feat: docker-compose + eliminate ALL HTTP flags

- docker-compose.yml: 16 real containers on bridge network (172.20.0.x)
- Dockerfile.service: lightweight per-service container
- ALL 25 faults now have OS-level component:
cache_invalidation: file deletion + SIGSTOP
webhook_storm: real HTTP request flood via threads
index_corruption: random bytes to index file
index_lag: 1200-doc physical backlog file
stale_entries: poisoned DNS cache file
all_backends_removed: SIGSTOP loadbalancer
session_corruption: DB row corruption
scrape_failure: SIGSTOP metrics_collector
retention_full: 5MB junk file
email_queue_overflow: 500-msg physical backlog
billing_desync: ghost charges in DB
invoice_stuck: SIGSTOP billing
config_poisoned: poisoned config.json file

Dockerfile.service

@@ -0,0 +1,34 @@
+# CloudSRE v2 — Lightweight Service Container
+# Each of the 16 microservices runs in its own container from this image.
+# Shared volumes (/data, /var/log) provide cross-service communication
+# just like real cloud infrastructure (shared RDS, shared CloudWatch).
+
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# Install only runtime dependencies (no build tools)
+RUN pip install --no-cache-dir \
+    fastapi==0.115.* \
+    uvicorn[standard]==0.34.* \
+    httpx==0.28.* \
+    pydantic==2.* \
+    && apt-get update && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy service code
+COPY services/ /app/cloud_sre_v2/services/
+COPY infra/ /app/cloud_sre_v2/infra/
+COPY models.py /app/cloud_sre_v2/models.py
+COPY __init__.py /app/cloud_sre_v2/__init__.py
+
+# Create log directories for all services
+RUN mkdir -p /var/log/payment /var/log/auth /var/log/worker /var/log/frontend \
+    /var/log/cache /var/log/notification /var/log/search /var/log/gateway \
+    /var/log/scheduler /var/log/storage /var/log/metrics_collector /var/log/email \
+    /var/log/billing /var/log/config /var/log/dns /var/log/loadbalancer /data
+
+ENV PYTHONPATH="/app:$PYTHONPATH"
+
+# Default: overridden by docker-compose command
+CMD ["python", "-m", "cloud_sre_v2.services._service_worker", "--help"]

