Latest Version: v0.1.1046
Ready for
better switching?
WOS for macOS
Universal Last-Recently-Seen switching for apps, windows, and tabs. Simple DMG installation. Full privacy guaranteed.
Download WOS.dmg
Supports macOS 15.0+ · Universal Binary (M1/M2/Intel)
What's New in v0.1.1046
Your most-used browser tab no longer vanishes from Cmd+Tab. Two long-standing bugs conspired to keep dropping one specific tab from the switcher — typically the web app you live in all day. First, a text-encoding oversight made every background scan silently lose the first tab of the first window, so WOS kept concluding it was closed and removed it from your recents. Second, for web apps that change their page title and URL as you navigate (dashboards, SaaS tools), WOS could mistake a successful switch for a failed one and delete the entry you had just switched to. Both are fixed: scans now see every tab, and WOS verifies a switch by the tab's actual identity — its position (Safari) or its internal ID (Chrome) — instead of comparing yesterday's page title.
New: silence noisy tabs without leaving your keyboard (⌘⌃M). Tap the chord and WOS shows every tab and app currently playing audio — across all your running browsers — so you can mute one, jump to it, or mute everything. Hold the chord to instantly silence it all (panic mode). Toggleable in Settings.
From v0.1.1016: The "Cmd+Tab is blocked — Secure Input is active" notice now names the real culprit and clears itself. When macOS blocks Cmd+Tab because a password field or a system prompt holds "Secure Input", WOS now identifies the exact process holding it — including system processes like the login window, which it previously couldn't see and would mis-blame on whatever app was in front. If a stale system lock is the cause, it tells you to simply lock and unlock your screen to clear it, and the on-screen notice no longer lingers after the block lifts.
From v0.1.1007: The "Search menu bar items" (⌘⇧B) badges look right now. The little label on the right of a row — "Battery", "Dark Mode", "Bluetooth" — used to be a heavy, typewriter-style block. It's now a subtle, neatly-padded pill sized to its text, with proper margins and spacing in both light and dark mode.
From v0.1.1007: A cleaner ⌘⇧B layout. The redundant "Visible" header and the divider line under the search field are gone, so the search field flows straight into your results. (Hidden menu-bar items are still grouped under their own "Hidden" heading.)
From v0.1.1006: "Search menu bar items" (⌘⇧B) now matches Quick Search — and opens on the first press. The panel got the same Spotlight-style search field (no more clipped placeholder), a chromeless window (the stray close/minimize/zoom buttons are gone —
esc closes it), and the same rotating "did you know?" tips while it scans. It also previously did nothing unless you pressed Cmd+Tab first; that cold-press bug is fixed.
From v0.1.1006: Memory Bank — a friendly save prompt if you open search by mistake. If you have text selected and press ⇧⌘M (search) when you meant ⌥⌘M (save), a banner now offers to save that selection as a new entry —
↩ to save, esc to discard. Nothing is written until you confirm, and your clipboard is never touched.
From v0.1.1005: Memory Bank — a searchable Markdown wiki for everything you copy. Select text anywhere on macOS and press ⌥⌘M to save it to a personal knowledge base; press ⇧⌘M to open a Spotlight-style search HUD where
↩ pastes the chosen snippet straight back into the app you came from. Storage is plain Markdown you can edit by hand. No new sandbox permissions were added.
From v0.1.1005: Cmd+Tab no longer loses a tab that shares a title with another. Committing to one of two same-titled tabs — two Gmail accounts both showing "Inbox", several "Untitled" docs, duplicate page titles across windows — used to silently drop the other from your recents until it was seen again. Tabs are now de-duplicated by URL, with the title used only when no URL is available.
From v0.1.1005: Duplicate iTerm / Terminal rows are gone. The same terminal session could appear twice in the switcher because two internal recording paths disagreed on how to identify it. They now agree, so one session shows as exactly one row.
