update docs

docs/bmlapi/13-qr-payment.md

@@ -150,7 +150,7 @@ POST https://www.bankofmaldives.com.mv/internetbanking/api/mobile/walletpayments
 
 Expected response: `{ "success": true, "code": 99 }` (OTP required)
 
-> **Note:** This step may be skipped. The app proceeds directly to Step 2b if the gateway already indicates OTP is required.
+> **When this step is used:** the client only calls `preInitiatePayment` for **gateway QRs** — QR URLs that begin with `https://pay.bml.com.mv/app/` (`TransferFragment.kt:349, 1419-1423`). For PayMV-native static QRs (`QRS`), Step 2a is skipped and the flow starts at Step 2b.
 
 ### Step 2b — Request OTP Channel
 
@@ -195,6 +195,8 @@ Expected response:
 }
 ```
 
+> **Currency fallback:** if the server's `payload.currency` is blank, the client falls back to the `currency` value sent in the request (`BmlQrPayClient.kt:148`). The same applies to `merchant` and `amount` at the UI layer.
+
 On failure:
 
 ```json
@@ -240,4 +242,4 @@ The OTP is a standard TOTP (RFC 6238, SHA-1, 30-second window, 6 digits) derived
 
 ---
 
-[← Tap-to-Pay](12-tap-to-pay.md)
+[← Tap-to-Pay](12-tap-to-pay.md)     **Next →** [Notifications](14-notifications.md)