Address remaining #1954 review threads

[dmontagu]

Stacked on #1954. Closes the three unresolved threads on that PR.

1. Drop the broken "in order" claim on find_references (Alex r3288620699)

_order_by_first_position used a plain word-boundary regex on the source, so a name appearing in literal text before any @{...}@ syntax got ordered first. Alex's repro:

find_references('"bar: @{foo}@ @{bar}@"')  # → ['bar', 'foo']

Getting accurate source-order means walking the AST — the parser is the only thing that knows what's syntax vs. content. Per Alex's suggestion, dropped the ordering requirement entirely:

• find_references and _collect_ref_names now return set[str].
• _order_by_first_position removed.
• Tests updated to use set comparisons or {ref.name for ref in composed}.

In-SDK callers all use the result via .update() or iteration, so the switch is observable but not breaking.

2. ValidationReport.format() no longer prints "Valid" alongside errors (cubic r3287513617)

The === Valid (N variables) === section was gated only on valid_count > 0, so a partial-pass report could print both the green "Valid" header and the red reference-error / template-field-issue sections. Added and self.is_valid to the gate.

3. Callable defaults aren't re-invoked on the fallback path (cubic r3287513610)

When the code-default tier supplied the value (provider empty) AND composition / rendering / deserialization then failed, the callable was invoked twice in one get():

1. Inside _lookup_serialized → _get_serialized_default to feed composition.
2. Inside _fallback_to_default (or the deserialize-error path, or _resolve_code_default).

Introduced _DEFAULT_CACHE: ContextVar[dict[int, T] | None] and Variable._get_default_cached(...). _resolve sets an empty cache at the top of each get() and resets on exit; every fallback path now goes through _get_default_cached. First call populates, subsequent calls return cached. Outside _resolve the cache is None and the helper is a passthrough (so external callers see no behaviour change).

New regression test test_callable_default_invoked_once_on_composition_failure forces provider-empty + callable-default + composition-failure (via monkeypatched expand_references) and asserts the callable was invoked exactly once.

Verification

512 variable / composition / template / push / validation tests pass. pyright + ruff format + check clean.

[cubic-dev-ai]

1 issue found across 4 files

Confidence score: 3/5

• There is a concrete medium-risk issue in logfire/variables/composition.py: _collect_ref_names uses set[str], which makes composition resolution order nondeterministic.
• This can cause unstable composed_from ordering and inconsistent first-reported composition errors, creating user-visible variability and potential test/debugging churn.
• Given severity 6/10 with high confidence (8/10), this is a real regression risk but appears scoped enough to address without broad destabilization.
• Pay close attention to logfire/variables/composition.py - nondeterministic set iteration can change resolution and error-reporting order.

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>