From v0.1.1004: iTerm tabs are searchable again — including right after a restart. Two bugs hid them: WOS's enumeration script asked iTerm for each tab's
index, a property iTerm doesn't support, so every tab silently dropped and the search panel showed zero iTerm sessions. And even with that fixed, iTerm was only learned when you focused a session — so a fresh start showed nothing. WOS now reads tab titles from the active session and runs a cold-start re-scan (plus a lazy re-scan when you open Quick Search) so your terminal tabs are there immediately.
From v0.1.1004: A wedged iTerm no longer freezes tab search. If iTerm's automation stops responding (a stuck session), WOS used to block for ~2 minutes waiting on it. There's now a hard 3-second timeout that gives up cleanly and shows "iTerm isn't responding to automation — quit & relaunch iTerm to restore tab search."
From v0.1.1004: Clipboard HUD no longer spills off-screen. A long URL could stretch the clipboard panel far past the right edge of the display. Long entries now truncate neatly inside the fixed-width, centered panel.
From v0.1.997: Jump-to-File (Cmd+Shift+G) now also opens web URLs. Select a URL anywhere — schemed (
https://github.com/...) or a bare domain (foo.workers.dev, apple.com/mac) — hit the hotkey, and WOS hands it to your default browser. Previously the resolver would fall through to "treat raw clipboard as a path" and surface a confusing "Jump failed: not found" toast when the clipboard happened to hold non-path text. The hotkey's new precedence: UI path → file path → web URL → raw-string fallthrough. file:// URLs still flow through the file-path branch unchanged.
From v0.1.964: Quick Search "App Launcher" can now cold-launch installed apps. Pressing Enter on a non-running app (e.g. Front, Google Chrome Canary) used to fail with a generic "miscellaneous error" — the kernel sandbox was missing one rule (
(allow lsopen)) that LaunchServices needs to open another app. Rule added; network blackout, Gatekeeper, notarization, and sandbox non-inheritance to launched apps are all unchanged. See the security page for the threat-model delta.
From v0.1.964: Recent Files idle CPU dropped from 50–65% to ~0%. The Spotlight engine was re-scanning the entire 500-item result set on every
DidUpdate notification — several times per second on a busy disk. Now throttled (2s) and switched to delta processing (only items the notification flags as added/changed, typically 1–10). Plus a new "Scan Documents, Downloads, Desktop Only" toggle in Settings → Recent Files that narrows both the Spotlight scope and the FSEvents root, skipping per-second churn from ~/Library, browser caches, and IDE build artifacts. On by default for fresh installs.
From v0.1.964: Crash fixed on the Jump-to-File hotkey when two running apps normalize to the same name.
Dictionary(uniqueKeysWithValues:) traps on duplicate keys; switched to the collision-tolerant variant. Reproduced in a real crash report.
From v0.1.964: Launch failures are no longer silent. If WOS can't launch an app from Quick Search for any reason (sandbox, Gatekeeper, missing bundle), a status HUD now beeps and shows the underlying error message — instead of just doing nothing on Enter.
From v0.1.955: Easter egg
somebody → "Somebody's gonna get hurt real bad. I'm not saying who. Somebody." — a Russell Peters reference in the Cmd+Tab+S search panel.
From v0.1.954: Distribution is now signed with a real Apple Developer ID and notarized. First-launch UX is the standard one-click "Open" dialog with no Privacy & Security → Open Anyway detour.
From v0.1.953: Easter egg
vedio → "Did you mean: Video? ;)".
From v0.1.952: Easter-egg lightbox no longer haunts a fresh search panel. The lightbox is a child window of the search panel — AppKit doesn't sever the parent-child link when the parent is ordered out, so the banner used to ride back onto the screen alongside the empty results. Fix: the lightbox now unconditionally removes itself from the parent's child-window list when hidden, regardless of current visibility.
From v0.1.950: Easter eggs in the Cmd+Tab+S search panel. Type a recognized phrase and a HUD-style lightbox pops above the panel — pinned on top via a child-window relationship so it's always in front. Icons are monochrome to keep it professional.
