feat(cli+templateengine+deploymanager): resolve follow-ups #4/#5/#6/#8 — CLI ergonomics + structured deploy validation error

Closes the four remaining items in the 2026-06-24 template-inheritance/CLI
follow-up tracker.

#4 — CLI `instance set-bindings` can now set DataSourceReferenceOverride.
  `--bindings` accepts an optional 3rd element per entry:
  [attributeName, dataConnectionId, dataSourceReferenceOverride]. A string
  sets the override; a JSON null or an omitted 3rd element leaves it unset
  (template default). TryParseBindings accepts 2- or 3-element entries and
  rejects a non-string/non-null 3rd element or 4+ elements with a clean
  error. Previously the CLI sent the override as null and silently wiped any
  existing one (only a raw POST /management could set it).

#5 — `template update` is partial, not full-replace (fixed server-side so all
  clients benefit). UpdateTemplateAsync now uses leave-unchanged semantics:
  a null description keeps the stored value (pass "" to clear); a null
  parentTemplateId keeps the existing parent. Parent stays immutable — a
  non-null differing value is still rejected — but omitting --parent-id is
  now a no-op instead of failing every derived-template update.

#6 — compact `template list`/`get` table output + `--detail`. Table output is
  now id/name/description/parent/derived + member counts (#attrs/#alarms/
  #scripts/#comps/#nativeAlarms) via TemplateTableProjection, fed through a
  new optional tableProjector seam on CommandHelpers. `--detail` restores the
  full dump. JSON output is left untouched (always full) so machine consumers
  are unaffected — the projector only runs on the table path.

#8 — structured deploy-time validation error. New ValidationResult.SummarizeErrors()
  (Commons) returns a grouped, capped summary: leading total count, one line
  per ValidationCategory, and a per-module rollup (canonical name up to its
  last dot) with counts + "... and N more module(s)" caps. DeploymentService
  uses it for the "Pre-deployment validation failed" message and logs the full
  per-entry list via LogWarning. Replaces the flat semicolon-joined dump that
  became a wall of text for instances with 50-194 unbound attributes.

Tests: +8 Commons (SummarizeErrors), +8 CLI (4 binding 3-element / 4 table
projection), +2 net TemplateEngine (partial-update). Affected suites green:
Commons 587, CLI 341, TemplateEngine 447, DeploymentManager 101,
ManagementService 230, CentralUI 866; full solution builds 0/0.

Docs: Component-DeploymentManager.md "Validation Error Reporting"; CLI README
(set-bindings 3-element form, template update leave-unchanged, list/get
--detail); UpdateTemplateCommand doc; known-issues tracker #4/#5/#6/#8 resolved
(all 8 items now closed).

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/CommandHelpers.cs

@@ -30,6 +30,13 @@ internal static class CommandHelpers
     /// (<see cref="IsAuthorizationFailure"/>) is preserved on the error path either way,
     /// closing CLI-017's regression.
     /// </param>
+    /// <param name="tableProjector">
+    /// Optional transform applied to the success JSON body <em>only</em> when the resolved
+    /// format is <c>table</c>. Lets a command render a compact table projection (e.g.
+    /// <c>template list</c> dropping per-template attribute dumps, followup #6) while
+    /// leaving JSON output untouched for machine consumers. Ignored when
+    /// <paramref name="onSuccess"/> is supplied.
+    /// </param>
     /// <returns>A task that resolves to the process exit code (0 = success, 1 = error, 2 = authorization failure).</returns>
     internal static async Task<int> ExecuteCommandAsync(
         ParseResult result,
@@ -39,7 +46,8 @@ internal static class CommandHelpers
         Option<string> passwordOption,
         object command,
         TimeSpan? timeout = null,
-        Func<string, int>? onSuccess = null)
+        Func<string, int>? onSuccess = null,
+        Func<string, string>? tableProjector = null)
     {
         var config = CliConfig.Load();
         var format = ResolveFormat(result, formatOption, config);
@@ -98,7 +106,7 @@ internal static class CommandHelpers
             return IsAuthorizationFailure(response) ? 2 : 1;
         }
 
-        return HandleResponse(response, format);
+        return HandleResponse(response, format, tableProjector);
     }
 