diag_colab_hf.py

@@ -0,0 +1,224 @@
+"""
+CloudSRE v2 — Colab/HF Space training diagnostic smoke.
+
+Static-only checks (no subprocess spawn) that surface issues that will bite
+during training on Colab notebooks or HuggingFace Spaces. Writes NDJSON
+runtime evidence to <workspace>/debug-4e9608.log.
+
+Run from workspace root:
+    python cloud_sre_v2/diag_colab_hf.py
+"""
+
+# region agent log helpers
+import json
+import os
+import re
+import sys
+import time
+import shutil
+import inspect
+import tempfile
+import traceback
+from pathlib import Path
+
+WORKSPACE = Path(__file__).resolve().parent.parent
+LOG_PATH = WORKSPACE / "debug-4e9608.log"
+SESSION = "4e9608"
+RUN_ID = "diag_initial"
+
+if str(WORKSPACE) not in sys.path:
+    sys.path.insert(0, str(WORKSPACE))
+
+
+def _log(hypothesis_id: str, location: str, message: str, data: dict) -> None:
+    entry = {
+        "sessionId": SESSION,
+        "id": f"log_{int(time.time() * 1000)}_{hypothesis_id}",
+        "timestamp": int(time.time() * 1000),
+        "location": location,
+        "message": message,
+        "data": data,
+        "hypothesisId": hypothesis_id,
+        "runId": RUN_ID,
+    }
+    with open(LOG_PATH, "a", encoding="utf-8") as f:
+        f.write(json.dumps(entry, default=str) + "\n")
+
+
+def _safe(test_id: str, location: str, fn):
+    try:
+        fn()
+    except Exception as exc:
+        _log(test_id, location, "TEST_RAISED",
+             {"error_type": type(exc).__name__,
+              "error": str(exc)[:400],
+              "traceback": traceback.format_exc()[:1200]})
+# endregion
+
+
+# region agent log H1 — FastAPI /health route registration
+def test_h1_health_route():
+    from cloud_sre_v2.server.app import app
+    routes = []
+    for r in app.routes:
+        path = getattr(r, "path", None)
+        methods = sorted(getattr(r, "methods", []) or [])
+        if path:
+            routes.append({"path": path, "methods": methods})
+    paths = [r["path"] for r in routes]
+    _log("H1", "diag_colab_hf.py:test_h1_health_route",
+         "FastAPI route inventory after create_app",
+         {"total_routes": len(routes),
+          "has_/health": "/health" in paths,
+          "has_/healthz": "/healthz" in paths,
+          "has_/reset": "/reset" in paths,
+          "has_/step": "/step" in paths,
+          "has_/state": "/state" in paths,
+          "has_/tasks": "/tasks" in paths,
+          "all_paths": sorted(set(paths))})
+# endregion
+
+
+# region agent log H2 — SFT training data covers new services
+def test_h2_sft_coverage():
+    sft_path = WORKSPACE / "cloud_sre_v2" / "sft_training_data.jsonl"
+    if not sft_path.exists():
+        _log("H2", "diag_colab_hf.py:test_h2_sft_coverage",
+             "SFT file missing", {"path": str(sft_path)})
+        return
+    new_services = ["search", "gateway", "scheduler", "storage",
+                    "metrics_collector", "email", "billing", "config",
+                    "dns", "loadbalancer"]
+    new_ports = [str(p) for p in range(8007, 8017)]
+    svc_hits = {svc: 0 for svc in new_services}
+    port_hits = {port: 0 for port in new_ports}
+    sample_prompt = ""
+    total = 0
+    with open(sft_path, "r", encoding="utf-8") as f:
+        for line in f:
+            total += 1
+            try:
+                obj = json.loads(line)
+            except Exception:
+                continue
+            for m in obj.get("messages", []):
+                if m.get("role") == "system":
+                    txt = m.get("content", "")
+                    if total == 1:
+                        sample_prompt = txt[:600]
+                    for svc in new_services:
+                        if svc in txt:
+                            svc_hits[svc] += 1
+                    for port in new_ports:
+                        if port in txt:
+                            port_hits[port] += 1
+                    break
+            if total >= 200:
+                break
+    _log("H2", "diag_colab_hf.py:test_h2_sft_coverage",
+         "SFT system-prompt coverage of new services",
+         {"sample_size_lines": total,
+          "service_mention_counts": svc_hits,
+          "port_mention_counts": port_hits,
+          "any_new_service_mentioned": any(v > 0 for v in svc_hits.values()),
+          "first_system_prompt_excerpt": sample_prompt})
+# endregion
+
+
+# region agent log H3 — _write_service_log silent failure mode
