[adilalperenciftci]

Summary

I traced a lexical-containment gap to DSL receiver fallback running before hide and seal except were enforced. A blocked bare name could therefore resolve as <receiver>_<name> inside a trailing builder block.

This change:

• applies a closure body's visibility directives to the receiver scope before expression lookup;
• checks the current scope before attempting receiver-prefixed lookup;
• checks each crossed ancestor scope before resolving a receiver-prefixed symbol;
• keeps exact local bindings ahead of the visibility barrier, preserving the documented local-shadowing behavior.

Verification

• BEFORE: the three new direct/nested DSL containment cases compiled unexpectedly (16 passed, 3 failed).
• AFTER: hide/seal directive integration: 19 passed, 0 failed.
• DSL receiver scoping, nested scoping, and edge suites: passed.
• make test: 634 passed, 0 failed on Ubuntu VM.
• ae fmt --check std examples tests: passed.
• make check-changelog: passed.

The broader VM sweep reached 1921 passed, 17 failed, and 45 skipped. All containment and DSL receiver targets passed; the remaining failures were the VM's unavailable optional backends and copied-file permission differences.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[paul-hammant]

Thanks, reviewed and folded into the batch #3456 with your authorship kept on the commit. This PR will be closed when #3456 merges.

🤖 Generated with Claude Code

[paul-hammant]

Merged as part of #3456 (merge 9364d6b), with your authorship on the commit. Thank you, @adilalperenciftci: this was a real fix, carefully tested, and it's appreciated.

🤖 Generated with Claude Code