The block editor: the only stateful module in the package's rendered half (ADR-0005 decisions 6, 8, 9, 13).

Everything this component does is translation. Every author gesture reduces to one of the four commands StatifierBlocks.Edit defines, and the mutation, its inverse and the set of places a block may be dropped are all pure functions of {document, palette} that were tested with LiveView absent from the dependency tree. What is left here is turning a phx- event into a command, offering it to StatifierBlocks.Edit.History, and re-rendering.

That split is the single most load-bearing constraint in ADR-0005, and the reason is drag-and-drop specifically: it is the interaction most likely to be tested by clicking around and declared fine, and the one most likely to corrupt a document when it is wrong. If the semantics of a drag lived here, they would be testable only through a browser driver.

The drag, in two round-trips

dragstart pushes one event. Edit.Targets.slot_verdicts/3 runs once, the result goes into the drag session, and the re-render stamps data-drop on every slot - so every valid target highlights before the pointer has moved, and hover costs nothing. drop pushes the position, one :move is built and applied, and the tree re-renders. dragend clears the session. There is no third round-trip and no client-side validity logic.

That one enumeration answers both halves of the drag. The accepting slots are data-drop; the refusing ones that have a data-flow reason to give (the 2026-08-29 ADR-0003 amendment's vocabulary) carry it as data-drop-reason beside it, so a later hover affordance has the reason already in the markup and still needs no round-trip and no JavaScript. The host's widening relation reaches all of this the way ADR-0003 decision 6 says it does and the way nothing else could: through palette.assignability, consulted by the one Assignability the compiler's validate/3 consults.

Config, and the gate that keeps the document sound

ADR-0002 decision 6 guarantees slots/1 returns without raising only for config validate_config/1 accepts - and an author halfway through typing an identifier has invalid config almost continuously. So an :update_config reaches the document only when it validates, which Edit.check_config/3 enforces inside History.commit/4.

In-progress form state that does not validate lives in this component's drafts assign: never in the document, never on the undo stack. It is overlaid onto the selected block's form at render time - values and findings both - so the author keeps their keystrokes and sees findings about the value they are currently typing, while the tree, the slot set and every consumer downstream still see the last config that validated. Crucially, the overlay never calls slots/1: it touches the form and nothing else, which is what keeps the draft from reaching a callback that was only promised valid config.

The datamodel, and why it is one assign and no logic

A host may hand the editor the datamodel paths it declares. The only thing that buys is the undeclared-path advisory ADR-0005 amendment 11e-11g specifies: a config field a block type annotated datamodel_path?: true whose value is not in that set gets an :info finding anchored on the field. The rule itself is StatifierBlocks.Datamodel's and is pure, so it is tested with LiveView absent; what happens here is one normalization on update/3 and one concatenation in rebuild/1, which is the same translation-only posture as everything else in this module.

nil is the default and means no datamodel supplied, which per 11f produces nothing anywhere - the check does not run at all. That is not the same as an empty set, which is a host declaring that its documents address nothing.

What stays the host's

Which palette entries a tenant may use, who may edit or publish a document, where it is stored, and what publishing means are all outside this package (decision 15).

The 2026-08-29 shell amendment's ruling 8A adds two more, and names the seam for each: slots for markup, events for actions. The outer header - document identity, the document switcher, the theme control, compile and publish - is the :header slot, because markup is exactly the thing a host wants to own and a slot costs this package no API surface. The drawer's height is on_drawer_resize out and drawer_height back in, because the height is remembered per viewer and this package has no viewer. A host that renders its own publish button into the slot and receives the press as its own event is the intended shape; the editor draws no header of its own and is not waiting for permission to. So is concurrency: this is a single-session component, it surfaces the revision it loaded so a host can do optimistic concurrency on save, and it does not merge, rebase or resolve anything.

Assigns