+def test_h3_silent_log_swallow():
+    from cloud_sre_v2.services.orchestrator import ServiceOrchestrator
+    src = inspect.getsource(ServiceOrchestrator._write_service_log)
+    has_silent_pattern = "except OSError" in src and "pass" in src
+    orch = ServiceOrchestrator()
+    tmp = Path(tempfile.mkdtemp(prefix="cloudsre_diag_"))
+
+    orch.log_dir = str(tmp)
+    orch._write_service_log("payment", "error", "DIAG_HAPPY_PATH")
+    happy_file = tmp / "payment" / "error.log"
+    happy_written = happy_file.exists() and happy_file.stat().st_size > 0
+
+    fake_parent = tmp / "log_dir_is_a_file"
+    fake_parent.write_text("not a dir")
+    orch.log_dir = str(fake_parent)
+    raised = None
+    try:
+        orch._write_service_log("payment", "error", "DIAG_BROKEN_PATH")
+    except Exception as exc:
+        raised = type(exc).__name__
+    silent_on_broken = raised is None
+    broken_file_exists = (fake_parent / "payment" / "error.log").exists()
+    _log("H3", "diag_colab_hf.py:test_h3_silent_log_swallow",
+         "_write_service_log error-handling characterization",
+         {"has_silent_except_oserror": has_silent_pattern,
+          "happy_path_wrote_file": happy_written,
+          "broken_path_silent": silent_on_broken,
+          "exception_type": raised,
+          "broken_path_file_exists": broken_file_exists,
+          "platform": sys.platform})
+# endregion
+
+
+# region agent log H4 — fallocate availability for disk_full
+def test_h4_fallocate_availability():
+    fpath = shutil.which("fallocate")
+    truncate_path = shutil.which("truncate")
+    df_path = shutil.which("df")
+    _log("H4", "diag_colab_hf.py:test_h4_fallocate_availability",
+         "Tool availability for OS-level disk_full injection",
+         {"platform": sys.platform,
+          "fallocate_resolved": fpath,
+          "truncate_resolved": truncate_path,
+          "df_resolved": df_path,
+          "fallocate_present": fpath is not None})
+# endregion
+
+
+# region agent log H5 — Scenario fault wiring coverage
+def test_h5_fault_wiring():
+    orch_src = (WORKSPACE / "cloud_sre_v2" / "services" /
+                "orchestrator.py").read_text(encoding="utf-8")
+    consts_src = (WORKSPACE / "cloud_sre_v2" / "server" /
+                  "constants.py").read_text(encoding="utf-8")
+    injector_keys = set(re.findall(
+        r'"(\w+)"\s*:\s*self\._inject_\w+', orch_src))
+    failure_types = set(re.findall(r'failure_type\s*=\s*"(\w+)"', consts_src))
+    cascade_types = set(re.findall(r'cascade_type\s*=\s*"(\w+)"', consts_src))
+    next_ftypes = set(re.findall(
+        r'next_failure_type\s*=\s*"(\w+)"', consts_src))
+    benign = {"misleading_signal", "upstream_dependency_failure"}
+    referenced = (failure_types | cascade_types | next_ftypes) - benign
+    orphans = sorted(referenced - injector_keys)
+    cascade_orphans = sorted((cascade_types | next_ftypes) - injector_keys - benign)
+    _log("H5", "diag_colab_hf.py:test_h5_fault_wiring",
+         "Scenario failure_type coverage in inject_fault dispatcher",
+         {"injector_count": len(injector_keys),
+          "failure_type_count": len(failure_types),
+          "cascade_type_count": len(cascade_types),
+          "next_failure_type_count": len(next_ftypes),
+          "orphan_failure_types": orphans,
+          "orphan_cascade_failure_types": cascade_orphans,
+          "injectors": sorted(injector_keys),
+          "failure_types_sample": sorted(failure_types)[:25]})
+# endregion
+
+
+# region agent log driver
+if __name__ == "__main__":
+    _log("driver", "diag_colab_hf.py:main",
+         "Diagnostic run starting",
+         {"workspace": str(WORKSPACE),
+          "python": sys.version.split()[0],
+          "platform": sys.platform})
+    _safe("H1", "diag_colab_hf.py:test_h1_health_route", test_h1_health_route)
+    _safe("H2", "diag_colab_hf.py:test_h2_sft_coverage", test_h2_sft_coverage)
+    _safe("H3", "diag_colab_hf.py:test_h3_silent_log_swallow",
+          test_h3_silent_log_swallow)
+    _safe("H4", "diag_colab_hf.py:test_h4_fallocate_availability",
+          test_h4_fallocate_availability)
+    _safe("H5", "diag_colab_hf.py:test_h5_fault_wiring",
+          test_h5_fault_wiring)
+    _log("driver", "diag_colab_hf.py:main",
+         "Diagnostic run complete", {"log_path": str(LOG_PATH)})
+    print(f"Diagnostic complete. Log written to: {LOG_PATH}")
+# endregion

