docs(SDK-555): clarify deprecated encryption docs and precedence test

Align encryptionEnforced JSDoc with keychainEncryption defaults and assert
explicit keychainEncryption wins over encryptionEnforced in toDict().

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jferrao-itrbl

src/core/classes/Iterable.test.ts

@@ -386,14 +386,23 @@ describe('Iterable', () => {
       expect(configDict.keychainEncryption).toBe(false);
     });
 
-    it('should keep keychainEncryption enabled when only deprecated encryptionEnforced is set', () => {
+    it('should still serialize encrypted keychain when only deprecated encryptionEnforced is set', () => {
       const config = new IterableConfig();
       config.encryptionEnforced = true;
       const configDict = config.toDict();
       expect(config.keychainEncryption).toBe(true);
       expect(configDict.keychainEncryption).toBe(true);
       expect(configDict.encryptionEnforced).toBe(true);
     });
+
+    it('should prefer keychainEncryption over deprecated encryptionEnforced in toDict()', () => {
+      const config = new IterableConfig();
+      config.keychainEncryption = false;
+      config.encryptionEnforced = true;
+      const configDict = config.toDict();
+      expect(configDict.keychainEncryption).toBe(false);
+      expect(configDict.encryptionEnforced).toBe(true);
+    });
   });
 
   describe('urlHandler', () => {

src/core/classes/IterableConfig.ts

@@ -331,11 +331,10 @@ export class IterableConfig {
   keychainEncryption = true;
 
   /**
-   * @deprecated Use {@link IterableConfig.keychainEncryption} instead. This field is still serialized for
-   * back-compat on Android when `keychainEncryption` is absent from the bridge payload.
-   *
-   * Android only feature: This controls whether the SDK should enforce encryption for all PII stored on disk.
-   * By default, the SDK will not enforce encryption and may fallback to unencrypted storage in case the encryption fails.
+   * @deprecated Use {@link IterableConfig.keychainEncryption} instead. Android honors
+   * `keychainEncryption` (default `true`, encrypted). This field is still serialized so
+   * older bridge payloads that omit `keychainEncryption` can fall back when
+   * `encryptionEnforced` is `true`; it does not disable encryption when left `false`.
    */
   encryptionEnforced = false;