A block type derived from params plus a pure subtree (ADR-0002 decision 5's amendment of 2026-09-07).

use StatifierBlocks.Composite is a second use macro on the declaration surface StatifierBlocks.BlockType owns. Where use StatifierBlocks.BlockType injects a fixed answer per callback (ADR-0007), this one injects answers derived from a declaration: the params an author fills in, and the subtree/1 those params stand for.

The declaration

defmodule MyApp.GuardedStep do
  use StatifierBlocks.Composite,
    name: "myapp.guarded_step",
    params: [
      %{key: "invoke_type", type: :string, label: "Call",
        required?: true, default: ""},
      %{key: "failure_path", type: :string, label: "Record the failure at",
        required?: true, default: "", datamodel_path?: true}
    ],
    sentence: "Call {invoke_type}, recording failure at {failure_path}",
    palette_entry: %{label: "Guarded step", group: "Structure"},
    version: 1

  @impl true
  def subtree(params) do
    [
      Block.new("core.invoke",
        id: "call",
        config: %{"invoke_type" => params["invoke_type"], "assign_to" => ""},
        slots: %{"on_error" => [
          Block.new("core.assign",
            id: "guard",
            config: %{"path" => params["failure_path"], "value" => "failed"})
        ]}
      )
    ]
  end
end

params is a [t:StatifierBlocks.BlockType.field_decl/0] in decision 7's shape - no new key, no new field type. Every flag decision 7 and its amendments give a field means here exactly what it means on any other declared field, and the F3 and F4 refusals apply to a param declaration unchanged: because the composite's config_schema/1 is the params, the compiler's own declaration checks run over them for free.

subtree/1 is pure in decision 4's sense - same params in, same subtree out, forever - and answers a non-empty list of StatifierBlocks.Block.t/0 whose head is the expansion root. Several derivations below read that block and no other.

The ids the subtree mints

The ids a subtree/1 writes are local: expand/2 mints each expanded block's real id from the composite block's own id, as composite_id <> "_" <> local_id. They are not fresh UXIDs and not a counter over the document, and two properties follow:

• No __. ADR-0004 decision 3 derives a state id as "s_" <> block_id or "s_" <> block_id <> "__" <> role, and its invertibility rests on a block id containing no __. expand/2 refuses a local id that would put one there.
• Document-unique, for free. The composite block's id is document-unique, opaque and never reused (ADR-0001 decision 3), and minting is injective over it, so the members inherit all three.

A local id that looks like a freshly minted UXID ("blk_"-prefixed) is refused: StatifierBlocks.Block.new/2 mints one when a declaration writes no :id, and a minted id is different on every call, which would make subtree/1 impure and the expansion unstable.

What the use derives

sentence/1, palette_entry/0 and validate_config/1 and no others are overridable: they are the three whose answers are about presentation and refusal rather than about the expansion. migrate_config/2 keeps ADR-0007's injected refusal unchanged, and fixtures/0, failure_outcomes/1, summary/1 and donedata_type/1 are not derived - they stay optional and absent unless a declaration writes them by hand.

validate_config/1 is left at ADR-0007's injected :ok, deliberately. The refusals a param declares are declaration-level - F3's missing default:, F4's empty hidden default, and {:type_expr, opts}' allow_empty? - and the compile already runs every one of them over config_schema/1, which for a composite is the params. required? is a rendering hint and never an authority (block_type.ex, "This is a rendering hint, not the authority"), so it raises no finding here either: that is what makes the amendment's own worked example - two required?: true params defaulting to "" - land finding-free out of StatifierBlocks.Palette.new_block/2. A composite with a cross-param refusal its params cannot state as a single field's flag overrides the callback, which is why it is one of the three that may be.

emit/2 exists because the behaviour requires it and ADR-0007 deliberately injects no default for it. It raises, because the compiler expands a composite at Resolve and no composite block survives to Emit (sb-nzc1).

What a composite reads and writes

A composite's reads and writes, as the environment walk consumes them, are the union of its expanded members', each taken over that member's expanded config, at the composite's one position in the document (RQ-SF037-15, ruled 2026-09-07: shape (A)). That union is computed by StatifierBlocks.Environment.read_signatures/3 and write_signatures/3 - the same two functions, run over expand/2's subtree - and not by io/1, which is single-valued in consumes and produces and carries no per-path read or write at all.

The derived io/1 therefore answers, per key of StatifierBlocks.Assignability.io/0:

• kinds - the members' kinds concatenated in expansion order, de-duplicated
• slot_accepts - %{}; the composite declares no slots, so there is no slot name to accept into
• consumes - the expansion root's, or absent when the root declares none
• produces - the expansion root's, or absent when the root declares none

Dropping a non-root member's sugar under-declares rather than over-declares, which is the safe direction ADR-0011 decision 6 already takes.

The one limitation in the derived io/1 and outcomes/1

Both rows read a member's module, and a StatifierBlocks.Block.t/0 carries a type name. Resolving a name to a module is StatifierBlocks.Palette's job, and neither StatifierBlocks.BlockType.io/1 nor StatifierBlocks.BlockType.outcomes/1 is handed a palette - so these two derivations resolve through StatifierBlocks.Palette.core_types/0, the one type map this package holds as a value. A composite whose expansion root is a host type therefore falls back: outcomes/1 to the behaviour's default outcomes, and io/1 to [:step] kinds with no sugar. Both reference composites root at core.* and are exact. The environment walk is unaffected - it has a palette, and resolves every member through it.

The derived recipe

The declaration also derives a StatifierBlocks.Recipe at <Module>.Recipe, whose insert/2 returns exactly one :insert of the composite block at the armed target and whose palette_entry/0 is the block type's. One command, not the expansion: what an author puts down is the composite, and the expansion happens at compile.

It is a compatibility surface for a host that already ships the arrangement as a recipe. A composite's own palette entry is its types entry; StatifierBlocks.Palette keeps types and recipes in two maps, so a host that registers both is choosing to show two entries.