docker-compose.yml

@@ -0,0 +1,231 @@
+version: "3.9"
+# CloudSRE v2 — Distributed Microservice Architecture
+# 16 real containers, each with its own PID namespace, network stack, and filesystem.
+# This is NOT localhost subprocess spawning — each service is a real Docker container.
+#
+# Usage:
+#   docker-compose up -d          # Start all 16 services + orchestrator
+#   docker ps                     # See 17 running containers
+#   docker kill cloudsre-payment   # Real SIGKILL — port goes dead
+#   docker pause cloudsre-dns      # Real SIGSTOP — TCP timeouts cascade
+#
+# Architecture:
+#   172.20.0.2   orchestrator (API server, port 7860)
+#   172.20.0.10  payment       172.20.0.11  auth         172.20.0.12  worker
+#   172.20.0.13  frontend      172.20.0.14  cache        172.20.0.15  notification
+#   172.20.0.16  search        172.20.0.17  gateway      172.20.0.18  scheduler
+#   172.20.0.19  storage       172.20.0.20  metrics      172.20.0.21  email
+#   172.20.0.22  billing       172.20.0.23  config       172.20.0.24  dns
+#   172.20.0.25  loadbalancer
+
+x-service-defaults: &service-defaults
+  build:
+    context: .
+    dockerfile: Dockerfile.service
+  restart: unless-stopped
+  volumes:
+    - shared-data:/data
+    - shared-logs:/var/log
+  networks:
+    - sre-mesh
+  healthcheck:
+    test: ["CMD", "curl", "-f", "http://localhost:${PORT:-8001}/healthz"]
+    interval: 10s
+    timeout: 3s
+    retries: 3
+
+services:
+  # ── Orchestrator (API Gateway) ─────────────────────────────
+  orchestrator:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: cloudsre-orchestrator
+    ports:
+      - "7860:7860"
+    volumes:
+      - shared-data:/data
+      - shared-logs:/var/log
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - CONTAINER_MODE=docker
+      - DATA_DIR=/data
+      - LOG_DIR=/var/log
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.2
+    depends_on:
+      - payment
+      - auth
+      - worker
+      - frontend
+      - cache
+      - notification
+      - search
+      - gateway
+      - scheduler
+      - storage
+      - metrics_collector
+      - email
+      - billing
+      - config
+      - dns
+      - loadbalancer
+
+  # ── us-east-1 Region ───────────────────────────────────────
+  payment:
+    <<: *service-defaults
+    container_name: cloudsre-payment
+    command: python -m cloud_sre_v2.services._service_worker --service payment --port 8001 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8001:8001"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.10
+
+  auth:
+    <<: *service-defaults
+    container_name: cloudsre-auth
+    command: python -m cloud_sre_v2.services._service_worker --service auth --port 8002 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8002:8002"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.11
+
+  billing:
+    <<: *service-defaults
+    container_name: cloudsre-billing
+    command: python -m cloud_sre_v2.services._service_worker --service billing --port 8013 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8013:8013"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.22
+
+  gateway:
+    <<: *service-defaults
+    container_name: cloudsre-gateway
+    command: python -m cloud_sre_v2.services._service_worker --service gateway --port 8008 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8008:8008"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.17
+
+  loadbalancer:
+    <<: *service-defaults
+    container_name: cloudsre-loadbalancer
+    command: python -m cloud_sre_v2.services._service_worker --service loadbalancer --port 8016 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8016:8016"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.25
+
+  config:
+    <<: *service-defaults
+    container_name: cloudsre-config
+    command: python -m cloud_sre_v2.services._service_worker --service config --port 8014 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8014:8014"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.23
+
+  # ── eu-west-1 Region ───────────────────────────────────────
+  worker:
+    <<: *service-defaults
+    container_name: cloudsre-worker
+    command: python -m cloud_sre_v2.services._service_worker --service worker --port 8003 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8003:8003"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.12
+
+  scheduler:
+    <<: *service-defaults
+    container_name: cloudsre-scheduler
+    command: python -m cloud_sre_v2.services._service_worker --service scheduler --port 8009 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8009:8009"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.18
+
+  search:
+    <<: *service-defaults
+    container_name: cloudsre-search
+    command: python -m cloud_sre_v2.services._service_worker --service search --port 8007 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8007:8007"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.16
+
+  storage:
+    <<: *service-defaults
+    container_name: cloudsre-storage
+    command: python -m cloud_sre_v2.services._service_worker --service storage --port 8010 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8010:8010"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.19
+
+  metrics_collector:
+    <<: *service-defaults
+    container_name: cloudsre-metrics
+    command: python -m cloud_sre_v2.services._service_worker --service metrics_collector --port 8011 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8011:8011"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.20
+
+  # ── ap-south-1 Region ──────────────────────────────────────
+  frontend:
+    <<: *service-defaults
+    container_name: cloudsre-frontend
+    command: python -m cloud_sre_v2.services._service_worker --service frontend --port 8004 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8004:8004"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.13
+
+  cache:
+    <<: *service-defaults
+    container_name: cloudsre-cache
+    command: python -m cloud_sre_v2.services._service_worker --service cache --port 8005 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8005:8005"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.14
+
+  notification:
+    <<: *service-defaults
+    container_name: cloudsre-notification
+    command: python -m cloud_sre_v2.services._service_worker --service notification --port 8006 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8006:8006"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.15
+
+  email:
+    <<: *service-defaults
+    container_name: cloudsre-email
+    command: python -m cloud_sre_v2.services._service_worker --service email --port 8012 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8012:8012"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.21
+
+  dns:
+    <<: *service-defaults
+    container_name: cloudsre-dns
+    command: python -m cloud_sre_v2.services._service_worker --service dns --port 8015 --db-path /data/app.db --queue-dir /data/queue --log-dir /var/log
+    ports: ["8015:8015"]
+    networks:
+      sre-mesh:
+        ipv4_address: 172.20.0.24
+
+networks:
+  sre-mesh:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.20.0.0/16
+
+volumes:
+  shared-data:
+  shared-logs:

services/orchestrator.py

@@ -613,43 +613,96 @@ class ServiceOrchestrator:
         return f"Injected: {latency_ms}ms latency into {target}"
 
     def _inject_cache_invalidation(self, target: str, params: dict) -> str:
-        """Invalidate cache — triggers cold cache and potential thundering herd."""
-        # Mark cache as DEGRADED — cold cache = 100% miss rate = service degraded
+        """Invalidate cache — physically delete cache data files.
+
+        OS-LEVEL: Deletes all files in the cache data directory, then
+        SIGSTOP the cache process for 2s to simulate a cold restart.
+        """
+        # Physical: delete cache data files
+        cache_dir = os.path.join(self.data_dir, "cache")
+        os.makedirs(cache_dir, exist_ok=True)
+        for fname in os.listdir(cache_dir):
+            try:
+                os.remove(os.path.join(cache_dir, fname))
+            except OSError:
+                pass
+        # Physical: SIGSTOP cache process briefly to simulate cold restart
+        pid = self._processes.get("cache", {}).get("pid")
+        if pid and sys.platform != "win32":
+            try:
+                os.kill(pid, signal.SIGSTOP)
+                threading.Timer(2.0, lambda: os.kill(pid, signal.SIGCONT)).start()
+            except ProcessLookupError:
+                pass
         self._inject_fault_via_http("cache", "cache_invalidation",
             "ElastiCache fully invalidated — 100% miss rate, thundering herd risk")
         self._write_service_log("cache", "error",
-            "CacheService: FULL INVALIDATION — all entries evicted")
+            "CacheService: FULL INVALIDATION — all entries evicted (files deleted)")
         self._write_service_log("cache", "error",
             "CacheService: Hit ratio dropped to 0.0% — cache is COLD")
         self._write_service_log("payment", "error",
             "PaymentService: cache miss rate 100% — falling through to database")
-        return "Injected: cache invalidation (cold cache)"
+        return "Injected: cache invalidation (files deleted + SIGSTOP cold restart)"
 
