New Dash Pod images of pod bottom with blue needle cap

LOOP-4371 DIY Sync

OmniBLE parser improvements

Phase 1 of wiring stopIssuingPodCommands / resumeIssuingPodCommands
real gates. The state machine has been emitting these effects since
B.2.d but nothing actually blocked pod commands at the orchestrator
boundary — they were NSLog stubs in HandoffOrchestrator.execute.

This commit adds the OMNIBLE-side machinery:

- OmniBLEOwnership: new @published var commandsAllowed: Bool = true.
  Default-true for backwards compat.

- OmniBLEPumpManager: new var commandsAllowedCheck: (() -> Bool)?
  callback. When set + returning false, enactBolus and enactTempBasal
  short-circuit with PumpManagerError.uncertainDelivery (retryable).
  Default nil = always-allow.

- OmniBLEOwnership wires the callback at setPumpManager (watch lazy
  path) AND init (iOS construction path). Uses [weak self] capture
  so deallocation gracefully degrades to default-allow.

CRITICAL design choice: callback closure pattern instead of back-
reference. OmniBLEOwnership already holds OmniBLEPodOwner (the pump
manager) strongly. Adding a back-reference would create a retain
cycle. Callback closure with [weak self] sidesteps it.

Loop-side wiring (HandoffOrchestrator.execute case .stopIssuingPod
Commands → ownership.commandsAllowed = false) lands in the next
Loop-submodule commit (Phase 3 of B.5).

threecee-claude

Three review items from code review of 1ec89ca:

IMPORTANT — Add 2 unit tests for the gate actually firing in enactBolus
+ enactTempBasal. The 4 original tests verified the OmniBLEOwnership
flag wiring + callback behavior; they did NOT verify the gate
short-circuits the BLE path. A future refactor could remove the gate
and the original tests would still pass — regression risk. New tests:
testEnactBolus_shortCircuitsWhenCommandsNotAllowed,
testEnactTempBasal_shortCircuitsWhenCommandsNotAllowed. Both assert
synchronous completion within 0.5s (proves the gate fires before any
async work) AND .uncertainDelivery as the returned error.

IMPORTANT/SUGGESTION — Updated commandsAllowedCheck doc comment to:
1. Explain why .uncertainDelivery is the right error (DeviceDataManager
   .swift:833 suppresses the notification — avoids misleading "delivery
   uncertain" alert during handoff).
2. Document the SCOPE GAP: only enactBolus + enactTempBasal are gated.
   UI-driven manual paths (runTemporaryBasalProgram, cancelBolus,
   suspendDelivery, resumeDelivery) are NOT gated. Justification: handoff
   window is sub-second, UI paths are low-frequency, user is consciously
   triggering them. Marker for B.5.1 / B.7 followup if gap matters in
   practice.

threecee-claude

Adds testCommandGate_blocksDoseWhenCommandsNotAllowed to
WatchAlgorithmEndToEndTests. Sets pump manager's
commandsAllowedCheck callback to return false (simulating
ownership.commandsAllowed = false in production), runs the algorithm
iteration, asserts:
- pod insulinDelivered did NOT change
- no temp basal was installed (basalDeliveryState != .tempBasal)

Complements the OmniBLEOwnershipTests unit tests (which verify the
flag wiring in isolation). This integration test proves the gate
prevents the dose from reaching the real emulated pod through the
full plumbing (driver -> didRecommend -> enactRecommendedDose ->
pumpManager.enactBolus/enactTempBasal -> short-circuit).

Total WatchAlgorithmEndToEndTests now 5: full chain + 3 gate-
suppression (B.6) + 1 command-gate (B.5). ~6-7 min wall-clock.

threecee-claude