Implement a conservative review gate for destructive database plans.

Write Python blocked_databases(plan) for a small, fictional review export derived from a Terraform plan. The export has exactly one key, resource_changes, whose value is a list. Each entry has exactly address, type and actions. Address and type are nonempty strings with no surrounding whitespace; addresses are unique. Allowed action sequences are ["no-op"], ["create"], ["read"], ["update"], ["delete"], ["delete","create"] and ["create","delete"]. Return sorted addresses whose type is aws_db_instance or aws_rds_cluster and whose actions include delete. Reject malformed or unsupported input with ValueError. An empty list is valid. This simplified export is not the complete Terraform JSON schema and is not an authorization system.

Optional six-minute route mode: review this flawed helper instead of implementing the full function. Give two concrete counterexamples, explain its missing validation, and describe the correction. The standalone exercise still asks for the complete implementation.

def quick_gate(plan):
    return [item["address"] for item in plan["resource_changes"]
            if item["type"] == "aws_db_instance"
            and item["actions"] == ["delete"]]