docs: correct the record that android never reports a secure field

Four places said android reports the fact for nothing and that every typed
value there is redacted. The sidecar now states it, so they described the
old behaviour.

internal/runner/redaction_test.go

@@ -40,9 +40,9 @@ const webLoginTreeJSON = `{
   ]
 }`
 
-// androidLoginTreeJSON is the same form on Android, where the native tree
-// mapper drops uiautomator's password attribute and neither field carries the
-// fact.
+// androidLoginTreeJSON is the same form with the fact missing from both fields,
+// which is what an Android tree looks like when the sidecar could not match its
+// text fields against the device's own view hierarchy.
 const androidLoginTreeJSON = `{
   "attributes": {"bounds": "[0,0,1080,2340]"},
   "children": [
@@ -65,8 +65,8 @@ func TestTraceActionForRedactsTypedValuesTheTargetCannotClear(t *testing.T) {
 	}{
 		{"ios secure field", iosLoginTreeJSON, "id:LoginPassword"},
 		{"web secure field", webLoginTreeJSON, "id:login-password"},
-		{"android field reported as neither", androidLoginTreeJSON, "id:login_email"},
-		{"android password field", androidLoginTreeJSON, "id:login_password"},
+		{"field reported as neither", androidLoginTreeJSON, "id:login_email"},
+		{"password field reported as neither", androidLoginTreeJSON, "id:login_password"},
 	} {
 		t.Run(testCase.name, func(t *testing.T) {
 			traceAction := traceActionFor(typeInto(testCase.selector), mustParseTree(t, testCase.treeJSON))

internal/verifier/redaction.go

@@ -76,11 +76,11 @@ func RecordedAction(action Action, tree *hierarchy.Tree) Action {
 // have produced.
 //
 // A target the platform reports as a secure entry is redacted, and so is a
-// target carrying no report at all. iOS and web state the fact on every
-// editable element, so a missing one means Android, whose native tree mapper
-// drops uiautomator's password attribute before the sidecar sees it. There a
-// password field cannot be told from a search box, and the target that cannot
-// be told apart is treated as the credential.
+// target carrying no report at all. All three platforms state the fact on their
+// editable elements, so a missing one is a field none of them could speak for:
+// an action that named no target, or an Android text field the sidecar could
+// not match against the device's own view hierarchy. The target that cannot be
+// told apart is treated as the credential.
 func recordedInputText(text string, target secureFact) string {
 	if target.reported && !target.secure {
 		return text