update FORK_DIVERGENCE.md

FORK_DIVERGENCE.md

@@ -4,6 +4,71 @@ This document tracks the functional and behavioral differences between this fork
 
 ---
 
+### **D-0004: Legal information screen opens links in-app and adds Acknowledgement row**
+
+- **Upstream baseline commit**: `e0ca2acc43649d4c80194d84d2179a7a9310d7eb`
+- **Fork commits**: `df66185dd38ddd47a93cfd505d8210651553a072`, `bb5a6eed7e5f374eab349664f5e41b750340378c`
+- **Type**: `Behavioral`
+- **Date**: `2026-05-04`
+
+#### **Description**
+
+The Legal Information screen (About page in Settings) was modified in two related steps. First, all three legal links (Copyright, Acceptable Use Policy, Privacy Policy) were changed to open inside the app via a `WKWebView` sheet rather than delegating to the system browser via `openURL`. Second, an "Acknowledgement" row was added that links to a generated SBOM (Software Bill of Materials) JSON artifact hosted on `git.postnumber.com`, with the URL constructed dynamically from the current app version string.
+
+#### **Upstream vs. Fork Behavior**
+
+| Area | Upstream (Element X) | Fork (Letro) |
+|---|---|---|
+| Legal links (Copyright, AUP, Privacy) | Opened in external browser via `openURL` environment action | Opened in an in-app `WKWebView` sheet with a Done toolbar button |
+| Acknowledgement row | Not present | Present; links to `https://git.postnumber.com/letro/letro-authentication-service/releases/download/letro-v<version>/sbom.json` |
+
+#### **Files Modified**
+
+- `ElementX/Sources/Screens/Settings/LegalInformationScreen/View/LegalInformationScreen.swift`
+
+#### **Impact & Risk**
+
+- **Impact**: Legal URLs now load inside the app, keeping users within the Letro experience. The new Acknowledgement row introduces a runtime dependency on `InfoPlistReader.main.bundleShortVersionString` and an external SBOM URL that must remain reachable for each release.
+- **Risk Level**: `LOW`. Changes are self-contained to one screen. The external SBOM URL could fail silently if not published with each release.
+
+#### **AGPL Relevance**
+
+Not Applicable
+
+---
+
+### **D-0003: Push gateway URL corrected to dedicated Sygnal instance**
+
+- **Upstream baseline commit**: `e0ca2acc43649d4c80194d84d2179a7a9310d7eb`
+- **Fork commit**: `4ec100c6aa27b6f0fb1af470f364907f7b23e3b9`
+- **Type**: `Behavioral`
+- **Date**: `2026-05-02`
+
+#### **Description**
+
+The `pushGatewayBaseURL` introduced in D-0002 was set to `https://letro.com`, which was incorrect. This commit corrects it to `https://sygnal.ess.postnumber.com`, the actual dedicated Sygnal push gateway instance used by Letro.
+
+#### **Upstream vs. Fork Behavior**
+
+| Area | Upstream (Element X) | Fork (Letro) |
+|---|---|---|
+| `pushGatewayBaseURL` | `https://matrix.org` (Element's gateway) | `https://sygnal.ess.postnumber.com` (Letro's dedicated Sygnal instance) |
+
+#### **Files Modified**
+
+- `ElementX/Sources/Application/Settings/AppSettings.swift`
+
+#### **Impact & Risk**
+
+- **Impact**: Push notifications are routed to the correct Sygnal server. Without this fix, push delivery via the D-0002 value (`letro.com`) would fail.
+- **Risk Level**: `LOW`. Single constant change; no structural or logic modifications.
+
+#### **AGPL Relevance**
+
+Not Applicable
+
+---
+
 ### **D-0002: Letro colour palette, gradient buttons, URL corrections, and live-location permission**
 
 - **Upstream baseline commit**: `e0ca2acc43649d4c80194d84d2179a7a9310d7eb`