[P2] correctness roundup: backup compare row counts, cron substring over-match, remote:init branch, logs -f interrupt, install.sh tag reset, set -u guards

[gfargo]

Problem

A batch of independently-verified smaller correctness defects across subsystems.

Evidence

1. backup compare row counts are wrong (backup/compare.sh:241-246): the subquery counts pg_class catalog entries (≈1), not table rows — every table prints "1 vs 1 ✓". Use pg_stat_user_tables.n_live_tup or per-table count(*). (Also hardcodes container names ignoring BACKUP_*_SERVICE, and the advertised --service flag is parsed but unused.)
2. Cron install/remove over-matches sibling stacks by substring (drift/schedule.sh:35,69; drift/autofix.sh:81,142): grep -q "drift monitor.*$stack" matches api inside api-v2 — installing for api says "already exists"; enabling auto-fix for api removes api-v2's job. Anchor on the full log path or a # strut:drift-<stack> tag.
3. remote:init ignores DEFAULT_BRANCH (cmd_remote_init.sh:46 sets branch="main", making :79's ${branch:-${DEFAULT_BRANCH:-main}} dead) → a master project clones/leaves main, and subsequent release/sync hard-reset to the wrong branch. Initialize branch="".
4. logs -f interrupt reports a false SSH error (cmd_logs.sh:63 → utils.sh:987): Ctrl-C on a followed remote log makes ssh exit 130 → the caller's || fail "Remote command failed — check VPS_HOST…". Treat rc 130/143 as clean for follow mode.
5. install.sh breaks on tag pins on re-run (install.sh:76-77): git reset --hard origin/$STRUT_BRANCH fails when STRUT_BRANCH is a release tag (which action.yml recommends) on an existing clone. Use FETCH_HEAD.
6. [ -z "$RED" ] guards abort under set -u (drift.sh:11, drift/alerts.sh:10, autofix.sh:10, schedule.sh:10): the guard exists for the case utils.sh wasn't sourced, but $RED is then unbound → set -u aborts before the fallback. Use ${RED:-}.

Acceptance

• Each item resolved with a targeted fix; ideally a regression test for feat: pluggable reverse proxy support (nginx + caddy) #1 and Expand test coverage for untested modules (backup, drift, keys, migrate, monitoring) #2.

---

Filed from the 2026-07-12 full-codebase audit (docs/AUDIT-2026-07-12.md).