     /// <summary>
@@ -158,8 +166,12 @@ internal static class CommandHelpers
     /// </summary>
     /// <param name="response">Response received from the management API.</param>
     /// <param name="format">Output format (<c>json</c> or <c>table</c>).</param>
+    /// <param name="tableProjector">
+    /// Optional transform applied to the JSON body before table rendering only — JSON
+    /// output is never altered. See <see cref="ExecuteCommandAsync"/>.
+    /// </param>
     /// <returns>The process exit code (0 = success, 1 = error, 2 = authorization failure).</returns>
-    internal static int HandleResponse(ManagementResponse response, string format)
+    internal static int HandleResponse(ManagementResponse response, string format, Func<string, string>? tableProjector = null)
     {
         if (response.JsonData != null)
         {
@@ -173,7 +185,11 @@ internal static class CommandHelpers
 
             if (string.Equals(format, "table", StringComparison.OrdinalIgnoreCase))
             {
-                WriteAsTable(response.JsonData);
+                // A table projector compacts the body for terminal display (e.g. dropping
+                // per-template attribute dumps). JSON output stays full/untouched so
+                // machine consumers keep the complete payload.
+                var body = tableProjector != null ? tableProjector(response.JsonData) : response.JsonData;
+                WriteAsTable(body);
             }
             else
             {

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/InstanceCommands.cs

@@ -54,7 +54,18 @@ public static class InstanceCommands
     private static Command BuildSetBindings(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
-        var bindingsOption = new Option<string>("--bindings") { Description = "JSON array of [attributeName, dataConnectionId] pairs", Required = true };
+        var bindingsOption = new Option<string>("--bindings")
+        {
+            Description = "JSON array of binding entries. Each entry is either " +
+                          "[attributeName, dataConnectionId] or " +
+                          "[attributeName, dataConnectionId, dataSourceReferenceOverride] " +
+                          "(the 3rd element overrides the attribute's data-source reference; " +
+                          "pass null or omit it to use the template default). " +
+                          "NOTE: this REPLACES all bindings for the instance — include the " +
+                          "override on every entry that needs one, or omitting it clears any " +
+                          "previously-set override.",
+            Required = true
+        };
 
         var cmd = new Command("set-bindings") { Description = "Set data connection bindings for an instance" };
         cmd.Add(idOption);
@@ -76,11 +87,16 @@ public static class InstanceCommands
     }
 
     /// <summary>
-    /// Parses the <c>--bindings</c> argument — a JSON array of
-    /// <c>[attributeName, dataConnectionId]</c> pairs — into a typed list.
-    /// Returns <c>false</c> with a descriptive <paramref name="error"/> instead of
-    /// throwing when the JSON is malformed, a pair has the wrong arity, or an element
-    /// has the wrong type.
+    /// Parses the <c>--bindings</c> argument — a JSON array of binding entries — into a
+    /// typed list. Each entry is either a two-element
+    /// <c>[attributeName, dataConnectionId]</c> pair or a three-element
+    /// <c>[attributeName, dataConnectionId, dataSourceReferenceOverride]</c> triple. The
+    /// optional third element carries the per-instance data-source reference override
+    /// (<see cref="ConnectionBinding.DataSourceReferenceOverride"/>); a JSON
+    /// <c>null</c> (or an omitted third element) leaves it unset so the template default
+    /// applies. Returns <c>false</c> with a descriptive <paramref name="error"/> instead
+    /// of throwing when the JSON is malformed, an entry has the wrong arity, or an
+    /// element has the wrong type.
     /// </summary>
     /// <param name="json">The JSON string to parse.</param>
     /// <param name="bindings">The parsed bindings list, or null if parsing fails.</param>
@@ -99,16 +115,19 @@ public static class InstanceCommands
                 .Deserialize<List<List<System.Text.Json.JsonElement>>>(json);
             if (pairs == null)
             {
-                error = "Bindings JSON must be a non-null array of [attributeName, dataConnectionId] pairs.";
+                error = "Bindings JSON must be a non-null array of "
+                    + "[attributeName, dataConnectionId] or "
+                    + "[attributeName, dataConnectionId, dataSourceReferenceOverride] entries.";
                 return false;
             }
 
