fix: address PR review — undefined decision, vector rename, merge compat, JSDoc

- README Quick Start: define `decision` variable before use in verifySettlement
- Rename intent-hash-mismatch.json → settlement-amount-mismatch.json (no intent
  hash after SPA removal)
- merge.ts: write to both vendorAllowlist and operatorAllowlist during deprecation
  window so callers reading operatorAllowlist from resolveEffectivePolicy() still
  get the merged result
- types.ts: fix trustBundles JSDoc wording ("pre-configured key" not "env-var")

Made-with: Cursor

Author: NAOR YUVAL

README.md

@@ -48,6 +48,7 @@ const sba = createSignedBudgetAuthorization({
 });
 
 // 3. Verify the chain (merchant / Trust Gateway)
+const decision = { /* PaymentPolicyDecision from evaluatePaymentPolicy() */ };
 const result = verifySettlement({
   policyGrant: grant,
   signedBudgetAuthorization: sba,

src/policy-core/merge.ts

@@ -52,7 +52,10 @@ function mergeTwo(base: Policy, override: Policy): Policy {
       base.vendorAllowlist ?? base.operatorAllowlist,
       override.vendorAllowlist ?? override.operatorAllowlist,
     ),
-    operatorAllowlist: undefined,
+    operatorAllowlist: mergeAllowlist(
+      base.vendorAllowlist ?? base.operatorAllowlist,
+      override.vendorAllowlist ?? override.operatorAllowlist,
+    ),
     geoAllowlist: mergeGeoAllowlist(base.geoAllowlist, override.geoAllowlist),
     railAllowlist: mergeRailAllowlist(base.railAllowlist, override.railAllowlist),
     assetAllowlist: mergeAssetAllowlist(base.assetAllowlist, override.assetAllowlist),

src/verifier/types.ts

@@ -95,6 +95,6 @@ export interface SettlementVerificationContext {
   cumulativeSpentMinor?: string;
   /** Pre-verified Trust Bundles for offline key resolution.
    *  When provided, SBA and PolicyGrant signature verification resolves issuer keys
-   *  from the bundles before falling back to env-var or HTTPS well-known. */
+   *  from the bundles before falling back to pre-configured key or HTTPS well-known. */
   trustBundles?: TrustBundle[];
 }