feat(cli+templateengine+deploymanager): resolve follow-ups #4/#5/#6/#8 — CLI ergonomics + structured deploy validation error

Closes the four remaining items in the 2026-06-24 template-inheritance/CLI
follow-up tracker.

#4 — CLI `instance set-bindings` can now set DataSourceReferenceOverride.
  `--bindings` accepts an optional 3rd element per entry:
  [attributeName, dataConnectionId, dataSourceReferenceOverride]. A string
  sets the override; a JSON null or an omitted 3rd element leaves it unset
  (template default). TryParseBindings accepts 2- or 3-element entries and
  rejects a non-string/non-null 3rd element or 4+ elements with a clean
  error. Previously the CLI sent the override as null and silently wiped any
  existing one (only a raw POST /management could set it).

#5 — `template update` is partial, not full-replace (fixed server-side so all
  clients benefit). UpdateTemplateAsync now uses leave-unchanged semantics:
  a null description keeps the stored value (pass "" to clear); a null
  parentTemplateId keeps the existing parent. Parent stays immutable — a
  non-null differing value is still rejected — but omitting --parent-id is
  now a no-op instead of failing every derived-template update.

#6 — compact `template list`/`get` table output + `--detail`. Table output is
  now id/name/description/parent/derived + member counts (#attrs/#alarms/
  #scripts/#comps/#nativeAlarms) via TemplateTableProjection, fed through a
  new optional tableProjector seam on CommandHelpers. `--detail` restores the
  full dump. JSON output is left untouched (always full) so machine consumers
  are unaffected — the projector only runs on the table path.

#8 — structured deploy-time validation error. New ValidationResult.SummarizeErrors()
  (Commons) returns a grouped, capped summary: leading total count, one line
  per ValidationCategory, and a per-module rollup (canonical name up to its
  last dot) with counts + "... and N more module(s)" caps. DeploymentService
  uses it for the "Pre-deployment validation failed" message and logs the full
  per-entry list via LogWarning. Replaces the flat semicolon-joined dump that
  became a wall of text for instances with 50-194 unbound attributes.

Tests: +8 Commons (SummarizeErrors), +8 CLI (4 binding 3-element / 4 table
projection), +2 net TemplateEngine (partial-update). Affected suites green:
Commons 587, CLI 341, TemplateEngine 447, DeploymentManager 101,
ManagementService 230, CentralUI 866; full solution builds 0/0.

Docs: Component-DeploymentManager.md "Validation Error Reporting"; CLI README
(set-bindings 3-element form, template update leave-unchanged, list/get
--detail); UpdateTemplateCommand doc; known-issues tracker #4/#5/#6/#8 resolved
(all 8 items now closed).

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/CommandHelpers.cs

@@ -30,6 +30,13 @@ internal static class CommandHelpers
     /// (<see cref="IsAuthorizationFailure"/>) is preserved on the error path either way,
     /// closing CLI-017's regression.
     /// </param>
+    /// <param name="tableProjector">
+    /// Optional transform applied to the success JSON body <em>only</em> when the resolved
+    /// format is <c>table</c>. Lets a command render a compact table projection (e.g.
+    /// <c>template list</c> dropping per-template attribute dumps, followup #6) while
+    /// leaving JSON output untouched for machine consumers. Ignored when
+    /// <paramref name="onSuccess"/> is supplied.
+    /// </param>
     /// <returns>A task that resolves to the process exit code (0 = success, 1 = error, 2 = authorization failure).</returns>
     internal static async Task<int> ExecuteCommandAsync(
         ParseResult result,
@@ -39,7 +46,8 @@ internal static class CommandHelpers
         Option<string> passwordOption,
         object command,
         TimeSpan? timeout = null,
-        Func<string, int>? onSuccess = null)
+        Func<string, int>? onSuccess = null,
+        Func<string, string>? tableProjector = null)
     {
         var config = CliConfig.Load();
         var format = ResolveFormat(result, formatOption, config);
@@ -98,7 +106,7 @@ internal static class CommandHelpers
             return IsAuthorizationFailure(response) ? 2 : 1;
         }
 
-        return HandleResponse(response, format);
+        return HandleResponse(response, format, tableProjector);
     }
 