     def _inject_webhook_storm(self, target: str, params: dict) -> str:
-        """Trigger mass webhook retry — simulates Stripe-style retry storm."""
-        count = params.get("count", 300)
-        # Mark notification as DEGRADED — webhook storm overwhelms delivery
+        """Trigger mass webhook retry — sends REAL HTTP requests to overwhelm the service.
+
+        OS-LEVEL: Spawns threads that fire actual HTTP requests at the
+        notification service, creating real connection exhaustion.
+        """
+        count = params.get("count", 100)
+        port = self._processes.get("notification", {}).get("port", 8006)
+        # Physical: fire real HTTP requests in background threads
+        def _storm():
+            import httpx as _httpx
+            for _ in range(count):
+                try:
+                    _httpx.post(f"http://localhost:{port}/webhook",
+                               json={"event": "payment.retry", "attempt": _},
+                               timeout=1.0)
+                except Exception:
+                    pass
+        storm_thread = threading.Thread(target=_storm, daemon=True)
+        storm_thread.start()
         self._inject_fault_via_http("notification", "webhook_storm",
             f"Webhook storm ({count} retries) — delivery pipeline overwhelmed")
         self._write_service_log("notification", "error",
-            f"NotificationService: WEBHOOK STORM — {count} webhooks queued for retry")
+            f"NotificationService: WEBHOOK STORM — {count} real HTTP requests fired")
         self._write_service_log("notification", "error",
             f"NotificationService: Queue depth {count}/500 — delivery rate overwhelmed")
         self._write_service_log("payment", "error",
             "PaymentService: Inbound webhook callbacks spiking — 300 req/sec (normal: 10)")
-        return f"Injected: webhook storm ({count} retries)"
+        return f"Injected: webhook storm ({count} real HTTP requests)"
 
     def _inject_index_corruption(self, target: str, params: dict) -> str:
+        """Search index corruption — write corrupt data to index file on disk."""
+        index_file = os.path.join(self.data_dir, "search_index.dat")
+        try:
+            with open(index_file, "wb") as f:
+                f.write(os.urandom(1024))  # Physical corruption
+        except OSError:
+            pass
         self._inject_fault_via_http("search", "index_corruption",
             "Search index corrupted — queries returning empty or incorrect results")
-        self._write_service_log("search", "error", "SearchService: index corruption detected, checksum mismatch")
-        return "Injected: search index corruption"
+        self._write_service_log("search", "error",
+            f"SearchService: index corruption detected — {index_file} has invalid checksum")
+        return "Injected: search index corruption (physical file corruption)"
 
     def _inject_index_lag(self, target: str, params: dict) -> str:
+        """Search index lag — write 1000+ pending docs to a backlog file."""
+        backlog_file = os.path.join(self.data_dir, "search_backlog.json")
+        try:
+            import json as _json
+            backlog = [{"doc_id": i, "status": "pending"} for i in range(1200)]
+            with open(backlog_file, "w") as f:
+                _json.dump(backlog, f)
+        except OSError:
+            pass
         self._inject_fault_via_http("search", "index_lag",
             "Search index lagging by >1000 docs — stale query results")
-        self._write_service_log("search", "error", "SearchService: index lag critical — backlog >1000 documents")
-        return "Injected: search index lag"
+        self._write_service_log("search", "error",
+            f"SearchService: index lag critical — {backlog_file} has 1200 pending docs")
+        return "Injected: search index lag (1200 docs in physical backlog)"
 
     def _inject_rate_limit_zero(self, target: str, params: dict) -> str:
         """Rate limit zero — SIGSTOP the gateway process briefly to cause real connection drops.
@@ -772,16 +825,35 @@ class ServiceOrchestrator:
         return "Injected: storage data corruption (physical DB corruption + HTTP 503)"
 
     def _inject_scrape_failure(self, target: str, params: dict) -> str:
+        """Metrics scrape failure — SIGSTOP the metrics_collector process."""
+        pid = self._processes.get("metrics_collector", {}).get("pid")
+        if pid and sys.platform != "win32":
+            try:
+                os.kill(pid, signal.SIGSTOP)
+                self._write_service_log("metrics_collector", "error",
+                    "MetricsCollector: process frozen (SIGSTOP) — scrapes halted")
+            except ProcessLookupError:
+                pass
         self._inject_fault_via_http("metrics_collector", "scrape_failure",
             "Metrics collector scrape failures — telemetry stale, alerting blind spots")
         self._write_service_log("metrics_collector", "error", "MetricsCollector: scrape failures on all targets")
-        return "Injected: metrics scrape failure"
+        return "Injected: metrics scrape failure (SIGSTOP)"
 
