So you have a setup where the user needs to do full username / password authentication, but as a short-cut you allow them to use a PIN until the session expires.
I would follow the model used by the Keepass2Android client:
- When you open the app (equivalent to your new session), you need to do the full authentication process.
- While the app remains open, but in the background, you can re-open it using a short-cut -- last 3 characters of your password, fingerprint scanner, etc (equivalent to your PIN, I think).
- When you fully close the app, you will need to do the full login next time.
So following that model, I would have them enter one PIN at install, when opening a new session they must re-enter their full credentials, and while the session is open they may use the PIN.
I don't see any difference here between whether the session expired naturally or because they clicked Log Out. I also don't see any reason to ever force them to choose a new PIN, if that's what you're implying.