     /// <summary>
@@ -158,8 +166,12 @@ internal static class CommandHelpers
     /// </summary>
     /// <param name="response">Response received from the management API.</param>
     /// <param name="format">Output format (<c>json</c> or <c>table</c>).</param>
+    /// <param name="tableProjector">
+    /// Optional transform applied to the JSON body before table rendering only — JSON
+    /// output is never altered. See <see cref="ExecuteCommandAsync"/>.
+    /// </param>
     /// <returns>The process exit code (0 = success, 1 = error, 2 = authorization failure).</returns>
-    internal static int HandleResponse(ManagementResponse response, string format)
+    internal static int HandleResponse(ManagementResponse response, string format, Func<string, string>? tableProjector = null)
     {
         if (response.JsonData != null)
         {
@@ -173,7 +185,11 @@ internal static class CommandHelpers
 
             if (string.Equals(format, "table", StringComparison.OrdinalIgnoreCase))
             {
-                WriteAsTable(response.JsonData);
+                // A table projector compacts the body for terminal display (e.g. dropping
+                // per-template attribute dumps). JSON output stays full/untouched so
+                // machine consumers keep the complete payload.
+                var body = tableProjector != null ? tableProjector(response.JsonData) : response.JsonData;
+                WriteAsTable(body);
             }
             else
             {

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/InstanceCommands.cs

@@ -54,7 +54,18 @@ public static class InstanceCommands
     private static Command BuildSetBindings(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
-        var bindingsOption = new Option<string>("--bindings") { Description = "JSON array of [attributeName, dataConnectionId] pairs", Required = true };
+        var bindingsOption = new Option<string>("--bindings")
+        {
+            Description = "JSON array of binding entries. Each entry is either " +
+                          "[attributeName, dataConnectionId] or " +
+                          "[attributeName, dataConnectionId, dataSourceReferenceOverride] " +
+                          "(the 3rd element overrides the attribute's data-source reference; " +
+                          "pass null or omit it to use the template default). " +
+                          "NOTE: this REPLACES all bindings for the instance — include the " +
+                          "override on every entry that needs one, or omitting it clears any " +
+                          "previously-set override.",
+            Required = true
+        };
 
         var cmd = new Command("set-bindings") { Description = "Set data connection bindings for an instance" };
         cmd.Add(idOption);
@@ -76,11 +87,16 @@ public static class InstanceCommands
     }
 
     /// <summary>
-    /// Parses the <c>--bindings</c> argument — a JSON array of
-    /// <c>[attributeName, dataConnectionId]</c> pairs — into a typed list.
-    /// Returns <c>false</c> with a descriptive <paramref name="error"/> instead of
-    /// throwing when the JSON is malformed, a pair has the wrong arity, or an element
-    /// has the wrong type.
+    /// Parses the <c>--bindings</c> argument — a JSON array of binding entries — into a
+    /// typed list. Each entry is either a two-element
+    /// <c>[attributeName, dataConnectionId]</c> pair or a three-element
+    /// <c>[attributeName, dataConnectionId, dataSourceReferenceOverride]</c> triple. The
+    /// optional third element carries the per-instance data-source reference override
+    /// (<see cref="ConnectionBinding.DataSourceReferenceOverride"/>); a JSON
+    /// <c>null</c> (or an omitted third element) leaves it unset so the template default
+    /// applies. Returns <c>false</c> with a descriptive <paramref name="error"/> instead
+    /// of throwing when the JSON is malformed, an entry has the wrong arity, or an
+    /// element has the wrong type.
     /// </summary>
     /// <param name="json">The JSON string to parse.</param>
     /// <param name="bindings">The parsed bindings list, or null if parsing fails.</param>
@@ -99,16 +115,19 @@ public static class InstanceCommands
                 .Deserialize<List<List<System.Text.Json.JsonElement>>>(json);
             if (pairs == null)
             {
-                error = "Bindings JSON must be a non-null array of [attributeName, dataConnectionId] pairs.";
+                error = "Bindings JSON must be a non-null array of "
+                    + "[attributeName, dataConnectionId] or "
+                    + "[attributeName, dataConnectionId, dataSourceReferenceOverride] entries.";
                 return false;
             }
 