             var result = new List<ConnectionBinding>(pairs.Count);
             foreach (var pair in pairs)
             {
-                if (pair.Count != 2)
+                if (pair.Count is not (2 or 3))
                 {
-                    error = "Each binding must be a [attributeName, dataConnectionId] pair of exactly two elements.";
+                    error = "Each binding must be a [attributeName, dataConnectionId] pair, "
+                        + "optionally with a third dataSourceReferenceOverride element.";
                     return false;
                 }
                 if (pair[0].ValueKind != System.Text.Json.JsonValueKind.String)
@@ -122,7 +141,24 @@ public static class InstanceCommands
                     error = "The second element of each binding (dataConnectionId) must be an integer.";
                     return false;
                 }
-                result.Add(new ConnectionBinding(pair[0].GetString()!, connectionId));
+
+                string? referenceOverride = null;
+                if (pair.Count == 3)
+                {
+                    var third = pair[2];
+                    if (third.ValueKind == System.Text.Json.JsonValueKind.String)
+                    {
+                        referenceOverride = third.GetString();
+                    }
+                    else if (third.ValueKind != System.Text.Json.JsonValueKind.Null)
+                    {
+                        error = "The third element of each binding (dataSourceReferenceOverride) "
+                            + "must be a string or null.";
+                        return false;
+                    }
+                }
+
+                result.Add(new ConnectionBinding(pair[0].GetString()!, connectionId, referenceOverride));
             }
 
             bindings = result;

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/TemplateCommands.cs

@@ -54,11 +54,19 @@ public static class TemplateCommands
 
     private static Command BuildList(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
-        var cmd = new Command("list") { Description = "List all templates" };
+        var detailOption = new Option<bool>("--detail")
+        {
+            Description = "Include full template definitions (all attributes/alarms/scripts) in table output. "
+                + "Without it, table output is a compact summary (counts only). JSON output is always full."
+        };
+        var cmd = new Command("list") { Description = "List all templates (compact table summary; use --detail for the full dump)" };
+        cmd.Add(detailOption);
         cmd.SetAction(async (ParseResult result) =>
         {
+            var detail = result.GetValue(detailOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, urlOption, formatOption, usernameOption, passwordOption, new ListTemplatesCommand());
+                result, urlOption, formatOption, usernameOption, passwordOption, new ListTemplatesCommand(),
+                tableProjector: detail ? null : TemplateTableProjection.ProjectSummary);
         });
         return cmd;
     }
@@ -66,13 +74,21 @@ public static class TemplateCommands
     private static Command BuildGet(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Template ID", Required = true };
-        var cmd = new Command("get") { Description = "Get a template by ID" };
+        var detailOption = new Option<bool>("--detail")
+        {
+            Description = "Include full template definitions (all attributes/alarms/scripts) in table output. "
+                + "Without it, table output is a compact summary (counts only). JSON output is always full."
+        };
+        var cmd = new Command("get") { Description = "Get a template by ID (compact table summary; use --detail for the full dump)" };
         cmd.Add(idOption);
+        cmd.Add(detailOption);
         cmd.SetAction(async (ParseResult result) =>
         {
             var id = result.GetValue(idOption);
+            var detail = result.GetValue(detailOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, urlOption, formatOption, usernameOption, passwordOption, new GetTemplateCommand(id));
+                result, urlOption, formatOption, usernameOption, passwordOption, new GetTemplateCommand(id),
+                tableProjector: detail ? null : TemplateTableProjection.ProjectSummary);
         });
         return cmd;
     }
@@ -103,10 +119,10 @@ public static class TemplateCommands
     {
         var idOption = new Option<int>("--id") { Description = "Template ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "Template name", Required = true };
-        var descOption = new Option<string?>("--description") { Description = "Template description" };
-        var parentOption = new Option<int?>("--parent-id") { Description = "Parent template ID" };
+        var descOption = new Option<string?>("--description") { Description = "Template description. Omit to leave unchanged; pass an empty string (\"\") to clear it." };
+        var parentOption = new Option<int?>("--parent-id") { Description = "Parent template ID. Immutable after creation; omit to leave unchanged." };
 
-        var cmd = new Command("update") { Description = "Update a template" };
+        var cmd = new Command("update") { Description = "Update a template (omitted optional fields are left unchanged)" };
         cmd.Add(idOption);
         cmd.Add(nameOption);
         cmd.Add(descOption);