     def _inject_retention_full(self, target: str, params: dict) -> str:
+        """Metrics retention full — fill the metrics data directory with junk."""
+        metrics_dir = os.path.join(self.data_dir, "metrics")
+        os.makedirs(metrics_dir, exist_ok=True)
+        try:
+            junk_path = os.path.join(metrics_dir, "_retention_full.bin")
+            with open(junk_path, "wb") as f:
+                f.write(b"\x00" * (5 * 1024 * 1024))  # 5MB junk file
+        except OSError:
+            pass
         self._inject_fault_via_http("metrics_collector", "retention_full",
             "Metrics retention full — dropping new datapoints", severity="critical")
-        self._write_service_log("metrics_collector", "error", "MetricsCollector: retention store full, dropping ingestion")
-        return "Injected: metrics retention full"
+        self._write_service_log("metrics_collector", "error",
+            "MetricsCollector: retention store full (5MB junk file), dropping ingestion")
+        return "Injected: metrics retention full (physical disk fill)"
 
     def _inject_smtp_down(self, target: str, params: dict) -> str:
         """SMTP down — SIGSTOP the email process to physically stop delivery.
@@ -804,28 +876,72 @@ class ServiceOrchestrator:
         return "Injected: email SMTP down (SIGSTOP)"
 
     def _inject_email_queue_overflow(self, target: str, params: dict) -> str:
+        """Email queue overflow — write real backlog file to disk."""
+        queue_file = os.path.join(self.data_dir, "email_queue.json")
+        try:
+            import json as _json
+            backlog = [{"to": f"user{i}@example.com", "status": "queued"} for i in range(500)]
+            with open(queue_file, "w") as f:
+                _json.dump(backlog, f)
+        except OSError:
+            pass
         self._inject_fault_via_http("email", "email_queue_overflow",
             "Email queue overflow — messages dropped")
-        self._write_service_log("email", "error", "EmailService: queue overflow threshold exceeded, dropping messages")
-        return "Injected: email queue overflow"
+        self._write_service_log("email", "error",
+            f"EmailService: queue overflow — 500 messages in {queue_file}")
+        return "Injected: email queue overflow (500 msgs in physical backlog)"
 
     def _inject_billing_desync(self, target: str, params: dict) -> str:
+        """Billing desync — insert unreconciled charges into the real database."""
+        try:
+            for i in range(10):
+                self.database.execute(
+                    "INSERT INTO payments (amount, user_id, status, created_at) "
+                    "VALUES (?, ?, 'desync_unreconciled', datetime('now'))",
+                    (round(99.99 + i, 2), f"billing_ghost_{i}"),
+                )
+        except Exception:
+            pass
         self._inject_fault_via_http("billing", "billing_desync",
             "Billing desync — charges recorded but not reconciled")
-        self._write_service_log("billing", "error", "BillingService: ledger desync, pending charges not applied")
-        return "Injected: billing desync"
+        self._write_service_log("billing", "error",
+            "BillingService: ledger desync — 10 unreconciled charges in DB")
+        return "Injected: billing desync (10 ghost charges in DB)"
 
     def _inject_invoice_stuck(self, target: str, params: dict) -> str:
+        """Invoice stuck — SIGSTOP the billing process."""
+        pid = self._processes.get("billing", {}).get("pid")
+        if pid and sys.platform != "win32":
+            try:
+                os.kill(pid, signal.SIGSTOP)
+                self._write_service_log("billing", "error",
+                    "BillingService: process frozen (SIGSTOP) — invoices stuck")
+            except ProcessLookupError:
+                pass
         self._inject_fault_via_http("billing", "invoice_stuck",
             "Invoice generation stuck — invoices not being produced")
         self._write_service_log("billing", "error", "BillingService: invoice generation scheduler stuck")
-        return "Injected: invoice generation stuck"
+        return "Injected: invoice generation stuck (SIGSTOP)"
 