             var result = new List<ConnectionBinding>(pairs.Count);
             foreach (var pair in pairs)
             {
-                if (pair.Count != 2)
+                if (pair.Count is not (2 or 3))
                 {
-                    error = "Each binding must be a [attributeName, dataConnectionId] pair of exactly two elements.";
+                    error = "Each binding must be a [attributeName, dataConnectionId] pair, "
+                        + "optionally with a third dataSourceReferenceOverride element.";
                     return false;
                 }
                 if (pair[0].ValueKind != System.Text.Json.JsonValueKind.String)
@@ -122,7 +141,24 @@ public static class InstanceCommands
                     error = "The second element of each binding (dataConnectionId) must be an integer.";
                     return false;
                 }
-                result.Add(new ConnectionBinding(pair[0].GetString()!, connectionId));
+
+                string? referenceOverride = null;
+                if (pair.Count == 3)
+                {
+                    var third = pair[2];
+                    if (third.ValueKind == System.Text.Json.JsonValueKind.String)
+                    {
+                        referenceOverride = third.GetString();
+                    }
+                    else if (third.ValueKind != System.Text.Json.JsonValueKind.Null)
+                    {
+                        error = "The third element of each binding (dataSourceReferenceOverride) "
+                            + "must be a string or null.";
+                        return false;
+                    }
+                }
+
+                result.Add(new ConnectionBinding(pair[0].GetString()!, connectionId, referenceOverride));
             }
 
             bindings = result;

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/TemplateCommands.cs

@@ -54,11 +54,19 @@ public static class TemplateCommands
 
     private static Command BuildList(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
-        var cmd = new Command("list") { Description = "List all templates" };
+        var detailOption = new Option<bool>("--detail")
+        {
+            Description = "Include full template definitions (all attributes/alarms/scripts) in table output. "
+                + "Without it, table output is a compact summary (counts only). JSON output is always full."
+        };
+        var cmd = new Command("list") { Description = "List all templates (compact table summary; use --detail for the full dump)" };
+        cmd.Add(detailOption);
         cmd.SetAction(async (ParseResult result) =>
         {
+            var detail = result.GetValue(detailOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, urlOption, formatOption, usernameOption, passwordOption, new ListTemplatesCommand());
+                result, urlOption, formatOption, usernameOption, passwordOption, new ListTemplatesCommand(),
+                tableProjector: detail ? null : TemplateTableProjection.ProjectSummary);
         });
         return cmd;
     }
@@ -66,13 +74,21 @@ public static class TemplateCommands
     private static Command BuildGet(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Template ID", Required = true };
-        var cmd = new Command("get") { Description = "Get a template by ID" };
+        var detailOption = new Option<bool>("--detail")
+        {
+            Description = "Include full template definitions (all attributes/alarms/scripts) in table output. "
+                + "Without it, table output is a compact summary (counts only). JSON output is always full."
+        };
+        var cmd = new Command("get") { Description = "Get a template by ID (compact table summary; use --detail for the full dump)" };
         cmd.Add(idOption);
+        cmd.Add(detailOption);
         cmd.SetAction(async (ParseResult result) =>
         {
             var id = result.GetValue(idOption);
+            var detail = result.GetValue(detailOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, urlOption, formatOption, usernameOption, passwordOption, new GetTemplateCommand(id));
+                result, urlOption, formatOption, usernameOption, passwordOption, new GetTemplateCommand(id),
+                tableProjector: detail ? null : TemplateTableProjection.ProjectSummary);
         });
         return cmd;
     }
@@ -103,10 +119,10 @@ public static class TemplateCommands
     {
         var idOption = new Option<int>("--id") { Description = "Template ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "Template name", Required = true };
-        var descOption = new Option<string?>("--description") { Description = "Template description" };
-        var parentOption = new Option<int?>("--parent-id") { Description = "Parent template ID" };
+        var descOption = new Option<string?>("--description") { Description = "Template description. Omit to leave unchanged; pass an empty string (\"\") to clear it." };
+        var parentOption = new Option<int?>("--parent-id") { Description = "Parent template ID. Immutable after creation; omit to leave unchanged." };
 
-        var cmd = new Command("update") { Description = "Update a template" };
+        var cmd = new Command("update") { Description = "Update a template (omitted optional fields are left unchanged)" };
         cmd.Add(idOption);
         cmd.Add(nameOption);
         cmd.Add(descOption);