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/TemplateTableProjection.cs

@@ -0,0 +1,112 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace ZB.MOM.WW.ScadaBridge.CLI.Commands;
+
+/// <summary>
+/// Compact table projection for <c>template list</c> / <c>template get</c> (followup #6).
+/// The management API returns full <c>Template</c> entities — every attribute, alarm,
+/// script, and composition inline — which the generic table renderer dumps as one giant
+/// cell per template (~171 KB for a real catalogue, unusable in a terminal). This
+/// projector reduces each template to id / name / description / parent / derived plus
+/// member <em>counts</em>, leaving JSON output untouched (callers pass this only on the
+/// table path) and the full dump available via the command's <c>--detail</c> flag.
+/// </summary>
+internal static class TemplateTableProjection
+{
+    /// <summary>
+    /// Projects a templates JSON response (an array from <c>list</c> or a single object
+    /// from <c>get</c>) to its compact summary form. Returns the input unchanged when it
+    /// is not JSON or not the expected shape, so the generic renderer's own fallbacks
+    /// still apply.
+    /// </summary>
+    /// <param name="json">The raw success JSON body from the management API.</param>
+    /// <returns>Compact JSON (same array/object shape) suitable for table rendering.</returns>
+    internal static string ProjectSummary(string json)
+    {
+        JsonDocument doc;
+        try
+        {
+            doc = JsonDocument.Parse(json);
+        }
+        catch (JsonException)
+        {
+            // Not JSON (e.g. a proxy error page) — let the renderer print it verbatim.
+            return json;
+        }
+
+        using (doc)
+        {
+            var root = doc.RootElement;
+            if (root.ValueKind == JsonValueKind.Array)
+            {
+                var arr = new JsonArray();
+                foreach (var item in root.EnumerateArray())
+                    arr.Add(ProjectElement(item));
+                return arr.ToJsonString();
+            }
+            if (root.ValueKind == JsonValueKind.Object)
+            {
+                return ProjectElement(root).ToJsonString();
+            }
+            return json;
+        }
+    }
+
+    /// <summary>Projects a single template object to its compact summary node.</summary>
+    private static JsonNode ProjectElement(JsonElement element)
+    {
+        if (element.ValueKind != JsonValueKind.Object)
+            return JsonValue.Create(element.ToString())!;
+
+        // JsonObject preserves insertion order, fixing the column order for the table.
+        return new JsonObject
+        {
+            ["id"] = Int(element, "id"),
+            ["name"] = Str(element, "name"),
+            ["description"] = Str(element, "description"),
+            ["parentTemplateId"] = Int(element, "parentTemplateId"),
+            ["isDerived"] = Bool(element, "isDerived"),
+            ["#attrs"] = Count(element, "attributes"),
+            ["#alarms"] = Count(element, "alarms"),
+            ["#scripts"] = Count(element, "scripts"),
+            ["#comps"] = Count(element, "compositions"),
+            ["#nativeAlarms"] = Count(element, "nativeAlarmSources"),
+        };
+    }
+
+    private static bool TryGetPropertyCI(JsonElement obj, string name, out JsonElement value)
+    {
+        foreach (var prop in obj.EnumerateObject())
+        {
+            if (string.Equals(prop.Name, name, StringComparison.OrdinalIgnoreCase))
+            {
+                value = prop.Value;
+                return true;
+            }
+        }
+        value = default;
+        return false;
+    }
+
+    private static JsonNode? Str(JsonElement obj, string name)
+        => TryGetPropertyCI(obj, name, out var v) && v.ValueKind == JsonValueKind.String
+            ? JsonValue.Create(v.GetString())
+            : null;
+
+    private static JsonNode? Int(JsonElement obj, string name)
+        => TryGetPropertyCI(obj, name, out var v) && v.ValueKind == JsonValueKind.Number && v.TryGetInt32(out var n)
+            ? JsonValue.Create(n)
+            : null;
+
+    private static JsonNode? Bool(JsonElement obj, string name)
+        => TryGetPropertyCI(obj, name, out var v) && (v.ValueKind == JsonValueKind.True || v.ValueKind == JsonValueKind.False)
+            ? JsonValue.Create(v.GetBoolean())
+            : null;
+
+    private static JsonNode Count(JsonElement obj, string name)
+        => JsonValue.Create(
+            TryGetPropertyCI(obj, name, out var v) && v.ValueKind == JsonValueKind.Array
+                ? v.GetArrayLength()
+                : 0);
+}

src/ZB.MOM.WW.ScadaBridge.CLI/README.md

@@ -86,23 +86,35 @@ Exit codes:
 
