I'm sure I'm missing something simple here, but couldn't we combine electronic voting with a physical print-out that the voter receives immediately, including their vote and a unique (but anonymous) identifier.
The voter checks this print-out is correct and submits it to an audit box as they leave the voting booth.
If it is incorrect, they file an immediate complaint, and the data is later corrected based on their unique vote identifier (this could be recorded in the audit box with a vote correction audit form for that identifier).
The physical audit counts can then be retained, and spot-verified against the electronic counts if/as needed.
This assumes (as I think we must) integrity of the voting officers and of chain of custody of the physical audit voting boxes.
The voter checks this print-out is correct and submits it to an audit box as they leave the voting booth.
If it is incorrect, they file an immediate complaint, and the data is later corrected based on their unique vote identifier (this could be recorded in the audit box with a vote correction audit form for that identifier).
The physical audit counts can then be retained, and spot-verified against the electronic counts if/as needed.
This assumes (as I think we must) integrity of the voting officers and of chain of custody of the physical audit voting boxes.