feat(cli+templateengine+deploymanager): resolve follow-ups #4/#5/#6/#8 — CLI ergonomics + structured deploy validation error

Closes the four remaining items in the 2026-06-24 template-inheritance/CLI
follow-up tracker.

#4 — CLI `instance set-bindings` can now set DataSourceReferenceOverride.
  `--bindings` accepts an optional 3rd element per entry:
  [attributeName, dataConnectionId, dataSourceReferenceOverride]. A string
  sets the override; a JSON null or an omitted 3rd element leaves it unset
  (template default). TryParseBindings accepts 2- or 3-element entries and
  rejects a non-string/non-null 3rd element or 4+ elements with a clean
  error. Previously the CLI sent the override as null and silently wiped any
  existing one (only a raw POST /management could set it).

#5 — `template update` is partial, not full-replace (fixed server-side so all
  clients benefit). UpdateTemplateAsync now uses leave-unchanged semantics:
  a null description keeps the stored value (pass "" to clear); a null
  parentTemplateId keeps the existing parent. Parent stays immutable — a
  non-null differing value is still rejected — but omitting --parent-id is
  now a no-op instead of failing every derived-template update.

#6 — compact `template list`/`get` table output + `--detail`. Table output is
  now id/name/description/parent/derived + member counts (#attrs/#alarms/
  #scripts/#comps/#nativeAlarms) via TemplateTableProjection, fed through a
  new optional tableProjector seam on CommandHelpers. `--detail` restores the
  full dump. JSON output is left untouched (always full) so machine consumers
  are unaffected — the projector only runs on the table path.

#8 — structured deploy-time validation error. New ValidationResult.SummarizeErrors()
  (Commons) returns a grouped, capped summary: leading total count, one line
  per ValidationCategory, and a per-module rollup (canonical name up to its
  last dot) with counts + "... and N more module(s)" caps. DeploymentService
  uses it for the "Pre-deployment validation failed" message and logs the full
  per-entry list via LogWarning. Replaces the flat semicolon-joined dump that
  became a wall of text for instances with 50-194 unbound attributes.

Tests: +8 Commons (SummarizeErrors), +8 CLI (4 binding 3-element / 4 table
projection), +2 net TemplateEngine (partial-update). Affected suites green:
Commons 587, CLI 341, TemplateEngine 447, DeploymentManager 101,
ManagementService 230, CentralUI 866; full solution builds 0/0.

Docs: Component-DeploymentManager.md "Validation Error Reporting"; CLI README
(set-bindings 3-element form, template update leave-unchanged, list/get
--detail); UpdateTemplateCommand doc; known-issues tracker #4/#5/#6/#8 resolved
(all 8 items now closed).

tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/InstanceArgumentParsingTests.cs

@@ -64,6 +64,58 @@ public class InstanceArgumentParsingTests
         Assert.NotNull(error);
     }
 
+    [Fact]
+    public void ParseBindings_ThreeElementForm_CapturesReferenceOverride()
+    {
+        // The optional 3rd element carries the per-instance data-source reference
+        // override (followup #4) so the CLI can SET it instead of always wiping it.
+        var ok = InstanceCommands.TryParseBindings(
+            "[[\"Speed\", 5, \"ns=2;s=Spd\"], [\"Mode\", 7]]", out var bindings, out var error);
+
+        Assert.True(ok);
+        Assert.Null(error);
+        Assert.Equal(2, bindings!.Count);
+        Assert.Equal(new ConnectionBinding("Speed", 5, "ns=2;s=Spd"), bindings[0]);
+        // A 2-element entry still leaves the override null (template default applies).
+        Assert.Equal(new ConnectionBinding("Mode", 7, null), bindings[1]);
+        Assert.Null(bindings[1].DataSourceReferenceOverride);
+    }
+
+    [Fact]
+    public void ParseBindings_ThirdElementExplicitNull_LeavesOverrideUnset()
+    {
+        var ok = InstanceCommands.TryParseBindings(
+            "[[\"Speed\", 5, null]]", out var bindings, out var error);
+
+        Assert.True(ok);
+        Assert.Null(error);
+        Assert.Single(bindings!);
+        Assert.Null(bindings![0].DataSourceReferenceOverride);
+    }
+
+    [Fact]
+    public void ParseBindings_ThirdElementWrongType_ReturnsErrorNotException()
+    {
+        // A non-string, non-null 3rd element is rejected with a clean error.
+        var ok = InstanceCommands.TryParseBindings(
+            "[[\"Speed\", 5, 99]]", out var bindings, out var error);
+
+        Assert.False(ok);
+        Assert.Null(bindings);
+        Assert.NotNull(error);
+    }
+
+    [Fact]
+    public void ParseBindings_FourElements_ReturnsErrorNotException()
+    {
+        var ok = InstanceCommands.TryParseBindings(
+            "[[\"Speed\", 5, \"ref\", \"extra\"]]", out var bindings, out var error);
+
+        Assert.False(ok);
+        Assert.Null(bindings);
+        Assert.NotNull(error);
+    }
+
     [Fact]
     public void ParseOverrides_ValidJson_ReturnsDictionary()
     {

tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/TemplateTableProjectionTests.cs

