Mark, if you do, be sure to make a copy of the object instead of storing a pointer... and if the compositeData includes any component or data source references, be sure to store a primitive-based alternative (i.e. just the data source variable or form / view name, component id / client id, etc.). Part of the renderResponse phase is serialization of the View, including the viewScope, so any objects you store in the viewScope need to be serializable.
By the way, we've learned a lot more just in the last couple weeks about what exactly takes place in the various JSF phases of the XPage lifecycle, and without delving too deep into the nuts and bolts of it, the reason the compositeData is only available in certain phases is because of the way that the UIIncludeComposite class adds all of the core components defined in the custom control to the component tree.
A similar, though slightly different issue is a minor timing complication with repeat controls: I had wondered for years why it seemed the only property of a repeat control that could not be set to a value binding via a theme is its value attribute... but over the last week, the reason became obvious. A repeat's value attribute determines what collection it will iterate, and the runtime must calculate that before it applies themes, otherwise all the component instances inside the repeat would be skipped when the theme properties are applied... each of those components is only specified once in the source XML, but a separate set of them must be added to the component tree for each instance of the collection, and by the time themes are applied, that process has already occurred, so the repeat itself no longer exists, except as basically a div that contains all of the child components (not even that, if you've specified that the repeat should be removed).
So your issue is similar: a custom control defines zero or more core controls (and zero or more other custom controls) that should be added to the component tree at runtime. By the time it's ready to render the response, that process is already complete, so the compositeData - the map used to tell the custom control how to add those child controls to the tree - is considered no longer needed.