workspace-server/internal/handlers/approvals.go

@@ -200,7 +200,12 @@ func (h *ApprovalsHandler) Decide(c *gin.Context) {
 		return
 	}
 
-	rows, _ := result.RowsAffected()
+	rows, err := result.RowsAffected()
+	if err != nil {
+		log.Printf("Approval decision RowsAffected error approval=%s workspace=%s: %v", approvalID, workspaceID, err)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to update"})
+		return
+	}
 	if rows == 0 {
 		c.JSON(http.StatusNotFound, gin.H{"error": "approval not found or already decided"})
 		return

workspace-server/internal/handlers/tokens.go

@@ -153,7 +153,12 @@ func (h *TokenHandler) Revoke(c *gin.Context) {
 		return
 	}
 
-	rows, _ := result.RowsAffected()
+	rows, err := result.RowsAffected()
+	if err != nil {
+		log.Printf("tokens: revoke RowsAffected error token=%s workspace=%s: %v", tokenID, workspaceID, err)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to revoke token"})
+		return
+	}
 	if rows == 0 {
 		c.JSON(http.StatusNotFound, gin.H{"error": "token not found or already revoked"})
 		return

workspace-server/internal/handlers/workspace_restart.go

@@ -466,7 +466,11 @@ func (h *WorkspaceHandler) HibernateWorkspace(ctx context.Context, workspaceID s
 		log.Printf("Hibernate: atomic claim failed for %s: %v", workspaceID, err)
 		return
 	}
-	rowsAffected, _ := result.RowsAffected()
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		log.Printf("Hibernate: RowsAffected error for %s: %v", workspaceID, err)
+		return
+	}
 	if rowsAffected == 0 {
 		// Either already hibernating/hibernated/paused/removed, or active_tasks > 0 —
 		// safe to abort without side-effects.