@@ -0,0 +1,122 @@
+using System.Text.Json;
+using ZB.MOM.WW.ScadaBridge.CLI.Commands;
+
+namespace ZB.MOM.WW.ScadaBridge.CLI.Tests;
+
+/// <summary>
+/// Tests for the compact <c>template list</c>/<c>get</c> table projection (followup #6):
+/// the full per-template attribute/alarm/script dumps are collapsed to counts so table
+/// output is usable in a terminal, while the array/object shape is preserved.
+/// </summary>
+public class TemplateTableProjectionTests
+{
+    private const string ListJson = """
+    [
+      {
+        "id": 3,
+        "name": "MESReceiver",
+        "description": "base",
+        "parentTemplateId": null,
+        "isDerived": false,
+        "attributes": [ {"id":1},{"id":2},{"id":3} ],
+        "alarms": [ {"id":10} ],
+        "scripts": [ {"id":20},{"id":21} ],
+        "compositions": [],
+        "nativeAlarmSources": []
+      },
+      {
+        "id": 5,
+        "name": "LeftMESReceiver",
+        "description": null,
+        "parentTemplateId": 3,
+        "isDerived": false,
+        "attributes": [ {"id":1} ],
+        "alarms": [],
+        "scripts": [],
+        "compositions": [ {"id":99} ],
+        "nativeAlarmSources": [ {"id":7} ]
+      }
+    ]
+    """;
+
+    [Fact]
+    public void ProjectSummary_Array_DropsMemberArraysAndKeepsCounts()
+    {
+        var compact = TemplateTableProjection.ProjectSummary(ListJson);
+
+        using var doc = JsonDocument.Parse(compact);
+        var root = doc.RootElement;
+        Assert.Equal(JsonValueKind.Array, root.ValueKind);
+        Assert.Equal(2, root.GetArrayLength());
+
+        var first = root[0];
+        Assert.Equal(3, first.GetProperty("id").GetInt32());
+        Assert.Equal("MESReceiver", first.GetProperty("name").GetString());
+        Assert.Equal("base", first.GetProperty("description").GetString());
+        Assert.Equal(JsonValueKind.Null, first.GetProperty("parentTemplateId").ValueKind);
+        Assert.Equal(3, first.GetProperty("#attrs").GetInt32());
+        Assert.Equal(1, first.GetProperty("#alarms").GetInt32());
+        Assert.Equal(2, first.GetProperty("#scripts").GetInt32());
+        Assert.Equal(0, first.GetProperty("#comps").GetInt32());
+        Assert.Equal(0, first.GetProperty("#nativeAlarms").GetInt32());
+
+        // The full member arrays must NOT survive — that is the whole point of the projection.
+        Assert.False(first.TryGetProperty("attributes", out _));
+        Assert.False(first.TryGetProperty("scripts", out _));
+
+        var second = root[1];
+        Assert.Equal(5, second.GetProperty("id").GetInt32());
+        Assert.Equal(3, second.GetProperty("parentTemplateId").GetInt32());
+        Assert.Equal(1, second.GetProperty("#comps").GetInt32());
+        Assert.Equal(1, second.GetProperty("#nativeAlarms").GetInt32());
+        // A null description stays null (it is not invented).
+        Assert.Equal(JsonValueKind.Null, second.GetProperty("description").ValueKind);
+    }
+
+    [Fact]
+    public void ProjectSummary_SingleObject_ProducesCompactObject()
+    {
+        const string getJson = """
+        { "id": 7, "name": "ReactorSide", "description": "d", "parentTemplateId": null,
+          "isDerived": false, "attributes": [ {"id":1},{"id":2} ], "alarms": [], "scripts": [],
+          "compositions": [], "nativeAlarmSources": [] }
+        """;
+
+        var compact = TemplateTableProjection.ProjectSummary(getJson);
+
+        using var doc = JsonDocument.Parse(compact);
+        var root = doc.RootElement;
+        Assert.Equal(JsonValueKind.Object, root.ValueKind);
+        Assert.Equal(7, root.GetProperty("id").GetInt32());
+        Assert.Equal(2, root.GetProperty("#attrs").GetInt32());
+        Assert.False(root.TryGetProperty("attributes", out _));
+    }
+
+    [Fact]
+    public void ProjectSummary_NonJson_ReturnedVerbatim()
+    {
+        const string notJson = "<html>proxy error</html>";
+        Assert.Equal(notJson, TemplateTableProjection.ProjectSummary(notJson));
+    }
+
+    [Fact]
+    public void ProjectSummary_IsSubstantiallySmallerThanFullDump()
+    {
+        // Sanity check that the projection actually shrinks output (the reported symptom
+        // was ~171 KB table dumps). A template with a fat attribute array should collapse.
+        var fatAttributes = string.Join(",",
+            Enumerable.Range(0, 200).Select(i =>
+                $"{{\"id\":{i},\"name\":\"Attr{i}\",\"dataType\":\"String\",\"value\":\"some long-ish default value {i}\"}}"));
+        var fullJson = $$"""
+        [ { "id": 1, "name": "T", "description": "d", "parentTemplateId": null, "isDerived": false,
+            "attributes": [ {{fatAttributes}} ], "alarms": [], "scripts": [], "compositions": [], "nativeAlarmSources": [] } ]
+        """;
+
+        var compact = TemplateTableProjection.ProjectSummary(fullJson);
+
+        Assert.True(compact.Length * 4 < fullJson.Length,
+            $"Expected compact ({compact.Length}) to be far smaller than full ({fullJson.Length}).");
+        using var doc = JsonDocument.Parse(compact);
+        Assert.Equal(200, doc.RootElement[0].GetProperty("#attrs").GetInt32());
+    }
+}

