My approach in a similar situation where individual sites may be disconnected from a main hub for potentially days is to basically treat things closer to a CQRS transaction/command model, where all transactions are recorded as such, there's a local "summary" table for current state, but this is overridden on sync with the main hub after transactions are evaluated there.