[ps2]

Requires LoopKit/LoopKit#654, where a NewCarbEntry carries its own sync identifier, so that a retried save is stored once, and edits use CarbEntryUpdate.

Each place that creates a new entry now chooses its identity:

Path	Identifier
Carb entry screen → bolus screen	one per carb entry screen, so saving again after a failed bolus does not add the carbs twice
Watch carb and bolus flow	one per carb entry under consideration, sent inside the entry; a retry after a lost reply resends the same entry
Watch messages whose carb entry has no identifier (older watch apps)	refused: nothing is stored or delivered, and the watch shows its bolus failure
Simple bolus calculator	fresh per save, as before
Remote carb commands	fresh per command, as before
Missed-meal prefill, simulated data	fresh

Edits

The bolus screens took a nullable new entry plus a nullable original entry. They now take a CarbEntryChange, which is either .add(NewCarbEntry) or .edit(StoredCarbEntry, CarbEntryUpdate), and saving calls addCarbEntry or replaceCarbEntry to match. recommendManualBolus and generatePrediction take the same value.

Older watch apps

SetBolusUserInfo and GetBolusRecommendationUserInfo now refuse a message whose carb entry doesn't decode. Without that, an older watch app's entry would decode as no carbs, and its bolus would go ahead without them.

Not covered

Remote commands carry their own identity, but ServicesManager.deliverRemoteCarbs doesn't receive it yet; passing it through needs a LoopKit delegate change and is left for a follow-up.

Testing

• LoopTests: 333 pass on the iOS simulator against CarbStore: carry the sync identifier on new carb entries LoopKit#654. New tests cover saving a new entry from the bolus screen, a watch message without carbs, and a watch carb entry without an identifier being refused. The edit-path tests now check that replaceCarbEntry is called.
• The watch app compiled in the same build.
• Not yet exercised on a device.