tests/ZB.MOM.WW.ScadaBridge.Commons.Tests/Types/ValidationResultSummaryTests.cs

@@ -0,0 +1,111 @@
+using ZB.MOM.WW.ScadaBridge.Commons.Types.Flattening;
+
+namespace ZB.MOM.WW.ScadaBridge.Commons.Tests.Types;
+
+/// <summary>
+/// Tests for <see cref="ValidationResult.SummarizeErrors"/> (followup #8) — the grouped,
+/// capped summary that replaces the flat semicolon-joined deploy error dump.
+/// </summary>
+public class ValidationResultSummaryTests
+{
+    private static ValidationEntry Unbound(string canonicalName) =>
+        ValidationEntry.Error(
+            ValidationCategory.ConnectionBinding,
+            $"Attribute '{canonicalName}' has a data source reference but no connection binding.",
+            canonicalName);
+
+    [Fact]
+    public void SummarizeErrors_NoErrors_ReturnsEmpty()
+    {
+        Assert.Equal(string.Empty, ValidationResult.Success().SummarizeErrors());
+    }
+
+    [Fact]
+    public void SummarizeErrors_LeadsWithTotalCount()
+    {
+        var result = new ValidationResult
+        {
+            Errors = [Unbound("A.X"), Unbound("A.Y"), Unbound("B.Z")]
+        };
+
+        var summary = result.SummarizeErrors();
+
+        Assert.StartsWith("3 errors:", summary);
+    }
+
+    [Fact]
+    public void SummarizeErrors_SingleError_UsesSingularNoun()
+    {
+        var result = new ValidationResult { Errors = [Unbound("A.X")] };
+        Assert.StartsWith("1 error:", result.SummarizeErrors());
+    }
+
+    [Fact]
+    public void SummarizeErrors_RollsUpUnboundAttributesByModuleWithCounts()
+    {
+        // 12 + 12 unbound across two LeakTest modules — the reported wall-of-text case.
+        var errors = new List<ValidationEntry>();
+        for (var i = 0; i < 12; i++) errors.Add(Unbound($"LeftReactorSide.LeakTest.Attr{i}"));
+        for (var i = 0; i < 12; i++) errors.Add(Unbound($"RightReactorSide.LeakTest.Attr{i}"));
+
+        var summary = new ValidationResult { Errors = errors }.SummarizeErrors();
+
+        Assert.Contains("24 errors:", summary);
+        Assert.Contains("ConnectionBinding (24)", summary);
+        Assert.Contains("LeftReactorSide.LeakTest (12)", summary);
+        Assert.Contains("RightReactorSide.LeakTest (12)", summary);
+        // The full 24 individual clauses must NOT all appear inline.
+        Assert.DoesNotContain("Attr11' has a data source reference", summary);
+    }
+
+    [Fact]
+    public void SummarizeErrors_CapsModuleBreadthWithAndNMore()
+    {
+        // 10 distinct modules, cap at 3 → 7 collapsed.
+        var errors = Enumerable.Range(0, 10).Select(i => Unbound($"Module{i}.Attr")).ToList();
+
+        var summary = new ValidationResult { Errors = errors }.SummarizeErrors(maxGroups: 3);
+
+        Assert.Contains("… and 7 more module(s)", summary);
+        Assert.Contains("Module0 (1)", summary);
+    }
+
+    [Fact]
+    public void SummarizeErrors_TopLevelMember_GroupsUnderRoot()
+    {
+        var summary = new ValidationResult { Errors = [Unbound("Speed")] }.SummarizeErrors();
+        Assert.Contains("(root) (1)", summary);
+    }
+
+    [Fact]
+    public void SummarizeErrors_EntriesWithoutEntityName_FallBackToCappedMessageList()
+    {
+        var errors = Enumerable.Range(0, 5)
+            .Select(i => ValidationEntry.Error(ValidationCategory.ScriptCompilation, $"compile error {i}"))
+            .ToList();
+
+        var summary = new ValidationResult { Errors = errors }.SummarizeErrors(maxGroups: 2);
+
+        Assert.Contains("ScriptCompilation (5)", summary);
+        Assert.Contains("compile error 0", summary);
+        Assert.Contains("… and 3 more", summary);
+    }
+
+    [Fact]
+    public void SummarizeErrors_MixedCategories_ListsEachCategoryGroup()
+    {
+        var result = new ValidationResult
+        {
+            Errors =
+            [
+                Unbound("A.X"),
+                ValidationEntry.Error(ValidationCategory.NamingCollision, "dup name 'Foo'"),
+            ]
+        };
+
+        var summary = result.SummarizeErrors();
+
+        Assert.Contains("ConnectionBinding (1)", summary);
+        Assert.Contains("NamingCollision (1)", summary);
+    }
+}