Text reveals (from v0.1.950):
show wos version, open the pod bay doors, 42, hello there, how do i exit vim, i am groot, the cake is a lie, i'm a teapot, rm -rf /, sudo make me a sandwich, chmod 777, git blame.
Self-referential (from v0.1.950):
who am i returns your full name plus the live count of open tabs. wos secrets reports how many easter eggs you've discovered (persisted across launches). show wos credits.
One-shot animations (from v0.1.950):
do a barrel roll spins the panel 360°. matrix washes it green for 2.5 s. thanos fades half the results. konami pulses a rainbow border. Each only fires when the trigger phrase actually changes.
From v0.1.937 / v0.1.938: Safari tab drag no longer corrupts Cmd+Tab history for other tabs in the same window, and a comprehensive source-code documentation pass landed for the browser-tab subsystem (no behaviour changes).
Full Release History (20 Latest)
View full CHANGELOG.md
A browser WOS is not allowed to control now says so, and offers the one click that fixes it. Without an Automation grant a browser degrades in the most confusing way available: still in Cmd+Tab, as a single app row, with none of its tabs — indistinguishable from a browser that has nothing open. The alert that explains this, and the button that opens System Settings → Privacy & Security → Automation → WOS → *browser*, both already existed; they were gated behind Settings › Show Automation Warnings, which also governs the *repeating* privilege-violation toast and critical-error pill. Switching those off — an entirely reasonable thing to do — silenced the one message carrying the remedy. Found on 2026-09-07 on a machine with the switch off: had that machine's Opera GX grant been missing, WOS would have shown a bare "Opera GX · App" row and said nothing, forever. The two are now split. The repeating toasts stay opt-in; the guidance alert fires once per browser regardless of the switch and names the full Settings path. It is silenced by a precise opt-out instead of a global one — the alert's own "Don't ask again for *browser*" checkbox, the platform idiom for this, honoured on every exit path including Escape and recorded per browser — and that record is dropped again the moment WOS observes the grant working, because macOS revokes Automation on every rebuild or update and a permanently-silenced browser would make the next revocation invisible. A `nil` probe for a browser that is not running proves nothing and clears nothing. Files: [`AutomationGuidancePolicy.swift`](Sources/SwitchCore/AutomationGuidancePolicy.swift), [`AppDelegate.swift`](Sources/WOS/AppDelegate.swift), [`SettingsPanelController.swift`](Sources/WOS/SettingsPanelController.swift); tests in [`AutomationGuidancePolicyTests.swift`](Tests/SwitchCoreTests/AutomationGuidancePolicyTests.swift).
Opera GX tabs are Cmd+Tab targets. Opera GX shipped as a plain app row — its tabs were invisible to the switcher, quick search and the media commands, even though it is a separate install from Opera with its own windows, tabs and profile. It is now its own browser (`com.operasoftware.OperaGX`, addressed as "Opera GX"), not an alias of Opera: two rows in the HUD when both are open, and switching to a GX tab never lands you in Opera. Its `scripting.sdef` is byte-identical to Opera's, so it inherits the whole Chromium contract rather than a new one — native tab GUIDs for stable identity (a reordered tab still activates the right page), PID affinity, `mode`-based incognito detection with the same fail-safe (an unreadable privacy field is treated as private), and the per-tab JS media probe behind `show audio/video source`. You will need to grant Automation for Opera GX the first time WOS enumerates it — macOS treats it as a distinct app from Opera, so an existing Opera grant does not carry over. While wiring it up, Opera's three bespoke script builders were dropped: both Opera variants now go through the shared Chromium activate/close paths, so a fix to one can no longer skip the other. Files: [`LRSTarget.swift`](Sources/SwitchCore/LRSTarget.swift), [`BrowserScriptBridge.swift`](Sources/SwitchCore/BrowserScriptBridge.swift), [`AppDelegate.swift`](Sources/WOS/AppDelegate.swift), [`AudioSourcesHUDController.swift`](Sources/WOS/AudioSourcesHUDController.swift), [`SlideshowController.swift`](Sources/WOS/SlideshowController.swift), [`SettingsPanelController.swift`](Sources/WOS/SettingsPanelController.swift); tests in [`BrowserKindTests.swift`](Tests/SwitchCoreTests/BrowserKindTests.swift).
