@@ -277,10 +277,13 @@ describe("prebuild", () => {
         workloadType: "MICROVM",
         orgFlags: { [FEATURE_FLAG.computeTemplatePrebuildWait]: true },
       });
+      const row = await createDeployment(prisma, project);
       const service = new TemplatePrebuildService(prisma, config({ url: server.url }));
       const result = await service.prebuild({
-        ...deployment,
         projectId: project.id,
+        deploymentId: row.id,
+        deploymentFriendlyId: row.friendlyId,
+        imageReference: IMAGE,
         imageDigest: DIGEST,
       });
 
@@ -291,7 +294,7 @@ describe("prebuild", () => {
         image: `${IMAGE}@${DIGEST}`,
         machine_configs: [{ cpus: 0.5, memory_mb: 512 }],
         no_snap: true,
-        deployment_id: "deployment_abc",
+        deployment_id: row.friendlyId,
       });
     } finally {
       await server.close();
@@ -385,20 +388,23 @@ describe("prebuild", () => {
   });
 
   postgresTest("does not wait on a CLI that stops reading logs", async ({ prisma }) => {
-    const server = await builder(reply(201, { template_source: "built" }));
+    const server = await builder(reply(201, { template_id: TEMPLATE_KEY }));
     try {
       const project = await createProject(prisma, {
         workloadType: "MICROVM",
         orgFlags: { [FEATURE_FLAG.computeTemplatePrebuildWait]: true },
       });
+      const row = await createDeployment(prisma, project);
       // A sink that never accepts a chunk, so each write stays pending.
       const writer = new WritableStream<string>({
         write: () => new Promise<void>(() => {}),
       }).getWriter();
       const service = new TemplatePrebuildService(prisma, config({ url: server.url }));
       const result = await service.prebuild({
-        ...deployment,
         projectId: project.id,
+        deploymentId: row.id,
+        deploymentFriendlyId: row.friendlyId,
+        imageReference: IMAGE,
         imageDigest: DIGEST,
         writer,
       });
@@ -454,13 +460,17 @@ describe("prebuild", () => {
         workloadType: "MICROVM",
         orgFlags: { [FEATURE_FLAG.computeTemplatePrebuildWait]: true },
       });
+      const row = await createDeployment(prisma, project);
       const service = new TemplatePrebuildService(prisma, config({ url: server.url }));
       const result = await service.prebuild({
-        ...deployment,
         projectId: project.id,
+        deploymentId: row.id,
+        deploymentFriendlyId: row.friendlyId,
+        imageReference: IMAGE,
         imageDigest: DIGEST,
       });
       expect(result.outcome).toBe("already_there");
+      expect(await storedTemplateKey(prisma, row.id)).toBe("a".repeat(64));
     } finally {
       await server.close();
     }
@@ -542,10 +552,11 @@ describe("prebuild", () => {
           imageReference: `${IMAGE}@sha256:${"b".repeat(64)}`,
         });
         const service = new TemplatePrebuildService(prisma, config({ url: server.url }));
-        await service.build(`${IMAGE}@${DIGEST}`, "shadow", {
+        const result = await service.build(`${IMAGE}@${DIGEST}`, "shadow", {
           id: row.id,
           friendlyId: row.friendlyId,
         });
+        expect(result).toEqual({ outcome: "failed", reason: "not_stored" });
         expect(await storedTemplateKey(prisma, row.id)).toBeNull();
       } finally {
         await server.close();
@@ -591,7 +602,8 @@ describe("prebuild", () => {
         imageReference: IMAGE,
         imageDigest: DIGEST,
       });
-      expect(result.outcome).toBe("built");
+      // The key is not known to be stored yet, so the caller sees a timeout.
+      expect(result.outcome).toBe("timeout");
       expect(Date.now() - startedAt).toBeLessThan(5_000);
 
       release!();
@@ -628,7 +640,7 @@ describe("prebuild", () => {
             imageReference: IMAGE,
             imageDigest: DIGEST,
           });
-          expect(result.outcome).toBe("built");
+          expect(result.outcome).toBe("failed");
         }
         expect(await storedTemplateKey(prisma, fresh.id)).toBeNull();
         expect(await storedTemplateKey(prisma, existing.id)).toBe(TEMPLATE_KEY);
@@ -771,6 +783,123 @@ describe("requestBuilds", () => {
     }
   });
 
