Two follow-ups a review caught:

1. Write-path fix #3 (whole-plan role preflight in dc-dc-prefixes-import.py) shipped
   with NO test exercising it FAILING. Every existing test preseeds all roles, so
   they ran the preflight only when it passes -- silently. A future edit could delete
   the preflight and the harness would stay green: exactly the "green while the bug is
   armed" failure this session has been killing. Added a test that runs main() with one
   six-plane role missing and asserts nonzero exit AND that NOTHING was written (no
   site, no prefixes). prefixes-import 82 -> 85.

2. The ledger's "Live state" bullet still claimed OpenTofu repo/state were IN SYNC
   ("tofu plan reports No changes"). False since D-119 -- plan is 11 to add / 11 to
   destroy. Reconciled to state the gated destroying apply, contradicting nothing.

GAUNTLET ALL GREEN (58). repo-lint 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>