Settings has a search field. ⌘F (or click the field under "WOS" in the sidebar) searches every setting in the panel — titles, descriptions, group names and section names — and lists the matches with a "Section › Group" breadcrumb; ↑/↓ move, Return opens, Esc goes back. Picking a result switches to that section, scrolls the setting into view and flashes it, so you can see which of two dozen near-identical rows you landed on. Matching is fuzzy in three ways: typos still hit (`lnch strtup` → "Launch WOS at startup"), multi-word queries match in any order, and initials work (`wm` → Window Management). A synonym table covers the words that appear nowhere in the UI — "hotkey" finds the shortcut recorders, "dark mode" finds Appearance, "password" finds Secure Input. The index is derived from the panel's own view tree on every keystroke, not hand-maintained: a setting that exists is findable without anyone remembering to register it, a removed one cannot linger as a result that navigates nowhere, and runtime-rebuilt groups (Watched Folders, per-tab pinned shortcuts) are never stale. Files: [`SettingsSearch.swift`](Sources/SwitchCore/SettingsSearch.swift), [`SettingsPanelController.swift`](Sources/WOS/SettingsPanelController.swift); tests in [`SettingsSearchTests.swift`](Tests/SwitchCoreTests/SettingsSearchTests.swift).
Claude Desktop conversation tracking can be turned off — Settings › Search › App Integrations. On (the default, unchanged) WOS lists Claude's sidebar conversations — Chats, Code, Cowork — as individual Cmd+Tab and search targets. Unlike every other tab source this one is a heuristic read of an accessibility tree with no tab IDs, where identity is derived from (project, title), so a Claude layout change shows up as duplicated or stale rows and there was no way to opt out of it. Off treats Claude as a plain app: no AX traversal, `AXManualAccessibility` is never set on its renderer, and the conversation rows already recorded are dropped from the switcher — a sidebar row is never pruned by an empty enumeration (a virtualised list's "not visible" never means "closed"), so the switch removes them explicitly. Activating a conversation row is deliberately left working, so a row that outlives the switch still takes you somewhere. Files: [`ClaudeSidebarSource.swift`](Sources/SwitchCore/ClaudeSidebarSource.swift), [`SidebarWindowRowMigration.swift`](Sources/SwitchCore/SidebarWindowRowMigration.swift), [`GeneralSettingsStore.swift`](Sources/WOS/GeneralSettingsStore.swift), [`AppDelegate.swift`](Sources/WOS/AppDelegate.swift), [`SettingsPanelController.swift`](Sources/WOS/SettingsPanelController.swift); tests in [`ClaudeDesktopTrackingSwitchTests.swift`](Tests/SwitchCoreTests/ClaudeDesktopTrackingSwitchTests.swift).
Saved URIs now carry a title, description and keywords, and search can Ask. ⌃⌘B no longer silently bookmarks the front tab — it opens a form so you can name the artefact, describe it, and tag it. ⌃⌘K searches with the same fuzzy ranker as Cmd+Tab+S (typos still hit). Switch to Ask, or just type a sentence: “2-3 weeks ago I created a web site for a macos process explorer” uses the saved date plus an on-device Apple Intelligence pass when it is available, and falls back to time-window + keyword rules when it is not. ⌘C copies the URI, ⌘E edits, ⌘N adds. Files: [`Bookmark.swift`](Sources/SwitchCore/Bookmark.swift), [`BookmarkSearch.swift`](Sources/SwitchCore/BookmarkSearch.swift), [`BookmarksHUDController.swift`](Sources/WOS/BookmarksHUDController.swift), [`BookmarkEditorController.swift`](Sources/WOS/BookmarkEditorController.swift), [`BookmarkIntelligenceService.swift`](Sources/WOS/BookmarkIntelligenceService.swift).