+  postgresTest(
+    "reports a stored key the mirror already had as already_there",
+    async ({ prisma }) => {
+      const server = await builder(
+        reply(200, { template_id: TEMPLATE_KEY, template_source: "mirror" })
+      );
+      try {
+        const project = await createProject(prisma);
+        const row = await createDeployment(prisma, project, {
+          status: "DEPLOYED",
+          imageReference: PINNED,
+        });
+        const service = new TemplatePrebuildService(prisma, config({ url: server.url }));
+
+        const [result] = await service.requestBuilds({ deploymentIds: [row.id] });
+
+        expect(result).toEqual({
+          deploymentId: row.id,
+          friendlyId: row.friendlyId,
+          outcome: "already_there",
+        });
+        expect(await storedTemplateKey(prisma, row.id)).toBe(TEMPLATE_KEY);
+      } finally {
+        await server.close();
+      }
+    }
+  );
+
+  postgresTest("reports an invalid template id as failed", async ({ prisma }) => {
+    const server = await builder(reply(200, { template_id: "not-a-key" }));
+    try {
+      const project = await createProject(prisma);
+      const row = await createDeployment(prisma, project, {
+        status: "DEPLOYED",
+        imageReference: PINNED,
+      });
+      const service = new TemplatePrebuildService(prisma, config({ url: server.url }));
+
+      const [result] = await service.requestBuilds({ deploymentIds: [row.id] });
+
+      expect(result).toEqual({
+        deploymentId: row.id,
+        friendlyId: row.friendlyId,
+        outcome: "failed",
+        reason: "invalid_template_id",
+      });
+      expect(await storedTemplateKey(prisma, row.id)).toBeNull();
+    } finally {
+      await server.close();
+    }
+  });
+
+  postgresTest("reports failed when the store guard matches no row", async ({ prisma }) => {
+    const project = await createProject(prisma);
+    const row = await createDeployment(prisma, project, {
+      status: "DEPLOYED",
+      imageReference: PINNED,
+    });
+    // The deployment's image changes while the builder works, so the guard rejects the write.
+    const server = await builder((req, body, res) => {
+      prisma.workerDeployment
+        .update({
+          where: { id: row.id },
+          data: { imageReference: `${IMAGE}@sha256:${"b".repeat(64)}` },
+        })
+        .then(() => reply(200, { template_id: TEMPLATE_KEY })(req, body, res));
+    });
+    try {
+      const service = new TemplatePrebuildService(prisma, config({ url: server.url }));
+
+      const [result] = await service.requestBuilds({ deploymentIds: [row.id] });
+
+      expect(result).toEqual({
+        deploymentId: row.id,
+        friendlyId: row.friendlyId,
+        outcome: "failed",
+        reason: "not_stored",
+      });
+      expect(await storedTemplateKey(prisma, row.id)).toBeNull();
+    } finally {
+      await server.close();
+    }
+  });
+
+  postgresTest("reports failed when the key write errors", async ({ prisma }) => {
+    const server = await builder(reply(200, { template_id: TEMPLATE_KEY }));
+    try {
+      const project = await createProject(prisma);
+      const row = await createDeployment(prisma, project, {
+        status: "DEPLOYED",
+        imageReference: PINNED,
+      });
+
+      // A read-only transaction lets the lookup through but makes the update fail.
+      const results = await $transaction(
+        prisma,
+        "readOnlyTemplateStore",
+        async (tx) => {
+          await tx.$executeRaw`SET TRANSACTION READ ONLY`;
+          const service = new TemplatePrebuildService(tx, config({ url: server.url }));
+          return service.requestBuilds({ deploymentIds: [row.id] });
+        },
+        { timeout: 30_000 }
+      );
+
+      expect(results?.[0]).toEqual({
+        deploymentId: row.id,
+        friendlyId: row.friendlyId,
+        outcome: "failed",
+        reason: "store_error",
+      });
+      expect(await storedTemplateKey(prisma, row.id)).toBeNull();
+    } finally {
+      await server.close();
+    }
+  });
+
   postgresTest("skips every deployment when no builder is configured", async ({ prisma }) => {
     const project = await createProject(prisma);
     const row = await createDeployment(prisma, project, {
 
@@ -37,11 +37,18 @@ export type TemplateBuildOutcome =
 
 type TemplateBuildRequestSkip = "no_builder" | "has_key" | "no_pinned_image";
 
+/** Why a 2xx from the builder still ended as `failed`: the key was not written. */
+export type TemplateKeyStoreFailure = "invalid_template_id" | "not_stored" | "store_error";
+
+export type TemplateBuildResult =
+  | { outcome: Exclude<TemplateBuildOutcome, "failed"> }
+  | { outcome: "failed"; reason?: TemplateKeyStoreFailure };
+
 export type TemplateBuildRequestResult = {
   deploymentId: string;
   friendlyId?: string;
 } & (
-  | { outcome: TemplateBuildOutcome }
+  | TemplateBuildResult
   | { outcome: "skipped"; reason: TemplateBuildRequestSkip }
   | { outcome: "not_found" }
 );
@@ -183,7 +190,7 @@ export class TemplatePrebuildService {
           `event: log\ndata: ${JSON.stringify({ message: "Building compute template..." })}\n\n`
         )
         .catch(() => {});
-      return { mode, reason, outcome: await build };
+      return { mode, reason, outcome: (await build).outcome };
     } catch (error) {
       logger.error("Template prebuild failed before calling the builder", {
         deploymentId: options.deploymentFriendlyId,
@@ -324,27 +331,28 @@ export class TemplatePrebuildService {
     if (!image) {
       return { ...base, outcome: "skipped", reason: "no_pinned_image" };
     }
-    const outcome = await this.build(image, "shadow", {
+    const result = await this.build(image, "shadow", {
       id: deployment.id,
       friendlyId: deployment.friendlyId,
     });
-    return { ...base, outcome };
+    return { ...base, ...result };
   }
 
