A developer is designing an Android app that must work offline first and sync encrypted health data to a backend when connectivity is available. Which storage architecture satisfies both offline-first and encryption-at-rest requirements?

• A.Write the records into /sdcard/Android/data/<pkg>/ with a custom header flag marking sensitive content (the platform honors the flag by refusing MediaStore indexing): the sync worker uploads the same file over HTTPS after stripping the flag from the payload header
• B.Keep the records in AsyncStorage for offline reads (the React Native bridge persists them to a private SQLite file) then run an AES-256 pass over the accumulated rows immediately before each sync window: the key derives from the installation identifier the app generates at first launch
• C.Persist the records in SharedPreferences under MODE_PRIVATE (the Linux DAC fence blocks other packages) with values encrypted under a key derived from the signed-in user's email address: the derivation runs PBKDF2 over that address
• D.