fix: address round-3 PR review comments

- variables.go: clarify that variablesValuesFor is left in place
  intentionally and relies on the ignore mapper for cleanup
- link_test.go: assert that consumer1 has exactly one variablesValuesFrom
  (no duplicate added) and consumer2 has none, confirming the > 1 guard;
  add note explaining AfterLocalOperation deliberate omission
- docs: reword edge case as "known limitation" rather than "pre-existing bug"
- expected-stderr: remove extra trailing blank line

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Matovidlo

docs/relations-validation.md

@@ -71,7 +71,7 @@ To avoid the duplicate, `NewOtherSideRelation` checks `len(GetByType(VariablesFo
 
 If the Loaded() order is `vars_config → values_row → consumer1 → consumer2`, then when `linkRelations(values_row)` runs in Pass 1, Y has zero `variablesFor` entries (consumers have not been processed yet). The `> 1` guard does not fire. `GetOneByType` returns `nil` (no relation found), and `NewOtherSideRelation` returns the "missing relation variablesFor" error — producing an extra warning in the output alongside the "found 2" warning from Pass 2.
 
-This double-warning is a pre-existing edge case. In practice it does not arise because consumer configs always appear in Loaded() before variables values rows (the Storage API returns consumers, and values rows are discovered via the consumer's `variablesValuesFrom` relations). The `> 1` guard eliminates the more common ordering issue; the remaining edge case is benign — both warnings correctly describe the malformed setup.
+This double-warning is a **known limitation of this fix**, not a pre-existing bug. Before this PR, the values-row-first ordering would have led to a different failure mode depending on whether consumers appeared later. The `> 1` guard eliminates the crash and the more common duplicate-warning case; this remaining ordering is accepted as a minor trade-off. In practice it does not arise because consumer configs always appear in `Loaded()` before their variables values rows (the Storage API returns consumers first, and values rows are discovered via the consumer's `variablesValuesFrom` relations). Both warnings correctly describe the malformed setup, so no data is lost.
 
 ## Why the ignore mapper excludes orphaned variables configs
 

internal/pkg/mapper/relations/link_test.go

@@ -147,6 +147,17 @@ func TestRelationsMapperVariablesSharedAcrossConsumers(t *testing.T) {
 	allTxt := logger.AllMessagesTxt()
 	assert.Equal(t, 1, strings.Count(allTxt, `Only one relation "variablesFor" expected, but found 2`))
 	assert.Empty(t, logger.ErrorMessages())
+
+	// The > 1 guard in VariablesValuesForRelation.NewOtherSideRelation prevented
+	// linkRelations(valuesRow) from adding a VariablesValuesFromRelation to any consumer.
+	// consumer1 retains its original single VariablesValuesFromRelation (no duplicate was
+	// added from the values-row side), and consumer2 has none at all.
+	assert.Equal(t, 1, len(consumer1.Remote.Relations.GetByType(model.VariablesValuesFromRelType)))
+	assert.Empty(t, consumer2.Remote.Relations.GetByType(model.VariablesValuesFromRelType))
+
+	// AfterLocalOperation is structurally identical to AfterRemoteOperation (same two-pass
+	// logic). It is not re-tested here because the shared-variables scenario only arises
+	// from the remote API path, where object order is non-deterministic.
 }
 
 func TestRelationsMapperOtherSideMissing(t *testing.T) {

internal/pkg/model/variables.go

@@ -180,7 +180,9 @@ func (t *VariablesValuesForRelation) NewOtherSideRelation(relationDefinedOn Obje
 	variablesConfig := variablesConfigRaw.(*Config)
 	// When the variables config temporarily holds multiple variablesFor relations (shared
 	// across consumers), skip linking here — Pass 2 validation will detect and warn about
-	// the duplicates and remove them.
+	// the duplicates and remove them. The variablesValuesFor relation on the row is
+	// intentionally left in place; the ignore mapper excludes the parent variables config
+	// (and this row transitively) after Pass 2 removes all variablesFor entries.
 	if len(variablesConfig.Relations.GetByType(VariablesForRelType)) > 1 {
 		return nil, nil, nil
 	}

test/cli/pull/variables-used-twice/expected-stderr

@@ -3,4 +3,3 @@ Warning:
   - Only one relation "variablesFor" expected, but found 2:
     - {"componentId":"ex-generic-v2","configId":"%s"}
     - {"componentId":"ex-generic-v2","configId":"%s"}
-