Indeed, storing the state on the server only (still have to figure out what to do with no connectivity), and verifying receipts on the server will mostly get it fixed.