# Side-Effects Review — 0.28.57 (release aggregate)

**Version:** `0.28.57`
**Date:** `2026-04-19`
**Author:** `echo` (backfill)
**Second-pass reviewer:** `not required`

## Summary

Release 0.28.57 bundles two changes that were each reviewed individually at merge time. The publish workflow's file-renamer skipped the corresponding `upgrades/side-effects/` artifact during the 0.28.57 finalization (it renames `upgrades/NEXT.md → upgrades/{version}.md` but not the side-effects counterpart), so this file is a minimal aggregator that points at the two component reviews already on disk. Captured as a follow-up in the pre-push gate: teach `publish.yml` or `check-upgrade-guide.js` to also rename the matching side-effects artifact so this backfill isn't needed on future releases.

## Components

### 1. TelegramLifeline sends auth on `/internal/*` forwards

Landed via PR #64. Surgical fix in `src/lifeline/TelegramLifeline.ts` to add `Authorization: Bearer <authToken>` to `forwardToServer()` and `handleCallbackQuery()`. Reasoning: the 0.28.53 server-side tightening that required auth on `/internal/*` had no matching client-side update in the lifeline — every inbound Telegram message was 401ing.

- No runtime decision points introduced; a signal-less, surface-narrow header addition.
- Over-block / under-block: not applicable — no block/allow surface.
- Level-of-abstraction: header is constructed exactly where the fetch is built; no new indirection.
- Signal-vs-authority: not applicable — hard-invariant transport-layer auth.
- Interactions: none with other gates; backwards-compatible on servers that don't require the header.
- Rollback: revert the single file.

### 2. Drop duplicate CI gate from `publish.yml` (PR #67)

Full review: `upgrades/side-effects/publish-drop-duplicate-ci-gate.md` (in this directory). Summary: removed the `ci` job from `publish.yml` that duplicated `ci.yml` on the same `push: branches: [main]` event. Publish wall-clock measured 11m → 55s on the first post-merge run. Branch-protection-at-PR-time remains the actual authority.

## Notes

This aggregator file exists to satisfy the `pre-push-gate.js` requirement that `upgrades/side-effects/{version}.md` exists whenever `upgrades/{version}.md` exists and claims fix/feature content. The finer-grained artifacts for each component are the authoritative reviews; this file only provides the version-named pointer.

Follow-up captured: either (a) teach `publish.yml` to also rename the matching side-effects artifact during NEXT → version finalization, or (b) relax `pre-push-gate.js` to accept any side-effects artifact dated within the release window rather than requiring a version-exact filename.