WOS now tries the free fix before it ever proposes quitting your app. A Chromium-family app asserts Secure Input when a password field takes focus and drops it when that field gives focus up — so a leak is usually that release going missing. Forty-five seconds into a hold WOS hands the holder the cycle it missed: front it, let it become active, front the previous app back. It costs a focus flicker, quits nothing, and can end the episode outright. Bounded on every axis, because it does take focus: never before 45 s (a real credential prompt is answered in seconds), twice at most and 45 s apart (sized so both land before the earliest restart could fire), never for a system holder or a dead one, and never when fronting would switch Spaces — being dragged off your desktop costs more than the dead Cmd+Tab it was fixing. Files: [`SecureInputGentleRelease`](Sources/SwitchCore/DiagnosticsFileLog.swift), [`AppDelegate.swift`](Sources/WOS/AppDelegate.swift).
`scripts/clean_test_defaults.sh` — removes the domains the old tests left behind. Reports by default, deletes only with `--apply`, and matches the two test prefixes and nothing else, so real domains cannot be caught by it.
Automatic recovery is no longer browsers-only — and the restart is now genuinely a last resort. The gate required the holder to be a Chromium browser, on the reasoning that a browser comes back with its tabs while anything else can hold unsaved work. That reasoning still holds; the blanket exclusion did not. In one five-day sample of `WOS.log`, three of the five longest holds *with the user present* were an Electron app the rule declined to touch by name — including a 30-minute hold found by hand, still running, after the user had been offered a prompt and declined it once. The category ban is replaced by a class and a delay: a restorable browser waits 3 minutes and relaunches with `--restore-last-session`; any other app with a bundle to reopen waits 7, and its countdown dialog no longer promises tabs it cannot restore — it says the app reopens empty. System holders, dead holders and anything WOS could not reopen stay untouchable. And nothing on this ladder arms at all until the gentle release above has run out of attempts, so "quit their app" is a last resort in fact rather than in the comment. Files: [`SecureInputAutoRecovery`](Sources/SwitchCore/DiagnosticsFileLog.swift), [`AppDelegate.swift`](Sources/WOS/AppDelegate.swift), [`SettingsPanelController.swift`](Sources/WOS/SettingsPanelController.swift).
A locked screen is no longer reported as a blocked Cmd+Tab. Of 148 Secure-Input episodes in that same sample, 43 were `loginwindow` — the screen was locked, which is exactly when `loginwindow` is supposed to hold the flag — and they supplied the three longest entries in the file: 2 h 11 m, 45 m, 32 m. Each one announced that Cmd+Tab was blocked, about a machine whose owner was not there, and their bulk is what made the real entries hard to find. Such an episode now gets one line saying what it is and nothing else: no menubar lock, no overlay, no re-show heartbeat, no recovery ladder, and no alarming "interception restored" on the way out.
A launch without Accessibility permission no longer erases your Cmd+Tab history on quit. `applicationWillTerminate` saved `history.allEntries()` unconditionally — correct for every normal exit, and destructive for the one that isn't: an untrusted launch returns early, *before* `historyStore.load()` runs, so the in-memory history is empty and quitting wrote that emptiness over the real thing. Found the hard way on 2026-09-01 — a build launched straight from the bundle's binary (which TCC attributes to the parent shell, so Accessibility reads as denied) replaced the stored history with two bytes, `[]`. A process may now only overwrite the stored history if it read it first; an empty history that came from disk still saves, an empty history that came from never looking does not. Files: [`HistoryPersistencePolicy.swift`](Sources/SwitchCore/HistoryPersistencePolicy.swift), [`AppDelegate.swift`](Sources/WOS/AppDelegate.swift); tests in [`HistoryPersistencePolicyTests.swift`](Tests/SwitchCoreTests/HistoryPersistencePolicyTests.swift).