 #### `template list`
 
-List all templates with their full attribute, alarm, script, and composition definitions.
+List all templates. **Table** output (`--format table`) shows a compact summary — id,
+name, description, parent, and member **counts** (`#attrs`, `#alarms`, `#scripts`,
+`#comps`, `#nativeAlarms`) — so it stays readable in a terminal. Add `--detail` to dump
+the full attribute/alarm/script/composition definitions in the table. **JSON** output
+(`--format json`) is always the full, unmodified payload regardless of `--detail`.
 
 ```sh
-scadabridge --url <url> template list
+scadabridge --url <url> template list                       # compact table
+scadabridge --url <url> --format table template list --detail   # full table dump
+scadabridge --url <url> --format json template list        # full JSON (always)
 ```
 
+| Option | Required | Description |
+|--------|----------|-------------|
+| `--detail` | no | Include full definitions in table output (no effect on JSON) |
+
 #### `template get`
 
-Get a single template by ID.
+Get a single template by ID. Like `template list`, table output is a compact summary
+unless `--detail` is supplied; JSON output is always full.
 
 ```sh
-scadabridge --url <url> template get --id <int>
+scadabridge --url <url> template get --id <int> [--detail]
 ```
 
 | Option | Required | Description |
 |--------|----------|-------------|
 | `--id` | yes | Template ID |
+| `--detail` | no | Include full definitions in table output (no effect on JSON) |
 
 #### `template create`
 
@@ -120,9 +132,11 @@ scadabridge --url <url> template create --name <string> [--description <string>]
 
