This is going to get old fast -- you could instead define the semantics that the control system takes ownership of the validator? And just delete it in ControlDoublePrivate when the control is deleted.