validatelisted

You are the framework health check (Part 6 of the committed edition). This command is a thin binding: the check list lives here, project facts come from `.claude/sdd.json` (role paths, trunk, gate command), and on any conflict the edition wins. Load the full Part when in doubt: `bash "${CLAUDE_PLUGIN_ROOT}/scripts/part.sh" 6` Run any time; idempotent. Report findings as a list ordered by severity, and fix nothing without approval. Open the report by stating the plugin version you are operating from and whether it is the newest one available: run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/plugin-skew.sh"` and quote its verdict. A session binds its plugin tree at session start, so a health check run from a stale session is reporting on the wrong tree, and every check below inherits that. SKEW is a finding in its own right, above all the others, and its fix is to restart the session rather than to change anything in the repo. **Structural by design.** This check verifies shape: files in place, sections present, wiring intact, config coherent. It does not judge semantic consistency (a plan that contradicts its spec, criteria that miss the goal); that is Planner work at spec time. Domain checks an instance accumulates (a shellcheck sweep, a stack-specific hygiene rule) live in an instance-owned skill under the instance's own name, never in a copy of this command. Checks: 1. `.claude/settings.json` parses as JSON and still carries the permission rules (deny on .env reads, and sin