feat(pin): exactly 4 digits, entered on the 4th digit

The keypad has no OK key; the 4th digit submits, so a tap that also
arrives as START can no longer submit a partial PIN (the likely cause
of "Wrong PIN" before the code opened). PINs set by earlier versions
still unlock and are then replaced by a 4-digit one. Opening an entry
ignores a second request from the same tap. A Require PIN sent from
the phone while the watch is locked now applies at the next PIN
instead of waiting for Confirm all. The linter skips .claude.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/source/settings/ManageForm.mc b/source/settings/ManageForm.mc
index a075880..70d707f 100644
--- a/source/settings/ManageForm.mc
+++ b/source/settings/ManageForm.mc
@@ -8,7 +8,8 @@
 //     applies it, or queues it (ChangeQueue) when it touches a locked
 //     entry: edit, replace, counter, "Don't require PIN", the favourite
 //     mark and delete wait until the PIN is entered on the watch. "Require PIN" waits too while
-//     the watch is locked (it needs the master key). Moving never waits:
+//     the watch is locked (it needs the master key), but is applied at the
+//     next PIN without confirming (ChangeQueue.applyLocks). Moving never waits:
 //     the order isn't protected and a position is absolute, so applying a
 //     move twice can't hit another entry.
 // Replacing a code's contents runs CodeCheck with the entry's own options
@@ -383,7 +384,8 @@ class ManageRun extends Jobs.Job {
             return fail(e.code == VaultError.LIMIT ? e.getErrorMessage() as String : "storage full");
         }
         queued = true;
-        message = "Waiting for your PIN on the watch: " + _a.describe();
+        message = (_a.action == ManageAction.LOCK ? "Locks when you next enter your PIN on the watch: "
+            : "Waiting for your PIN on the watch: ") + _a.describe();
         _a.wipe();
         return true;
     }