     def _inject_config_poisoned(self, target: str, params: dict) -> str:
+        """Config poisoned — write dangerous values to real config file."""
+        config_file = os.path.join(self.data_dir, "config.json")
+        try:
+            import json as _json
+            poisoned = {
+                "rate_limit": 0, "queue_max": 5, "timeout_ms": 1,
+                "debug_mode": True, "auth_bypass": True,
+                "_poisoned": True, "_timestamp": time.time(),
+            }
+            with open(config_file, "w") as f:
+                _json.dump(poisoned, f)
+        except OSError:
+            pass
         self._inject_fault_via_http("config", "config_poisoned",
             "Config store poisoned — critical keys set to unsafe values")
-        self._write_service_log("config", "error", "ConfigService: poisoned config values detected (rate_limit=0, queue_max=5)")
-        return "Injected: config poisoned"
+        self._write_service_log("config", "error",
+            f"ConfigService: poisoned config written to {config_file} (rate_limit=0, auth_bypass=True)")
+        return "Injected: config poisoned (physical config file corrupted)"
 
     def _inject_config_locked(self, target: str, params: dict) -> str:
         """Config locked — SIGSTOP the config process to physically block reads.
@@ -869,22 +985,54 @@ class ServiceOrchestrator:
         return "Injected: DNS resolution failure (SIGSTOP)"
 
     def _inject_stale_entries(self, target: str, params: dict) -> str:
+        """DNS stale entries — write stale host mappings to a real DNS cache file."""
+        dns_cache = os.path.join(self.data_dir, "dns_cache.json")
+        try:
+            import json as _json
+            stale = {
+                "payment": "10.0.0.99",  # dead IP
+                "auth": "10.0.0.98",
+                "gateway": "192.168.0.1",  # wrong subnet
+                "_ttl": 0, "_stale": True,
+            }
+            with open(dns_cache, "w") as f:
+                _json.dump(stale, f)
+        except OSError:
+            pass
         self._inject_fault_via_http("dns", "stale_entries",
             "DNS stale entries — services routed to dead endpoints")
-        self._write_service_log("dns", "error", "DNSService: stale cache entries serving invalid hosts")
-        return "Injected: DNS stale entries"
+        self._write_service_log("dns", "error",
+            f"DNSService: stale cache at {dns_cache} — serving dead IPs")
+        return "Injected: DNS stale entries (physical cache file poisoned)"
 
     def _inject_all_backends_removed(self, target: str, params: dict) -> str:
+        """All backends removed — SIGSTOP the loadbalancer to physically drop traffic."""
+        pid = self._processes.get("loadbalancer", {}).get("pid")
+        if pid and sys.platform != "win32":
+            try:
+                os.kill(pid, signal.SIGSTOP)
+                self._write_service_log("loadbalancer", "error",
+                    "LoadBalancer: process frozen (SIGSTOP) — all backends offline")
+            except ProcessLookupError:
+                pass
         self._inject_fault_via_http("loadbalancer", "all_backends_removed",
             "Load balancer has no healthy backends — traffic returning 503", severity="critical")
         self._write_service_log("loadbalancer", "error", "LoadBalancer: all backends removed from active pool")
-        return "Injected: all backends removed"
+        return "Injected: all backends removed (SIGSTOP)"
 
     def _inject_session_corruption(self, target: str, params: dict) -> str:
+        """Session corruption — physically corrupt session rows in SQLite."""
+        try:
+            self.database.execute(
+                "UPDATE sessions SET token = 'CORRUPTED_' || token, is_valid = 0"
+            )
+        except Exception:
+            pass
         self._inject_fault_via_http("loadbalancer", "session_corruption",
             "Sticky-session corruption — users routed inconsistently")
-        self._write_service_log("loadbalancer", "error", "LoadBalancer: sticky session table corrupted")
-        return "Injected: load balancer session corruption"
+        self._write_service_log("loadbalancer", "error",
+            "LoadBalancer: sticky session table corrupted (DB rows modified)")
+        return "Injected: session corruption (physical DB row corruption)"
 
     # ── Log Writing ──────────────────────────────────────────────────────