tests/ZB.MOM.WW.ScadaBridge.TemplateEngine.Tests/TemplateServiceTests.cs

@@ -1286,17 +1286,39 @@ public class TemplateServiceTests
     }
 
     [Fact]
-    public async Task UpdateTemplate_ClearParent_Fails()
+    public async Task UpdateTemplate_OmittedParentAndDescription_LeavesUnchanged()
     {
-        var child = new Template("Child") { Id = 2, ParentTemplateId = 1 };
+        // Followup #5: a null parent/description means "leave unchanged" (an omitted
+        // CLI/API field), not an attempt to clear. Renaming without re-passing the
+        // description must not wipe it, and must not trip the parent-immutability guard.
+        var child = new Template("Child") { Id = 2, ParentTemplateId = 1, Description = "keep me" };
         _repoMock.Setup(r => r.GetTemplateByIdAsync(2, It.IsAny<CancellationToken>())).ReturnsAsync(child);
+        _repoMock.Setup(r => r.GetAllTemplatesAsync(It.IsAny<CancellationToken>()))
+            .ReturnsAsync(new List<Template> { child });
 
-        // Attempt to clear the parent.
-        var result = await _service.UpdateTemplateAsync(2, "Child", null, null, "admin");
+        var result = await _service.UpdateTemplateAsync(2, "ChildRenamed", null, null, "admin");
 
-        Assert.True(result.IsFailure);
-        Assert.Contains("cannot be changed", result.Error, StringComparison.OrdinalIgnoreCase);
-        _repoMock.Verify(r => r.UpdateTemplateAsync(It.IsAny<Template>(), It.IsAny<CancellationToken>()), Times.Never);
+        Assert.True(result.IsSuccess, result.IsFailure ? result.Error : null);
+        Assert.Equal("ChildRenamed", result.Value.Name);
+        Assert.Equal("keep me", result.Value.Description); // null description left unchanged
+        Assert.Equal(1, result.Value.ParentTemplateId);    // parent preserved
+        _repoMock.Verify(r => r.UpdateTemplateAsync(It.IsAny<Template>(), It.IsAny<CancellationToken>()), Times.Once);
+    }
+
+    [Fact]
+    public async Task UpdateTemplate_EmptyDescription_ClearsIt()
+    {
+        // An explicit empty string (distinct from omitted/null) clears the description.
+        var t = new Template("T") { Id = 1, Description = "old" };
+        _repoMock.Setup(r => r.GetTemplateByIdAsync(1, It.IsAny<CancellationToken>())).ReturnsAsync(t);
+        _repoMock.Setup(r => r.GetAllTemplatesAsync(It.IsAny<CancellationToken>()))
+            .ReturnsAsync(new List<Template> { t });
+
+        var result = await _service.UpdateTemplateAsync(1, "T", "", null, "admin");
+
+        Assert.True(result.IsSuccess, result.IsFailure ? result.Error : null);
+        Assert.Equal("", result.Value.Description);
+        _repoMock.Verify(r => r.UpdateTemplateAsync(It.IsAny<Template>(), It.IsAny<CancellationToken>()), Times.Once);
     }
 
     [Fact]