_autosave($revision),
            'excerpt' => mb_substr($text, 0, 160),
        ];
    }
}
```

`src/Integrations/WordPress/Revisions/RevisionRestoreAbility.php`:
```php
 'object',
            'properties' => [
                'revision_id' => ['type' => 'integer', 'minimum' => 1],
                'confirm' => ['type' => 'boolean'],
            ],
            'required' => ['revision_id'],
            'additionalProperties' => false,
        ];
    }

    public function outputSchema(): ?array
    {
        return ToolResult::schema();
    }

    public function annotations(): array
    {
        return ['readonly' => false, 'destructive' => true, 'idempotent' => true];
    }

    public function isDirect(): bool
    {
        return false;
    }

    public function permission(array $input): bool|WP_Error
    {
        $pair = $this->load($input);

        return $pair instanceof WP_Error ? $pair : true;
    }

    public function execute(array $input): mixed
    {
        $pair = $this->load($input);
        if ($pair instanceof WP_Error) {
            return $pair;
        }

        [$revision, $post] = $pair;
        $postId = (int) $post->ID;
        if (($input['confirm'] ?? false) !== true) {
            return Errors::confirmRequired(sprintf(
                '"%s" (ID %d) auf den Stand vom %s zurücksetzen?',
                $post->post_title,
                $postId,
                $revision->post_date
            ));
        }

        $backupId = RevisionPoint::capture($postId);
        $restored = wp_restore_post_revision((int) $revision->ID);
        if (! $restored) {
            return Errors::unsupported(
                'WordPress konnte die Revision nicht wiederherstellen.',
                'Revision in WordPress unter „Revisionen“ prüfen.'
            );
        }

        do_action('lit_mcp_after_save', $postId, $this->name(), $input);
        $updated = get_post($postId);
        $updated = $updated instanceof WP_Post ? $updated : $post;
        $summary = sprintf('"%s" auf Stand vom %s zurückgesetzt', $updated->post_title, $revision->post_date);
        $postType = (string) $post->post_type;
        $logId = $this->log->record($this->name(), $postType, (string) $postId, $summary, $backupId);

        return ToolResult::ok($summary . sprintf(' (Status unverändert: %s).', $updated->post_status))
            ->changed((string) $postId, $postType, 'restored', (string) $updated->post_title)
            ->rev(Rev::of((string) $updated->post_content))
            ->revisionId($backupId)
            ->logId($logId)
            ->urls((string) get_preview_post_link($updated), (string) get_edit_post_link($postId, 'raw'))
            ->toArray();
    }

    /**
     * @param array $input
     * @return array{0: WP_Post, 1: WP_Post}|WP_Error
     */
    private function load(array $input): array|WP_Error
    {
        $revisionId = PostGuard::id($input['revision_id'] ?? null);
        $revision = $revisionId === null ? null : get_post($revisionId);
        if (! $revision instanceof WP_Post || $revision->post_type !== 'revision') {
            return Errors::notFound('Revision nicht gefunden.', 'Revisionen über lit-revisions-list abrufen.');
        }

        $post = PostGuard::editable((int) $revision->post_parent, $this->schema);

        return $post instanceof WP_Error ? $post : [$revision, $post];
    }
}
```

`src/Integrations/WordPress/WordPressIntegration.php`: Imports ergänzen
```php
use LIT\MCP\Integrations\WordPress\Revisions\RevisionRestoreAbility;
use LIT\MCP\Integrations\WordPress\Revisions\RevisionsListAbility;
```
und in `abilities()` nach `new PostReplaceWithCopyAbility(...)` einfügen:
```php
            new RevisionsListAbility($this->schema),
            new RevisionRestoreAbility($this->schema, $this->log),
```

- [ ] **Step 4: Run – muss bestehen**

Run: `composer test && composer lint`
Expected: PASS.

- [ ] **Step 5: Commit**

```bash
git add src/Integrations/WordPress tests/Unit/Integrations/WordPress
git -c user.name="Jan-Niclas Loosen" -c user.email="janniclas@loosen-it.de" commit -m "feat: list and restore revisions

Co-Authored-By: Claude Opus 5.5 (1M context) 
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7"
```

---
### Task 13: Menüs lesen, anlegen, Positionen – `lit/menu-list`, `lit/menu-get`, `lit/menu-create`, `lit/menu-assign-location`

Recht für alle Menü-Tools: `edit_theme_options` (Spec §4.5).

**Files:**
- Create: `src/Integrations/WordPress/Menus/MenuTree.php`, `src/Integrations/WordPress/Menus/MenuLocations.php`, `src/Integrations/WordPress/Menus/MenuListAbility.php`, `src/Integrations/WordPress/Menus/MenuGetAbility.php`, `src/Integrations/WordPress/Menus/MenuCreateAbility.php`, `src/Integrations/WordPress/Menus/MenuAssignLocationAbility.php`
- Modify: `src/Integrations/WordPress/WordPressIntegration.php`, `tests/Unit/Integrations/WordPress/WordPressIntegrationTest.php`
- Test: `tests/Unit/Integrations/WordPress/Menus/MenuTreeTest.php`, `tests/Unit/Integrations/WordPress/Menus/MenuReadAbilitiesTest.php`, `tests/Unit/Integrations/WordPress/Menus/MenuCreateAbilityTest.php`, `tests/Unit/Integrations/WordPress/Menus/MenuAssignLocationAbilityTest.php`

**Interfaces:**
- Consumes: `ChangeLog`, `ToolResult`, `Errors`.
- Produces:
  - `MenuTree` (final, statisch): `build(list