fix(templates): introduce ErrMultipleParents sentinel; add unit test

- model/relation.go: declare ErrMultipleParents sentinel; wrap it into
  Relations.ParentKey error with %w so errors.Is can detect it
- model/object.go: use errors.Is(err, ErrMultipleParents) in Config.ParentKey
  so only the shared-variables case falls back to the structural parent;
  all other relation errors are now propagated; update comment to cite
  the full VariablesForRelation invariant (NewOtherSideRelation hard-codes
  keboola.VariablesComponentID, making both checkDefinedOn guards unreachable)
- mapper/ignore/remote.go: update comment to clarify the > 1 guard fires
  only when the variables config was absent from the loaded batch during
  relation linking, so the two-pass dedup never ran for it
- mapper/ignore/remote_test.go: add
  TestIgnoreMapper_AfterRemoteOperation_Variables_SharedByMultipleConsumers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Matovidlo

internal/pkg/mapper/ignore/remote.go

@@ -63,9 +63,11 @@ func (m *ignoreMapper) isIgnoredConfig(ctx context.Context, config *model.Config
 	if config.ComponentID == keboola.VariablesComponentID {
 		variablesForRels := config.Relations.GetByType(model.VariablesForRelType)
 
-		// Ignore if shared across multiple consumers — cannot be embedded under a single
-		// parent. The two-pass relation validator should remove these; this is a safety net
-		// for the Templates API where object iteration order exposes an edge case.
+		// Ignore if shared across multiple consumers — cannot be embedded under a single parent.
+		// Normally the two-pass relations mapper removes all VariablesForRelType entries when
+		// duplicates are detected (leaving len == 0, caught by the unattached check below).
+		// This guard fires only when the variables config was absent from the loaded batch in
+		// which consumer relations were linked, so the dedup pass never ran for it.
 		if len(variablesForRels) > 1 {
 			m.logger.Debugf(ctx, "Ignored %s shared by %d consumers", config.Desc(), len(variablesForRels))
 			return true

internal/pkg/mapper/ignore/remote_test.go

@@ -62,6 +62,55 @@ func TestIgnoreMapper_AfterRemoteOperation_Variables(t *testing.T) {
 	}, state.All())
 }
 
+func TestIgnoreMapper_AfterRemoteOperation_Variables_SharedByMultipleConsumers(t *testing.T) {
+	t.Parallel()
+	state, d := createStateWithMapper(t)
+	logger := d.DebugLogger()
+
+	// Consumer 1
+	consumer1Key := model.ConfigKey{BranchID: 1, ComponentID: "ex-generic-v2", ID: "1"}
+	consumer1 := &model.ConfigState{
+		ConfigManifest: &model.ConfigManifest{ConfigKey: consumer1Key},
+		Remote:         &model.Config{ConfigKey: consumer1Key},
+	}
+	require.NoError(t, state.Set(consumer1))
+
+	// Consumer 2
+	consumer2Key := model.ConfigKey{BranchID: 1, ComponentID: "ex-generic-v2", ID: "2"}
+	consumer2 := &model.ConfigState{
+		ConfigManifest: &model.ConfigManifest{ConfigKey: consumer2Key},
+		Remote:         &model.Config{ConfigKey: consumer2Key},
+	}
+	require.NoError(t, state.Set(consumer2))
+
+	// Shared variables config with two VariablesForRelation entries — simulates the case
+	// where the relations mapper's two-pass dedup did not run for this config (it was absent
+	// from the loaded batch when consumer relations were linked).
+	sharedVarsKey := model.ConfigKey{BranchID: 1, ComponentID: keboola.VariablesComponentID, ID: "3"}
+	sharedVars := &model.ConfigState{
+		ConfigManifest: &model.ConfigManifest{ConfigKey: sharedVarsKey},
+		Remote: &model.Config{
+			ConfigKey: sharedVarsKey,
+			Relations: model.Relations{
+				&model.VariablesForRelation{ComponentID: consumer1Key.ComponentID, ConfigID: consumer1Key.ID},
+				&model.VariablesForRelation{ComponentID: consumer2Key.ComponentID, ConfigID: consumer2Key.ID},
+			},
+		},
+	}
+	require.NoError(t, state.Set(sharedVars))
+
+	// Invoke
+	changes := model.NewRemoteChanges()
+	changes.AddLoaded(consumer1)
+	changes.AddLoaded(consumer2)
+	changes.AddLoaded(sharedVars)
+	require.NoError(t, state.Mapper().AfterRemoteOperation(t.Context(), changes))
+	logger.AssertJSONMessages(t, `{"level":"debug","message":"Ignored config \"branch:1/component:keboola.variables/config:3\" shared by 2 consumers"}`)
+
+	// Shared variables config is removed; consumers remain
+	assert.Equal(t, []model.ObjectState{consumer1, consumer2}, state.All())
+}
+
 func TestIgnoreMapper_AfterRemoteOperation_Scheduler(t *testing.T) {
 	t.Parallel()
 	state, d := createStateWithMapper(t)

internal/pkg/model/object.go

@@ -595,16 +595,20 @@ func (r *ConfigRow) GetContent() *orderedmap.OrderedMap {
 }
 
 // ParentKey - config parent can be modified via Relations, e.g. variables config embedded in another config.
-// When Relations.ParentKey returns an error it means multiple relation-defined parents exist (a variables
-// config shared by more than one consumer). In that case fall back to the structural parent (branch).
-// Other error kinds from Relations.ParentKey cannot occur here because individual relation errors require
-// a non-ConfigKey source, but c.Key() is always a ConfigKey.
+// When Relations.ParentKey returns ErrMultipleParents (a shared variables config), fall back to the
+// structural parent (branch). VariablesForRelation is only ever constructed by
+// VariablesFromRelation.NewOtherSideRelation, which hard-codes ComponentID: keboola.VariablesComponentID,
+// so neither checkDefinedOn guard can trigger in practice. All other errors are propagated.
 func (c *Config) ParentKey() (Key, error) {
 	parentKey, err := c.Relations.ParentKey(c.Key())
 	if err == nil && parentKey != nil {
 		return parentKey, nil
 	}
-	// No parent defined via "Relations", or multiple parents — fall back to structural parent (branch).
+	if err != nil && !errors.Is(err, ErrMultipleParents) {
+		return nil, err
+	}
+	// No relation-defined parent, or multiple parents (shared variables config) —
+	// fall back to the structural parent (branch).
 	return c.ConfigKey.ParentKey()
 }
 

internal/pkg/model/relation.go

@@ -24,6 +24,10 @@ const (
 	UsedInRowInputMappingRelType    = RelationType(`usedInRowInputMapping`)
 )
 
+// ErrMultipleParents is returned by Relations.ParentKey when more than one relation
+// defines a parent key for the same object.
+var ErrMultipleParents = errors.New(`multiple parents defined by "relations"`)
+
 // OneToXRelations gets relations that can be defined on an object only once.
 func OneToXRelations() []RelationType {
 	return []RelationType{
@@ -80,7 +84,7 @@ func (v Relations) ParentKey(source Key) (Key, error) {
 
 	// Multiple parents are forbidden
 	if len(parents) > 1 {
-		return nil, errors.Errorf(`unexpected state: multiple parents defined by "relations" in %s`, source.Desc())
+		return nil, errors.Errorf(`unexpected state in %s: %w`, source.Desc(), ErrMultipleParents)
 	}
 
 	return nil, nil