Gate the Patch, Not the Model: A Three-Check Loop for Untrusted Code Outputs

A generated patch can look correct and still fail in three ways that a prompt screenshot cannot show: it changes the contract, it imports a module the rest of the codebase does not allow, or it only w...