TraceCondemnZones could leave the white set inconsistent if TraceAddWhite failed. Add an assertion to cover this case (corresponding to the similar assertion in TraceCondemnAll).