feat(store): add TaskCorrected compensating-event type (S8)

Implements §3.1's invariant that a wrong event is never edited, only
compensated for by a new appended event. TaskCorrected references the
event it repairs and can change state and/or amend-style fields;
Store.Append verifies the referenced event actually exists on the task.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1rkJ2hBMybnJctPbcy4tT

progress.md

@@ -295,7 +295,19 @@ Fixed so far:
   would refuse or continue — asserting rotation happens anyway once a
   `reason=manual` handoff exists).
 
-Not yet started: Codex/opencode Stop-hook-equivalent scripts, S8, S11's
+- **S8** — no compensation-event mechanism existed for §3.1's own invariant
+  ("a wrong event is never edited; a compensating event is appended and
+  replay sees both"). Added `TaskCorrected`: payload requires `corrects`
+  (the id of the event it repairs) plus at least one change (`state`, or the
+  existing amend-style metadata fields). `Store.Append` rejects a `corrects`
+  that doesn't name a real prior event on the same task; `store.apply`
+  applies the state/field changes and clears `Lease` like every other
+  terminal-state branch. Covered by `TestTaskCorrected`
+  (`internal/store/store_test.go`): a mistaken `TaskFailed` reverted to
+  `queued`, an unknown-`corrects` rejection, and both events surviving a
+  snapshot+replay reopen.
+
+Not yet started: Codex/opencode Stop-hook-equivalent scripts, S11's
 milestone/thrash pieces. See `AUDIT.md` for the full plan.
 
 **Phase 0 done (2026-07-27):** this box has live TCP reachability to the real