He can lock the ecash payment to the public key of the reciever. Then theres no way he can double spend.
At first, I really liked your idea. Thought it would work. But I wanted to test it. Loaded up two cashu.me pages and cloned the state so they both had the same wallet. Then I created PKs for both, and went offline. I wasn’t able to create a “locked” token while offline. However, I was able to create tokens of different amounts from each instance and I could share those.