feat(pin): exactly 4 digits, entered on the 4th digit

The keypad has no OK key; the 4th digit submits, so a tap that also
arrives as START can no longer submit a partial PIN (the likely cause
of "Wrong PIN" before the code opened). PINs set by earlier versions
still unlock and are then replaced by a 4-digit one. Opening an entry
ignores a second request from the same tap. A Require PIN sent from
the phone while the watch is locked now applies at the next PIN
instead of waiting for Confirm all. The linter skips .claude.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 39 insertions, 1 deletions

diff --git a/test/settings/ManageTest.mc b/test/settings/ManageTest.mc
index 0adf785..1f050c5 100644
--- a/test/settings/ManageTest.mc
+++ b/test/settings/ManageTest.mc
@@ -243,7 +243,9 @@ function manageLocksEntries(logger as Test.Logger) as Boolean {
     vault.lock();
     s = ManageFixtures.send(vault, ids[1], ManageAction.LOCK);
     SettingsFixtures.run(vault, s);
-    var waits = !ManageFixtures.isLocked(vault, ids[1]) && ChangeQueue.count(vault) == 1;
+    var waits = !ManageFixtures.isLocked(vault, ids[1]) && ChangeQueue.count(vault) == 1
+        && SettingsFixtures.contains(logger, s, ManageForm.STATUS,
+            "Locks when you next enter your PIN on the watch: Require PIN: " + ids[1]);
     // In lower case: the same form again would just be "Already applied".
     s = ManageFixtures.send(vault, ids[0].toLower(), ManageAction.LOCK);
     SettingsFixtures.run(vault, s);
@@ -253,6 +255,42 @@ function manageLocksEntries(logger as Test.Logger) as Boolean {
     return now && waits && already && ManageFixtures.isLocked(vault, ids[1]);
 }
 
+// Waiting "Require PIN" changes apply at the next PIN without "Confirm
+// all" (the PIN screen calls applyLocks); other changes keep waiting, and
+// the results of a following "Confirm all" list the locks too.
+(:test)
+function manageQueuedLocksApplyAtNextPin(logger as Test.Logger) as Boolean {
+    var vault = ManageFixtures.vault();
+    var ids = vault.ids();
+    var bank = ManageFixtures.addLocked(vault, "Bank");
+    vault.lock();
+    var s = ManageFixtures.send(vault, ids[0], ManageAction.LOCK);
+    SettingsFixtures.run(vault, s);
+    s = ManageFixtures.send(vault, bank, ManageAction.DELETE);
+    SettingsFixtures.run(vault, s);
+    s = ManageFixtures.send(vault, ids[1], ManageAction.LOCK);
+    SettingsFixtures.run(vault, s);
+    var counted = ChangeQueue.count(vault) == 3 && ChangeQueue.countLocks(vault) == 2;
+    ChangeQueue.applyLocks(vault); // still locked: nothing happens
+    var untouched = ChangeQueue.count(vault) == 3 && !ManageFixtures.isLocked(vault, ids[0]);
+    StorageFixtures.unlock(vault, StorageFixtures.PIN);
+    ChangeQueue.applyLocks(vault);
+    var left = ChangeQueue.descriptions(vault);
+    var applied = ManageFixtures.isLocked(vault, ids[0]) && ManageFixtures.isLocked(vault, ids[1])
+        && left.size() == 1 && left[0].equals("Delete: " + bank + " Bank (alice@example.com)")
+        && ChangeQueue.countLocks(vault) == 0 && vault.ids().indexOf(bank) >= 0;
+    var job = ManageFixtures.confirm(vault);
+    var reported = job.lines.size() == 3 && job.lines[0].find(ids[0] + " ") == 0
+        && job.lines[0].find("now requires the PIN") != null && SettingsFixtures.hasLine(job.lines, "Deleted " + bank);
+    if (!reported) {
+        logger.error(job.lines.toString());
+    }
+    // The lines are reported once.
+    var again = ManageFixtures.confirm(vault);
+    return counted && untouched && applied && reported && vault.ids().indexOf(bank) < 0
+        && again.lines.size() == 1 && again.lines[0].equals("No changes were waiting.");
+}
+
 // Changes that arrive while the queue is being applied stay queued.
 (:test)
 function manageQueueKeepsLateArrivals(logger as Test.Logger) as Boolean {