feat(store): add TaskCorrected compensating-event type (S8)

Implements §3.1's invariant that a wrong event is never edited, only
compensated for by a new appended event. TaskCorrected references the
event it repairs and can change state and/or amend-style fields;
Store.Append verifies the referenced event actually exists on the task.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1rkJ2hBMybnJctPbcy4tT

internal/domain/domain.go

@@ -101,7 +101,7 @@ func ValidateEvent(e Event) error {
 	if e.SchemaVersion >= 2 && strings.TrimSpace(e.Surface) == "" {
 		return fmt.Errorf("%w: surface required", ErrInvalid)
 	}
-	allowed := map[string]bool{"TaskCreated": true, "TaskLeased": true, "TaskReleased": true, "TaskCompleted": true, "TaskFailed": true, "TaskBlocked": true, "ApprovalRequested": true, "ApprovalGranted": true, "ApprovalDenied": true, "TaskAmended": true, "QuotaReported": true, "StandupAdvisory": true}
+	allowed := map[string]bool{"TaskCreated": true, "TaskLeased": true, "TaskReleased": true, "TaskCompleted": true, "TaskFailed": true, "TaskBlocked": true, "ApprovalRequested": true, "ApprovalGranted": true, "ApprovalDenied": true, "TaskAmended": true, "TaskCorrected": true, "QuotaReported": true, "StandupAdvisory": true}
 	if !allowed[e.Type] {
 		return fmt.Errorf("%w: unknown type %q", ErrInvalid, e.Type)
 	}
@@ -189,6 +189,29 @@ func ValidatePayload(typ string, p map[string]any) error {
 		if len(p) == 0 {
 			return fmt.Errorf("%w: amendment cannot be empty", ErrInvalid)
 		}
+	case "TaskCorrected":
+		// §3.1: "a wrong event is never edited; a compensating event is
+		// appended and replay sees both." `corrects` names the event this one
+		// reverses/repairs — existence against the log is checked in
+		// Store.Append, where the log is visible; ValidatePayload only knows
+		// shape.
+		if err := requiredString("corrects"); err != nil {
+			return err
+		}
+		if v, ok := p["state"]; ok {
+			s, ok := v.(string)
+			if !ok {
+				return fmt.Errorf("%w: state must be a string", ErrInvalid)
+			}
+			switch TaskState(s) {
+			case StateQueued, StateLeased, StateCompleted, StateFailed, StateBlocked:
+			default:
+				return fmt.Errorf("%w: state invalid", ErrInvalid)
+			}
+		}
+		if len(p) < 2 {
+			return fmt.Errorf("%w: correction must change at least one field", ErrInvalid)
+		}
 	case "ApprovalRequested":
 		for _, k := range []string{"subject_ref", "options"} {
 			if _, ok := p[k]; !ok {