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/TemplateTableProjection.cs

@@ -0,0 +1,112 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace ZB.MOM.WW.ScadaBridge.CLI.Commands;
+
+/// <summary>
+/// Compact table projection for <c>template list</c> / <c>template get</c> (followup #6).
+/// The management API returns full <c>Template</c> entities — every attribute, alarm,
+/// script, and composition inline — which the generic table renderer dumps as one giant
+/// cell per template (~171 KB for a real catalogue, unusable in a terminal). This
+/// projector reduces each template to id / name / description / parent / derived plus
+/// member <em>counts</em>, leaving JSON output untouched (callers pass this only on the
+/// table path) and the full dump available via the command's <c>--detail</c> flag.
+/// </summary>
+internal static class TemplateTableProjection
+{
+    /// <summary>
+    /// Projects a templates JSON response (an array from <c>list</c> or a single object
+    /// from <c>get</c>) to its compact summary form. Returns the input unchanged when it
+    /// is not JSON or not the expected shape, so the generic renderer's own fallbacks
+    /// still apply.
+    /// </summary>
+    /// <param name="json">The raw success JSON body from the management API.</param>
+    /// <returns>Compact JSON (same array/object shape) suitable for table rendering.</returns>
+    internal static string ProjectSummary(string json)
+    {
+        JsonDocument doc;
+        try
+        {
+            doc = JsonDocument.Parse(json);
+        }
+        catch (JsonException)
+        {
+            // Not JSON (e.g. a proxy error page) — let the renderer print it verbatim.
+            return json;
+        }
+
+        using (doc)
+        {
+            var root = doc.RootElement;
+            if (root.ValueKind == JsonValueKind.Array)
+            {
+                var arr = new JsonArray();
+                foreach (var item in root.EnumerateArray())
+                    arr.Add(ProjectElement(item));
+                return arr.ToJsonString();
+            }
+            if (root.ValueKind == JsonValueKind.Object)
+            {
+                return ProjectElement(root).ToJsonString();
+            }
+            return json;
+        }
+    }
+
+    /// <summary>Projects a single template object to its compact summary node.</summary>
+    private static JsonNode ProjectElement(JsonElement element)
+    {
+        if (element.ValueKind != JsonValueKind.Object)
+            return JsonValue.Create(element.ToString())!;
+
+        // JsonObject preserves insertion order, fixing the column order for the table.
+        return new JsonObject
+        {
+            ["id"] = Int(element, "id"),
+            ["name"] = Str(element, "name"),
+            ["description"] = Str(element, "description"),
+            ["parentTemplateId"] = Int(element, "parentTemplateId"),
+            ["isDerived"] = Bool(element, "isDerived"),
+            ["#attrs"] = Count(element, "attributes"),
+            ["#alarms"] = Count(element, "alarms"),
+            ["#scripts"] = Count(element, "scripts"),
+            ["#comps"] = Count(element, "compositions"),
+            ["#nativeAlarms"] = Count(element, "nativeAlarmSources"),
+        };
+    }
+
+    private static bool TryGetPropertyCI(JsonElement obj, string name, out JsonElement value)
+    {
+        foreach (var prop in obj.EnumerateObject())
+        {
+            if (string.Equals(prop.Name, name, StringComparison.OrdinalIgnoreCase))
+            {
+                value = prop.Value;
+                return true;
+            }
+        }
+        value = default;
+        return false;
+    }
+
+    private static JsonNode? Str(JsonElement obj, string name)
+        => TryGetPropertyCI(obj, name, out var v) && v.ValueKind == JsonValueKind.String
+            ? JsonValue.Create(v.GetString())
+            : null;
+
+    private static JsonNode? Int(JsonElement obj, string name)
+        => TryGetPropertyCI(obj, name, out var v) && v.ValueKind == JsonValueKind.Number && v.TryGetInt32(out var n)
+            ? JsonValue.Create(n)
+            : null;
+
+    private static JsonNode? Bool(JsonElement obj, string name)
+        => TryGetPropertyCI(obj, name, out var v) && (v.ValueKind == JsonValueKind.True || v.ValueKind == JsonValueKind.False)
+            ? JsonValue.Create(v.GetBoolean())
+            : null;
+
+    private static JsonNode Count(JsonElement obj, string name)
+        => JsonValue.Create(
+            TryGetPropertyCI(obj, name, out var v) && v.ValueKind == JsonValueKind.Array
+                ? v.GetArrayLength()
+                : 0);
+}