 #### `template update`
 
-Update an existing template. An update **replaces** the whole entity — every required
-field below must be supplied with the value it should have after the update, even if
-it is unchanged.
+Update an existing template. Optional fields use **leave-unchanged** semantics: omitting
+`--description` or `--parent-id` keeps the stored value rather than wiping it. To
+explicitly clear the description, pass an empty string (`--description ""`). The parent
+template is immutable after creation — omit `--parent-id` (or pass the current value);
+passing a different value is rejected.
 
 ```sh
 scadabridge --url <url> template update --id <int> --name <string> [--description <string>] [--parent-id <int>]
@@ -132,8 +146,8 @@ scadabridge --url <url> template update --id <int> --name <string> [--descriptio
 |--------|----------|-------------|
 | `--id` | yes | Template ID |
 | `--name` | yes | Template name |
-| `--description` | no | Updated description |
-| `--parent-id` | no | Updated parent template ID |
+| `--description` | no | Updated description. Omit to leave unchanged; pass `""` to clear. |
+| `--parent-id` | no | Immutable; omit to leave unchanged. |
 
 #### `template delete`
 
@@ -544,7 +558,22 @@ scadabridge --url <url> instance set-bindings --id <int> --bindings <json>
 | Option | Required | Description |
 |--------|----------|-------------|
 | `--id` | yes | Instance ID |
-| `--bindings` | yes | JSON array of `[attributeName, dataConnectionId]` pairs (e.g. `[["Speed",7],["Temperature",7]]`) |
+| `--bindings` | yes | JSON array of binding entries, each either `[attributeName, dataConnectionId]` or `[attributeName, dataConnectionId, dataSourceReferenceOverride]` |
+
+The optional **third element** sets the per-instance data-source reference override
+(the OPC UA node id / protocol address used in place of the template's
+`DataSourceReference` for that attribute). Pass a string to set it, or `null` / omit
+it to use the template default:
+
+```sh
+# Bind Speed with an address override; bind Mode using the template default reference.
+scadabridge --url <url> instance set-bindings --id 42 \
+  --bindings '[["Speed",7,"ns=2;s=Reactor.Speed"],["Mode",7]]'
+```
+
+> **Note:** this command **replaces** all bindings for the instance. Include the
+> override on every entry that needs one — omitting the third element clears any
+> previously-set override for that attribute.
 
 #### `instance set-overrides`
 

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/TemplateCommands.cs

@@ -3,6 +3,13 @@ namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 public record ListTemplatesCommand;
 public record GetTemplateCommand(int TemplateId);
 public record CreateTemplateCommand(string Name, string? Description, int? ParentTemplateId);
+
+/// <summary>
+/// Updates a template. Optional fields use leave-unchanged semantics (followup #5):
+/// a <c>null</c> <see cref="Description"/> keeps the stored description (pass an empty
+/// string to clear it), and a <c>null</c> <see cref="ParentTemplateId"/> keeps the
+/// existing parent (the parent is immutable; a non-null value that differs is rejected).
+/// </summary>
 public record UpdateTemplateCommand(int TemplateId, string Name, string? Description, int? ParentTemplateId);
 public record DeleteTemplateCommand(int TemplateId);
 public record ValidateTemplateCommand(int TemplateId);

src/ZB.MOM.WW.ScadaBridge.Commons/Types/Flattening/ValidationResult.cs

@@ -1,3 +1,5 @@
+using System.Text;
+
 namespace ZB.MOM.WW.ScadaBridge.Commons.Types.Flattening;
 
 /// <summary>
@@ -12,6 +14,98 @@ public sealed record ValidationResult
     /// <summary>Non-blocking validation warnings.</summary>
     public IReadOnlyList<ValidationEntry> Warnings { get; init; } = [];
 
+    /// <summary>
+    /// Produces a compact, human-readable summary of the validation errors instead of a
+    /// flat semicolon-joined dump (followup #8). The old behaviour concatenated one clause
+    /// per error — for an instance with 50–194 unbound attributes that is a wall of text
+    /// unreadable in a CLI/UI toast. This groups errors by <see cref="ValidationCategory"/>
+    /// and, within a category, rolls entries up by "module" (the entity's canonical name up
+    /// to its last dot) with counts, capping the breadth with "… and N more". The full,
+    /// per-entry list is still available on <see cref="Errors"/> for a detail view or log.
+    /// </summary>
+    /// <param name="maxGroups">
+    /// Maximum number of modules (or messages, when entries are not entity-scoped) to list
+    /// per category before collapsing the remainder into a "… and N more" suffix.
+    /// </param>
+    /// <returns>
+    /// A multi-line summary, or an empty string when there are no errors. The first line is
+    /// the total error count; subsequent lines are one per category.
+    /// </returns>
+    public string SummarizeErrors(int maxGroups = 6)
+    {
+        if (Errors.Count == 0)
+            return string.Empty;
+
+        var sb = new StringBuilder();
+        sb.Append(Errors.Count).Append(Errors.Count == 1 ? " error:" : " errors:");
+
+        // Group errors by category, preserving first-seen order for a stable rendering.
+        var byCategory = new List<(ValidationCategory Category, List<ValidationEntry> Items)>();
+        var categoryIndex = new Dictionary<ValidationCategory, int>();
+        foreach (var error in Errors)
+        {
+            if (!categoryIndex.TryGetValue(error.Category, out var i))
+            {
+                i = byCategory.Count;
+                categoryIndex[error.Category] = i;
+                byCategory.Add((error.Category, []));
+            }
+            byCategory[i].Items.Add(error);
+        }
+
+        foreach (var (category, items) in byCategory)
+        {
+            sb.AppendLine();
+            sb.Append("  • ").Append(category).Append(" (").Append(items.Count).Append("): ");
+
+            // Prefer an entity/module rollup when every entry names an entity (the unbound-
+            // binding case). Otherwise fall back to a capped list of the raw messages.
+            if (items.TrueForAll(e => !string.IsNullOrEmpty(e.EntityName)))
+            {
+                var modules = new List<(string Module, int Count)>();
