A block type derived from params plus a pure subtree (ADR-0002 decision 5's amendment of 2026-09-07).

use StatifierBlocks.Composite is a second use macro on the declaration surface StatifierBlocks.BlockType owns. Where use StatifierBlocks.BlockType injects a fixed answer per callback (ADR-0007), this one injects answers derived from a declaration: the params an author fills in, and the subtree/1 those params stand for.

The declaration

defmodule MyApp.GuardedStep do
  use StatifierBlocks.Composite,
    name: "myapp.guarded_step",
    params: [
      %{key: "invoke_type", type: :string, label: "Call",
        required?: true, default: ""},
      %{key: "failure_path", type: :string, label: "Record the failure at",
        required?: true, default: "", datamodel_path?: true}
    ],
    sentence: "Call {invoke_type}, recording failure at {failure_path}",
    palette_entry: %{label: "Guarded step", group: "Structure"},
    version: 1

  @impl true
  def subtree(params) do
    [
      Block.new("core.invoke",
        id: "call",
        config: %{"invoke_type" => params["invoke_type"], "assign_to" => ""},
        slots: %{"on_error" => [
          Block.new("core.assign",
            id: "guard",
            config: %{"path" => params["failure_path"], "value" => "failed"})
        ]}
      )
    ]
  end
end

params is a [t:StatifierBlocks.BlockType.field_decl/0] in decision 7's shape - no new key, no new field type. Every flag decision 7 and its amendments give a field means here exactly what it means on any other declared field, and the F3 and F4 refusals apply to a param declaration unchanged: because the composite's config_schema/1 is the params, the compiler's own declaration checks run over them for free.

subtree/1 is pure in decision 4's sense - same params in, same subtree out, forever - and answers a non-empty list of StatifierBlocks.Block.t/0 whose head is the expansion root. Several derivations below read that block and no other.

The ids the subtree mints

The ids a subtree/1 writes are local: expand!/2 mints each expanded block's real id from the composite block's own id, as composite_id <> "_" <> local_id. They are not fresh UXIDs and not a counter over the document, and two properties follow:

• No __. ADR-0004 decision 3 derives a state id as "s_" <> block_id or "s_" <> block_id <> "__" <> role, and its invertibility rests on a block id containing no __. expand!/2 refuses a local id that would put one there.
• Document-unique, for free. The composite block's id is document-unique, opaque and never reused (ADR-0001 decision 3), and minting is injective over it, so the members inherit all three.

A local id that looks like a freshly minted UXID ("blk_"-prefixed) is refused: StatifierBlocks.Block.new/2 mints one when a declaration writes no :id, and a minted id is different on every call, which would make subtree/1 impure and the expansion unstable.

What the use derives

sentence/1, summary/1, palette_entry/0 and validate_config/1 and no others are overridable: they are the four whose answers are about presentation and refusal rather than about the expansion. migrate_config/2 keeps ADR-0007's injected refusal unchanged, and fixtures/0, failure_outcomes/1 and donedata_type/1 are not derived - they stay optional and absent unless a declaration writes them by hand.

The derived summary/1

ADR-0002's Note of 2026-09-07, item 4: the chips are the declaration's params, minus those declared hidden?: true. hidden? is a rendering claim (block_type.ex, "the field is never rendered by any form"), so a param the author has already said no form draws is not a chip either - the same reading StatifierBlocks.ViewModel takes of the flag. Each surviving param draws as "<label>: <value>", and a param whose value renders blank draws no chip at all rather than a label with nothing after it.

The value is read with Map.get/2 on the param's :key, which is the reading render_sentence/2 beside it already takes of the same declaration: a composite's params are its own config's keys, and the two derivations that read them cannot be allowed to disagree about which key a param is at.

It is overridable for sentence/1's reason - a declaration whose card wants to say something the params cannot spell says it itself.

validate_config/1 is left at ADR-0007's injected :ok, deliberately - the macro never redefines it, and the row above states what the compile guarantees rather than a generated function (ADR-0002's Note of 2026-09-07, correction 2). The refusals a param declares are declaration-level - F3's missing default:, F4's empty hidden default, and {:type_expr, opts}' allow_empty? - and the compile already runs every one of them over config_schema/1, which for a composite is the params. required? is a rendering hint and never an authority (block_type.ex, "This is a rendering hint, not the authority"), so it raises no finding here either: that is what makes the amendment's own worked example - two required?: true params defaulting to "" - land finding-free out of StatifierBlocks.Palette.new_block/2. A composite with a cross-param refusal its params cannot state as a single field's flag overrides the callback, which is why it is one of the three that may be.

emit/2 exists because the behaviour requires it and ADR-0007 deliberately injects no default for it. It raises, because the compiler expands a composite at Resolve and no composite block survives to Emit (sb-nzc1).

What a composite reads and writes

A composite's reads and writes, as the environment walk consumes them, are the union of its expanded members', each taken over that member's expanded config, at the composite's one position in the document (RQ-SF037-15, ruled 2026-09-07: shape (A)). That union is computed by StatifierBlocks.Environment.read_signatures/3 and write_signatures/3 - the same two functions, run over expand!/2's subtree - and not by io/1, which is single-valued in consumes and produces and carries no per-path read or write at all.

The derived io/1 therefore answers, per key of StatifierBlocks.Assignability.io/0:

• kinds - the members' kinds concatenated in expansion order, de-duplicated
• slot_accepts - one entry per declared pass-through slot, at the mapped inner slot's own accepted kinds; %{} for a composite that declares none, which is every composite written before RQ-SF038-5
• consumes - the expansion root's, or absent when the root declares none
• produces - the expansion root's, or absent when the root declares none

Dropping a non-root member's sugar under-declares rather than over-declares, which is the safe direction ADR-0011 decision 6 already takes.

The callbacks are core-only, and a reader with a palette is not

Both rows read a member's module, and a StatifierBlocks.Block.t/0 carries a type name. Resolving a name to a module is StatifierBlocks.Palette's job, and neither StatifierBlocks.BlockType.io/1 nor StatifierBlocks.BlockType.outcomes/1 is handed a palette - so the two callbacks resolve members through StatifierBlocks.Palette.core/0, whose types are StatifierBlocks.Palette.core_types/0, the one type map this package holds as a value. A composite whose expansion root is a host type therefore falls back in the callback: outcomes/1 to the behaviour's default outcomes, and io/1 to [:step] kinds with no sugar.

That fallback is the callbacks' answer and stays their answer (ADR-0002's Note of 2026-09-07, item 3: no @callback is added, removed or re-arity'd, and neither derivation gains a palette argument). What a reader holding a palette does instead is call io/2 and outcomes/2 below, which take the palette as their first argument and resolve every member through it - so the same composite is exact wherever a palette is in hand and takes the documented fallback only where none is.

The environment walk needs neither: it recurses into StatifierBlocks.Environment.read_signatures/3 and write_signatures/3 over the expansion, so no composite reaches its io/1 there at all.

The derived recipe

The declaration also derives a StatifierBlocks.Recipe at <Module>.Recipe, whose insert/2 returns exactly one :insert of the composite block at the armed target and whose palette_entry/0 is the block type's. One command, not the expansion: what an author puts down is the composite, and the expansion happens at compile.

It is a compatibility surface for a host that already ships the arrangement as a recipe. A composite's own palette entry is its types entry; StatifierBlocks.Palette keeps types and recipes in two maps, so a host that registers both is choosing to show two entries.