GroundedControlChecker<J: ControlJudge>::check(spec, regions, repo_id) judges each candidate region and keeps only findings that survive the core grounding gate. Generic over the judge so tests drive it with a deterministic stub — the recognize->ground path is proven without an LLM (grounded snippet kept, ungrounded dropped, non-violation yields nothing). 2 lib tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>