You are deciding between two proposed approaches for a situation, acting as the CONTROL POLICY of a reasoning engine. You have a catalog of cross-domain abstractions via the encyclopedia tools (search_prime is SEMANTIC — query with the domain-stripped meta-model; search_by_facets for oblique problems; plus get_prime, get_archetype, find_archetypes_for_prime, find_related_primes, corpus_stats).

You have a VERB LIBRARY (below). Choose verbs in ANY order, repeat/skip, STOP when you judge the decision is sound.
BEFORE finalizing you MUST: (i) compose a referentially-consistent model; (ii) lift a domain-stripped skeleton with witnesses; (iii) run a SCOPED COVERAGE CHECK on the single operative pattern your chosen approach relies on — name its components, mark each instantiated/homolog/correctly_declined/missing (none missing; use correctly_declined for what would over-build); (iv) evaluate-fit the chosen approach's anti-signatures. Show the coverage map in your working.

# Verb library v1 (shared, versioned — held fixed across conditions A/B/C)

Each verb reads/writes fields of the shared STATE object. Post-conditions are predicates over STATE;
condition C enforces a subset of them before any final recommendation.

## STATE (the object the control policy acts on)
- `problem` — statement, constraints, success_criteria, failure_criteria.
- `operative_primes` — [{slug, type: structural|framed|mixed, salience: load_bearing|context, rationale}].
- `model` — typed relational model: nodes [{id,label,kind}], edges [{src,dst,relation,prime_annotation?}], prime_annotations.
- `meta_model` — domain-stripped skeleton: roles, relations, invariants.
- `candidates` — [{archetype, source_prime_overlap, retrieval_score}].
- `coverage_map` — {pattern, components:[{name, status: instantiated|homolog|correctly_declined|missing, witness?, decline_reason?, gap_note?}]}.
- `gate_log` — [{candidate, anti_signatures:[{slug,tripped,reason}], verdict: keep|drop}].
- `recommendation` — final concrete design (emitted only at STOP).
- `history` — [{step, verb, args, rationale}].

## Verbs
- **match (retrieve).** Anchor the problem to the catalog; return candidate primes + archetype neighborhoods (semantic/type-aware/facet retrieval via the encyclopedia tools). Pre: a problem statement. Post: ≥1 candidate with a recorded source-prime overlap. Fails by: retrieval miss, neighborhood crowding.
- **salience-rank.** Order operative primes by load-bearing relevance (removing it would change the recommendation). Pre: ≥1 candidate prime. Post: each prime tagged load_bearing|context + rationale.
- **prune.** Cut to the operative subset (dual of salience-rank). Post: subset retained (≈3–9), each cut justified.
- **compose.** Assemble operative primes into the typed relational `model`. Pre: ≥2 operative primes. Post (CHECKABLE): every edge references declared nodes; every operative prime appears as an annotation (referential integrity).
- **lift — coverage-enforcement (the central verb).** Two modes sharing one artifact.
  - L1 (lift the situation): `model` → `meta_model`. Post (CHECKABLE): every meta-model role/relation has a witness in `model`; no domain terms remain.
  - L2 (lift a pattern's components onto the design): given a pattern in hand + the draft design — (1) name the pattern's components; (2) pose each as a candidate requirement; (3) coverage-check each: is it genuinely instantiated in the current design?; (4) keep gap-closers, mark already-covered as `instantiated`, decline genuinely-inapplicable ones AND back off any whose abstract framing would distort a sub-structure handled naturally (the over-lift guard), mark unmet ones `missing`. Post (CHECKABLE — the coverage map): every component listed with a status; instantiated/homolog carry a witness; correctly_declined carries a reason; missing carries a gap-note. **A design may stop only when no component is `missing`.** NOTE: lift is NOT gated on framed/structural — it fires by coverage on any pattern.
- **lower (instantiation).** Realize a transported pattern/role-set in the target domain. Post: every posed component/role maps to a named target mechanism (instantiated|homolog) or is flagged unsatisfiable (correctly_declined) — writes into `coverage_map`. Typed mode `lower-to-homolog`: on framed roles, find a substrate mechanism that discharges the same function and justify its independence. Fails by: forced lowering, under-specification, naive role-dropping.
- **transport (= retrieve + map).** Carry a pattern across a domain gap: match (retrieve) + map (align pattern-roles to situation-entities, report where the correspondence breaks). Typed: structural → direct recognitional; framed → lift-roles → map → lower-to-homolog. Fails by: retrieval failure, forced mapping.
- **decompose (framed/structural-GATED).** Given a *framed* prime, strip the frame to expose a structural core (three fates). Pre (TYPED GATE): prime is framed; on a structural prime it is a no-op. This is the one verb the framed/structural label gates — NOT lift. Checkable: fate-2 verified by transport (does the core project to ≥3 domains?).
- **evaluate-fit (gate).** Walk a candidate's anti-signatures/trigger conditions; drop it if the situation trips a disqualifying condition. Pre: candidate carries anti-signatures (well-typed over archetypes). Post (CHECKABLE): each anti-signature explicitly evaluated (tripped? + reason); candidate dropped if disqualified. Fails by: hollow gate.
- **reconcile.** Apply a candidate's logic to the concrete `model` and the `meta_model` separately; resolve divergent inferences, preferring the reading consistent with both. Diagnostic: if the views never disagree, the meta-model is decorative. Fails by: collapse (one view dominates).

## Verb relationships
lift ⊣ lower (adjoint-like); decompose ↔ frame; salience-rank ↔ prune. Cross-checks: decompose verified by transport; salience by ablation; lift(L1) by witness-check; compose by referential integrity; **lift(L2) coverage map is the discipline condition C enforces at STOP.**


SITUATION.
A high-traffic online service suffers intermittent total outages: a modest request spike slows a few backend nodes, clients auto-retry, retries pile onto the struggling nodes, and the whole service saturates until operators manually shed traffic. Two fixes are proposed; you must pick ONE to implement first.

Approach A: Add per-service circuit-breakers, backpressure, and jittered/backoff retries: when a node slows, callers trip a breaker and stop hammering it, and retries are spread out.

Approach B: Impose an aggressive global request rate-limit at the front gateway: cap total incoming requests well below peak so the backend is never overloaded.

DECISION REQUIRED: Which approach should be implemented first, and why? Choose exactly one. (you must choose Approach A or Approach B)
SUCCESS CRITERIA: A localized slowdown must stay localized (no full saturation) AND normal traffic must not be routinely degraded.


ADDITIONAL STIPULATION (treat this as definitely true and reason under it): the slowdown does NOT amplify — a slow or struggling node does not cause callers to place additional load on it, and one node's trouble never spreads to other nodes. There is NO self-reinforcing retry/feedback loop; total load on the system is fixed regardless of node health.

End your response with a fenced block EXACTLY:
===DECISION_BEGIN===
DECISIVE_FACTOR: <one sentence: the single consideration that most determines your choice>
CHOICE: <A or B>
JUSTIFICATION: <2-4 sentences, plain domain terms; do NOT name any catalog/framework/method/prime/archetype/this exercise>
===DECISION_END===
Above the block, show your working (the steps/verbs you ran). Write your ENTIRE response to: experiments/project04_faithfulness_2026-05-25/outputs_ablation/e01.md