The outbox & the optimistic rebase
Confirmed "base state" is kept apart from your pending changes. The screen always shows base state plus pending operations replayed in order, so a rollback can never corrupt data. Anything still waiting for the server carries a $pending mark.