review(regression): A-reg-3 — bad-backup/bad-restore compose.yml empty (wrong tier fails); bad-install/bad-upgrade PASS cold-verified

machine-docs/REVIEW-regression.md

@@ -38,8 +38,37 @@ Output: `collected 3 items` — `test_canary[good-simple]`, `test_canary[good-si
 - OBSERVATION (non-blocking now): if consistently flaky, add bounded retries to readiness probe per
   plan policy ("bounded retries on readiness only, never on correctness assertion"). Will watch.
 
-**A-reg-2 still open** — 4 per-tier RED canaries (install/upgrade/backup/restore on
-custom-html-tiny) not yet implemented. Builder actively working on it. See BACKLOG-regression.md.
+**A-reg-2 partially addressed** — 4 per-tier RED canary tests added to suite, 7 tests collect.
+But bad-backup and bad-restore FIXTURES are broken (see A-reg-3). A-reg-2 cannot close until
+all 4 canaries actually produce the expected results.
+
+---
+
+### D-initial-2 update @2026-06-02T02:00Z — A-reg-3 filed; bad-backup/bad-restore fixtures broken
+
+4 per-tier RED canary tests now in suite (7 tests collect via cold --collect-only). SHAs verified:
+- `4ae8866100563204` (custom-html-tiny, bad image) ✓ — bad-install + bad-upgrade fixture
+- `e1e3c5fc5e2bd414` (custom-html, bad-backup) — SHA exists BUT compose.yml is empty (A-reg-3)
+- `5a481cc1f6b2a462` (custom-html, bad-restore) — SHA exists BUT compose.yml is empty (A-reg-3)
+
+**Cold-verified canary run results:**
+
+bad-install (regression-bad-install-v2): `install=fail, upgrade=na` ✓ — install tier fails as intended
+bad-upgrade (regression-bad-upgrade-v2): `install=pass, upgrade=fail, custom=skip` ✓ — upgrade tier fails as intended
+bad-backup (regression-bad-backup-1): `install=pass, upgrade=fail, backup=skip` ✗ — WRONG TIER
+
+Root cause A-reg-3: `regression-bad-backup` branch has empty compose.yml (whole file deleted, not
+just backup path changed). Empty compose → chaos upgrade deploy fails → upgrade=fail, backup never
+runs. Same issue for `regression-bad-restore` (same empty compose.yml diff).
+
+**`_assert_red_at_tier` for bad-backup would FAIL** with `expected 'backup'='fail', got 'skip'` —
+proving the fixture is broken, not the test.
+
+**What still needs fixing before final gate:**
+1. A-reg-3: Recreate bad-backup and bad-restore fixtures with correct compose.yml (only targeted change)
+2. Run bad-backup and bad-restore to confirm correct tier failures
+3. Re-run good-significant (lasuite-docs) to confirm upgrade race is transient
+4. Open PR
 
 ---