fix(pin): START never submits on touch; Change PIN asks once after a legacy PIN

A legacy PIN (0.8.0 or earlier) on a touch screen was still submitted by
START, and a tap that also arrives as START could submit the digits
typed so far as a counted wrong PIN. The OK key is tapped instead.
"Change PIN" while locked with a legacy PIN asked for the new PIN twice:
the forced new PIN after the unlock is now the change.

Found in the review of b8addc8 and 096b5a4. make test and make
screenshots pass on the Forerunner 70.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 16 insertions, 11 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 540e319..cc7d9fa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,14 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+### Fixed
+
+- On touch screens, START no longer submits a PIN set by 0.8.0 or earlier:
+  a tap that also arrives as START could submit the digits typed so far as
+  a wrong PIN. Tap the OK key instead.
+- "Change PIN" with a PIN from 0.8.0 or earlier asked for the new PIN
+  twice: the new 4-digit PIN after the unlock is now the change.
+
 ## [0.9.0] - 2026-10-25
 
 Fixes from the first real-watch test on the Forerunner 70 (2026-10-21) and
diff --git a/source/ui/MainMenu.mc b/source/ui/MainMenu.mc
index db59f4a..21f427c 100644
--- a/source/ui/MainMenu.mc
+++ b/source/ui/MainMenu.mc
@@ -118,8 +118,10 @@ class MainMenuDelegate extends WatchUi.Menu2InputDelegate {
             } else if (vault.session.isUnlocked()) {
                 WatchUi.switchToView(new PinView(PinView.MODE_CHANGE, null), new PinDelegate(), WatchUi.SLIDE_LEFT);
             } else {
-                var then = new ChangePinAfterUnlock();
-                WatchUi.switchToView(new PinView(PinView.MODE_UNLOCK, then.method(:run)), new PinDelegate(), WatchUi.SLIDE_LEFT);
+                // A legacy PIN is followed by the forced new-PIN screen, which
+                // is already the change: no second one after it.
+                var then = vault.isLegacyPin() ? null : new ChangePinAfterUnlock().method(:run);
+                WatchUi.switchToView(new PinView(PinView.MODE_UNLOCK, then), new PinDelegate(), WatchUi.SLIDE_LEFT);
             }
         } else if (id == :reset) {
             // Two short lines (the item said "Reset PIN"): the native dialog shows
diff --git a/source/ui/PinView.mc b/source/ui/PinView.mc
index 47b12fd..af18e2b 100644
--- a/source/ui/PinView.mc
+++ b/source/ui/PinView.mc
@@ -515,16 +515,11 @@ class PinDelegate extends WatchUi.BehaviorDelegate {
         return true;
     }
 
-    // START on a touch screen submits only a legacy PIN. Otherwise it does
-    // nothing: one tap can arrive both here and in onTap, and submitting
-    // the digits typed so far was a wrong PIN.
+    // START on a touch screen does nothing, in every mode: one tap can arrive
+    // both here and in onTap, and submitting the digits typed so far was a
+    // counted wrong PIN. A legacy PIN is submitted with the tappable OK key.
     function onKey(event as WatchUi.KeyEvent) as Boolean {
-        var v = view();
-        if (v != null && Ui.isTouch() && event.getKey() == WatchUi.KEY_ENTER) {
-            if (v.legacy) {
-                v.markChanged();
-                v.press(PinView.KEY_OK);
-            }
+        if (Ui.isTouch() && event.getKey() == WatchUi.KEY_ENTER) {
             return true;
         }
         return false;