+                var moduleIndex = new Dictionary<string, int>(StringComparer.Ordinal);
+                foreach (var entry in items)
+                {
+                    var module = ModuleOf(entry.EntityName!);
+                    if (!moduleIndex.TryGetValue(module, out var mi))
+                    {
+                        mi = modules.Count;
+                        moduleIndex[module] = mi;
+                        modules.Add((module, 0));
+                    }
+                    modules[mi] = (module, modules[mi].Count + 1);
+                }
+
+                var shown = modules.Take(maxGroups).Select(m => $"{m.Module} ({m.Count})");
+                sb.Append(string.Join(", ", shown));
+                if (modules.Count > maxGroups)
+                    sb.Append($", … and {modules.Count - maxGroups} more module(s)");
+            }
+            else
+            {
+                var shown = items.Take(maxGroups).Select(e => e.Message);
+                sb.Append(string.Join("; ", shown));
+                if (items.Count > maxGroups)
+                    sb.Append($"; … and {items.Count - maxGroups} more");
+            }
+        }
+
+        return sb.ToString();
+    }
+
+    /// <summary>
+    /// Returns the "module" portion of a canonical attribute name — everything up to the
+    /// last <c>.</c> (e.g. <c>LeftReactorSide.LeakTest.DeltaVac</c> → <c>LeftReactorSide.LeakTest</c>).
+    /// A name with no dot is reported under <c>(root)</c>.
+    /// </summary>
+    /// <param name="canonicalName">The entity's canonical name.</param>
+    /// <returns>The module prefix, or <c>(root)</c> for top-level members.</returns>
+    private static string ModuleOf(string canonicalName)
+    {
+        var lastDot = canonicalName.LastIndexOf('.');
+        return lastDot > 0 ? canonicalName[..lastDot] : "(root)";
+    }
+
     /// <summary>Returns a result with no errors or warnings.</summary>
     /// <returns>A <see cref="ValidationResult"/> with empty error and warning lists.</returns>
     public static ValidationResult Success() => new();

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/DeploymentService.cs

@@ -179,8 +179,18 @@ public class DeploymentService
 
         if (!validationResult.IsValid)
         {
-            var errors = string.Join("; ", validationResult.Errors.Select(e => e.Message));
-            return Result<DeploymentRecord>.Failure($"Pre-deployment validation failed: {errors}");
+            // Followup #8: return a grouped/summarized error (leading count + per-module
+            // rollup, capped) instead of a flat semicolon-joined dump that becomes a wall
+            // of text for instances with dozens of unbound attributes. The full per-entry
+            // list still goes to the deploy log for operators who need every clause.
+            _logger.LogWarning(
+                "Pre-deployment validation failed for instance {InstanceId} ({ErrorCount} error(s)): {Detail}",
+                instanceId,
+                validationResult.Errors.Count,
+                string.Join("; ", validationResult.Errors.Select(e => e.Message)));
+
+            return Result<DeploymentRecord>.Failure(
+                $"Pre-deployment validation failed: {validationResult.SummarizeErrors()}");
         }
 
         // Serialize for transmission (also the payload stored in the deployed

src/ZB.MOM.WW.ScadaBridge.TemplateEngine/TemplateService.cs

@@ -90,12 +90,17 @@ public class TemplateService
     }
 
     /// <summary>
-    /// Updates a template's name and description. Parent template is immutable after creation.
+    /// Updates a template's name and (optionally) description. Optional fields use
+    /// leave-unchanged semantics so an omitted field is not silently wiped (followup #5):
+    /// a <c>null</c> <paramref name="description"/> leaves the stored description as-is —
+    /// pass an empty string to explicitly clear it. Parent template is immutable after
+    /// creation; a <c>null</c> <paramref name="parentTemplateId"/> leaves it unchanged,
+    /// and a non-null value that differs from the current parent is rejected.
     /// </summary>
     /// <param name="templateId">ID of the template to update.</param>
-    /// <param name="name">New name for the template.</param>
-    /// <param name="description">New description.</param>
-    /// <param name="parentTemplateId">Must match the existing parent (cannot be changed).</param>
+    /// <param name="name">New name for the template (required, non-empty).</param>
+    /// <param name="description">New description, or <c>null</c> to leave unchanged. Empty string clears it.</param>
+    /// <param name="parentTemplateId"><c>null</c> to leave unchanged; a non-null value must match the existing parent (cannot be changed).</param>
     /// <param name="user">Username of the user updating the template.</param>
     /// <param name="cancellationToken">Cancellation token.</param>
     /// <returns>Result containing the updated template or failure message.</returns>
@@ -115,15 +120,20 @@ public class TemplateService
             return Result<Template>.Failure($"Template with ID {templateId} not found.");
 
         // ParentTemplateId is immutable after creation — set once at create time.
-        // Reject any attempt to change it (null→value, value→null, or value→other).
-        if (parentTemplateId != template.ParentTemplateId)
+        // A null parentTemplateId means "leave unchanged" (an omitted CLI/API field),
+        // so only a non-null value that differs from the current parent is rejected.
+        // Immutability still holds: there is no path that mutates ParentTemplateId here.
+        if (parentTemplateId != null && parentTemplateId != template.ParentTemplateId)
         {
             return Result<Template>.Failure(
                 "Parent template cannot be changed after creation.");
         }
 
         template.Name = name;
-        template.Description = description;
+        // Leave-unchanged semantics: only overwrite the description when a value is
+        // supplied. null = not provided (keep existing); "" = explicit clear.
+        if (description != null)
+            template.Description = description;
 
         // Check for naming collisions after the change
         var collisionResult = await ValidateCollisionsAsync(template, cancellationToken);