The "where do the packages even come from" section is the part I'd want more detail on. For a template pinning an exact version that's already been yanked or deprecated on the registry, does the CDN resolution just fail at that point, or do you keep some kind of version snapshot cache so old templates stay openable even after upstream changes?