fix(compiler): enforce hide and seal on destructuring

new_changelogs/20261029T123000Z-fixed-hide-seal-destructure.md

@@ -0,0 +1,3 @@
+- **Tuple destructuring now respects lexical containment.** A slot can no
+  longer re-bind an outer name excluded by `hide` or `seal except`; visible
+  locals and new locals inside a sealed block keep their existing behavior.

tests/integration/hide_seal_directives/test_hide_reject.sh

@@ -332,6 +332,44 @@ main() {
 EOF
 run_reject "hide blocks DSL receiver fallback across nested scopes" $AE_TMP/ae_hide_dsl_receiver_outer.ae
 
+# Cases 20-22: tuple destructuring is a write to every named slot. It must
+# not re-bind an outer name that the current scope hid or sealed out.
+cat > $AE_TMP/ae_hide_destructure.ae << 'EOF'
+pair() -> (string, int) { return "changed", 1 }
+main() {
+    secret = "original"
+    {
+        hide secret
+        secret, _ = pair()
+    }
+}
+EOF
+run_reject "hide blocks tuple-destructure write" $AE_TMP/ae_hide_destructure.ae
+
+cat > $AE_TMP/ae_seal_destructure.ae << 'EOF'
+pair() -> (string, int) { return "changed", 1 }
+main() {
+    secret = "original"
+    {
+        seal except pair
+        secret, _ = pair()
+    }
+}
+EOF
+run_reject "seal except blocks tuple-destructure write" $AE_TMP/ae_seal_destructure.ae
+
+cat > $AE_TMP/ae_seal_local_destructure.ae << 'EOF'
+pair() -> (string, int) { return "changed", 1 }
+main() {
+    {
+        seal except pair
+        local = "original"
+        local, fresh = pair()
+    }
+}
+EOF
+run_accept "seal except permits local tuple-destructure bindings" $AE_TMP/ae_seal_local_destructure.ae
+
 # Cleanup
 rm -f $AE_TMP/ae_hide_*.ae $AE_TMP/ae_seal_*.ae $AE_TMP/ae_hide_out