ValidateApiKey's fire-and-forget last_used_date UPDATE discards its error

[SyniRon]

Where

datastores/mysql.go:739 (develop @ 92afba5): on the success path, ValidateApiKey fires

go ds.Db.Exec(`UPDATE xf_cav7_api_key SET last_used_date = ? WHERE api_key = ?`, ...)

The goroutine's result and error are fully discarded — no return, no log.

Impact

• last_used_date can silently never update in production (dead column, misleading key-audit data) with zero signal.
• The side effect is unobservable, therefore untestable as written — the Phase 3: datastore behavior tests on the MariaDB harness (retire the sqlmock pattern) #120 harness suite deliberately does not assert it (see comment in datastores/auth_harness_test.go).
• In tests it races teardown of the disposable harness DB; benign today only because the error is swallowed.

Fix options

1. Minimal: log the error inside the goroutine (Error.Println on tx.Error).
2. Better: synchronize the update (or make it injectable/awaitable) so behavior tests can pin it.

Provenance

Surfaced by the silent-failure review pass over the #120 datastore behavior tests (PRD #112, Goodbye gRPC). Pre-existing — not introduced by that branch. Natural home: the Phase 3 datastore rewrite slice, where the method gets reimplemented anyway.

[SyniRon]

This was generated by AI during triage.

Triage 2026-06-06 (pre-#131 backlog pass):

Provenance folded in from #149 (closed as duplicate of this issue): the finding was flagged independently twice — the #120 punch list, and the #125 review wave's silent-failure audit — which strengthens the signal.

Maintainer routing (ruled): the fix rides #134 (the datastore type-swap slice, where ValidateApiKey is reimplemented anyway), as an observability change, not a shape change — i.e. fix option 1 from the body: keep the fire-and-forget semantics, make the failure visible (log the Exec error; metering optional). Synchronizing the update is not required.

Labels: ready-for-agent (fully specified with this ruling) + blocked (sequenced into #134's wave).