An auditor asks: "What did this template say when it issued that certificate, eighteen months ago?" In most systems the honest answer is a shrug — the template was edited in place a dozen times since. In goca the answer is a lookup.
Templates are immutable versions: saving under an existing name creates version N+1, and every certificate records the exact template version that issued it (the inventory row shows template vN). Every version is kept, forever: GET /v1/templates/{name}/versions lists the history — version, author, timestamp — and ?version=N on the document endpoint returns version N exactly as saved.
Rollback follows the same discipline. In the console, History… lists versions and Load puts any of them into the editor — loading changes nothing. To roll back, load the good version and Save version: its content becomes a new version, attributed to you, audited, validated like any other save. There is no in-place restore, and no template delete, for the same reason: an edit that rewrites history is an edit the audit log can't explain.
One nuance: templates are checked at save, not first issuance — but saving over an already-broken template succeeds with a warning, because that save is probably the repair.
Now I can answer "what did this template say when it issued that cert?" with a version number.