This is the second stop in the failure-mode and testing path. Read first: Service Worker Failure Modes in Offline-First PWAs Then continue to: Testing IndexedDB Schema Migrations in Offline-First PWAs If you want privacy-first, offline health tech to exist without surveillance funding it: sponsor the build → https://paintracker.ca/sponsor If you want the trust boundary underneath rollback risk, add: Trust Boundaries in Client-Side Health Apps Rollback sounds simple until the app keeps state locally. If all you have is a server and stateless clients, rollback usually means deploy the old version and move on. That is not what happens in an offline-first system. In an offline-first app, the old version is still running in someone's tab. The new version may already be installed in a waiting service worker. The local database may already have been migrated. A queue of pending writes may have been created under assumptions the rollback does not understand.…