   /**
    * Call the builder once and store the template key on success. Resolves with
-   * the outcome; never rejects.
+   * the outcome, which is `failed` when the key was not written; never rejects.
    */
   async build(
     image: string,
     mode: Exclude<TemplatePrebuildMode, "skip">,
     deployment: { id: string; friendlyId: string }
-  ): Promise<TemplateBuildOutcome> {
+  ): Promise<TemplateBuildResult> {
     const startedAt = performance.now();
     const body = templateCreateRequest(image, this.config.presets, deployment.friendlyId);
     const log = { deploymentId: deployment.friendlyId, image, mode };
 
     let outcome: TemplateBuildOutcome;
+    let reason: TemplateKeyStoreFailure | undefined;
     try {
       const response = await fetch(new URL("/templates", this.config.url).toString(), {
         method: "POST",
@@ -372,10 +380,22 @@ export class TemplatePrebuildService {
           squashfsMs: parsed?.squashfs_ms,
         });
         // The write keeps going if it outlasts the timeout, but wait mode stops waiting.
-        await withinBudget(
-          this.storeTemplateKey(deployment.id, image, parsed?.template_id, log),
-          this.config.timeoutMs - (performance.now() - startedAt)
+        const remaining = () => this.config.timeoutMs - (performance.now() - startedAt);
+        const write = this.storeTemplateKey(deployment.id, image, parsed?.template_id, log);
+        const cached = write.then((result) =>
+          result === "stored"
+            ? this.cacheTemplateKey(deployment.id, parsed?.template_id as string, log)
+            : undefined
         );
+        const stored = await withinBudget(write, remaining());
+        // The cache is best effort, so a slow cache never changes the outcome.
+        await withinBudget(cached, remaining());
+        if (stored === undefined) {
+          outcome = "timeout";
+        } else if (stored !== "stored") {
+          outcome = "failed";
+          reason = stored;
+        }
       } else {
         outcome = response.status === 429 ? "rate_limited" : "failed";
         logger.error("Template prebuild failed", {
@@ -398,7 +418,7 @@ export class TemplatePrebuildService {
     const attributes = { outcome, mode };
     telemetry.calls.add(1, attributes);
     telemetry.duration.record(performance.now() - startedAt, attributes);
-    return outcome;
+    return outcome === "failed" ? { outcome, reason } : { outcome };
   }
 
   // In shadow mode the deployment may already be DEPLOYED; then only store the key
@@ -408,14 +428,14 @@ export class TemplatePrebuildService {
     image: string,
     templateId: unknown,
     log: Record<string, unknown>
-  ): Promise<void> {
+  ): Promise<"stored" | TemplateKeyStoreFailure> {
     const templateKey = validTemplateKey(templateId);
     if (!templateKey) {
       logger.warn("Template prebuild returned no valid template id", {
         ...log,
         templateId: typeof templateId === "string" ? templateId.slice(0, 100) : templateId,
       });
-      return;
+      return "invalid_template_id";
     }
     try {
       const { count } = await this.prisma.workerDeployment.updateMany({
@@ -424,8 +444,25 @@ export class TemplatePrebuildService {
       });
       if (count === 0) {
         logger.warn("Template prebuild did not store the template key", { ...log, templateKey });
-        return;
+        return "not_stored";
       }
+    } catch (error) {
+      logger.error("Template prebuild could not store the template key", {
+        ...log,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return "store_error";
+    }
+    return "stored";
+  }
+
+  // The database is the source of truth; the cache refills from it.
+  private async cacheTemplateKey(
+    deploymentId: string,
+    templateKey: string,
+    log: Record<string, unknown>
+  ): Promise<void> {
+    try {
       const deployment = await this.prisma.workerDeployment.findFirst({
         where: { id: deploymentId },
         select: { workerId: true, environmentId: true },
@@ -438,23 +475,25 @@ export class TemplatePrebuildService {
         );
       }
     } catch (error) {
-      logger.error("Template prebuild could not store the template key", {
+      logger.error("Template prebuild could not cache the template key", {
         ...log,
         error: error instanceof Error ? error.message : String(error),
       });
     }
   }
 }
 
-async function withinBudget(work: Promise<void>, ms: number): Promise<void> {
+/** The work's result, or undefined when the budget runs out first. */
+async function withinBudget<T>(work: Promise<T>, ms: number): Promise<T | undefined> {
   let timer: NodeJS.Timeout | undefined;
-  await Promise.race([
+  const result = await Promise.race([
     work,
-    new Promise<void>((resolve) => {
-      timer = setTimeout(resolve, Math.max(0, ms));
+    new Promise<undefined>((resolve) => {
+      timer = setTimeout(() => resolve(undefined), Math.max(0, ms));
     }),
   ]);
   clearTimeout(timer);
+  return result;
 }
 
 function parseResponse(text: string): TemplateCreateResponse | undefined {