fix: DST-aware calendar and ghost recurrence guard

tests/test_mvp_backend.py

@@ -114,7 +114,7 @@ def test_calendar_respects_timezone_boundaries_and_moved_occurrences(client):
 
     calendar = client.get(
         "/api/v1/calendar",
-        params={"start": "2026-09-01", "end": "2026-09-30", "timezone_offset": 480},
+        params={"start": "2026-09-01", "end": "2026-09-30", "timezone": "Asia/Shanghai"},
     ).json()
 
     assert any(row.get("id") == inside["id"] for row in calendar)
@@ -122,6 +122,38 @@ def test_calendar_respects_timezone_boundaries_and_moved_occurrences(client):
     assert any(row.get("recurrence_id") == recurrence["id"] and row["due_at"].startswith("2026-09-20") for row in calendar)
 
 
+def test_calendar_rejects_unknown_timezone(client):
+    boot(client)
+    response = client.get("/api/v1/calendar", params={"start": "2026-09-01", "end": "2026-09-30", "timezone": "Mars/Olympus"})
+    assert response.status_code == 422
+
+
+def test_recurrence_mutations_reject_ghost_occurrences(client):
+    inbox = boot(client)
+    task = client.post(
+        "/api/v1/tasks",
+        json={"title": "每周任务", "list_id": inbox["id"], "due_at": "2026-09-07T09:00:00Z"},
+    ).json()
+    recurrence = client.post(
+        "/api/v1/recurrences", json={"task_id": task["id"], "rrule": "FREQ=WEEKLY;COUNT=3"}
+    ).json()
+    # 9/7 and 9/14 are real occurrences; 9/9 is NOT part of this series.
+    ghost_patch = client.patch(
+        f"/api/v1/recurrences/{recurrence['id']}",
+        params={"scope": "this", "occurrence_at": "2026-09-09T09:00:00Z"},
+        json={"due_at": "2026-09-20T09:00:00Z"},
+    )
+    assert ghost_patch.status_code == 422
+
+    calendar = client.get(
+        "/api/v1/calendar",
+        params={"start": "2026-09-01", "end": "2026-09-30", "timezone": "UTC"},
+    ).json()
+
+    assert not any(row.get("recurrence_id") == recurrence["id"] and row["due_at"].startswith("2026-09-20") for row in calendar)
+    assert len([row for row in calendar if row.get("recurrence_id") == recurrence["id"]]) == 3
+
+
 def test_habit_logs_support_date_range_filter(client):
     boot(client)
     habit = client.post("/api/v1/habits", json={"name": "跑步", "kind": "boolean", "schedule_type": "daily"}).json()