`show video source` no longer hangs when Chrome's AppleScript handler is wedged. Typing the command and pressing Return opened the media HUD on "Scanning…" and never left it. Chrome 151 was observed holding a "Playing audio" assertion for ~59 minutes while even `tell application "Google Chrome" to count windows` never returned; the per-tab JS probe used unbounded in-process AppleScript, so one dead handler stalled the whole command — and blocked the other browsers from being asked at all. The cheap "is JavaScript from Apple Events on?" probe is now a 1.5 s osascript subprocess, a wedged browser is skipped rather than walked tab-by-tab, a timed-out scan is classified as blocked (so the HUD can name the browser instead of claiming silence), and a successful empty scan is still silence. Files: [`MediaTabsProbe.swift`](Sources/SwitchCore/MediaTabsProbe.swift), [`BrowserScriptBridge.swift`](Sources/SwitchCore/BrowserScriptBridge.swift), [`AudioSilenceService.swift`](Sources/WOS/AudioSilenceService.swift); tests in [`MediaTabsProbeTests.swift`](Tests/SwitchCoreTests/MediaTabsProbeTests.swift).
The media picker no longer inflates to the right on `show video source`. The blocked-browser empty state is a wrapping paragraph. An `NSTextField` with no `preferredMaxLayoutWidth` reports the unwrapped line as its intrinsic width (~900 pt), hugging 750 beats the panel, and Auto Layout grows the window from its origin — extra width to the right. The label now hugs at compression priority, the panel is locked at 572×500, and the copy is three short lines. File: [`AudioSourcesHUDController.swift`](Sources/WOS/AudioSourcesHUDController.swift).
Enabling JavaScript from Apple Events now probes first, then clicks. The menu mark is not trusted. Chrome is brought forward so System Events can hit the item, and the click is verified with `execute javascript` before the rescan. File: [`BrowserScriptBridge.swift`](Sources/SwitchCore/BrowserScriptBridge.swift).
The `show video source` JS probe and JS-enable click no longer pollute Cmd+Tab recency. Walking every tab and clicking View ▸ Developer can front Chrome and fire AX events; those are not user visits. The jump itself still records recency, so Cmd+Tab after the command returns to that tab. The per-tab JS walk restores the previously selected Chrome tab if `execute javascript` selected a background one. Files: [`LRSPromotionGate.swift`](Sources/SwitchCore/LRSPromotionGate.swift), [`AppDelegate.swift`](Sources/WOS/AppDelegate.swift), [`BrowserScriptBridge.swift`](Sources/SwitchCore/BrowserScriptBridge.swift).
`show video source` now finds the tab after Chrome turns JavaScript from Apple Events off. Chrome resets that switch on update, and a background YouTube tab is invisible without it. Three stacked bugs made the recovery a no-op: (1) an unchecked View ▸ Developer ▸ Allow JavaScript from Apple Events item reports `AXMenuItemMarkChar` as the literal string `"missing value"`, which the click script treated as a checkmark, so Return reported ALREADY and never clicked (measured: `treatsAsAlreadyOn=true`); (2) a 5 s negative JS-availability cache skipped the per-tab walk on the rescan; (3) the empty-state prompt only fired when CoreAudio listed the browser, missing Chromium's `"Playing audio"` idle-sleep assertion — the HUD said "No video playing" while Chrome had been playing for over an hour. The mark is classified correctly, the cache is dropped after a flip, that assertion is corroboration, and the command itself is treated as consent to enable JS once on a browser already known to be playing, then rescan and jump. Files: [`AXMenuItemMark.swift`](Sources/SwitchCore/AXMenuItemMark.swift), [`ProcessVideoProbe.swift`](Sources/SwitchCore/ProcessVideoProbe.swift), [`BrowserScriptBridge.swift`](Sources/SwitchCore/BrowserScriptBridge.swift), [`AudioSilenceService.swift`](Sources/WOS/AudioSilenceService.swift), [`AppDelegate.swift`](Sources/WOS/AppDelegate.swift); tests in [`MediaJSEnableTests.swift`](Tests/SwitchCoreTests/MediaJSEnableTests.swift).
The test suite no longer writes into the developer's real preferences. Three store suites built their scratch storage with `UserDefaults(suiteName:)`, which is not scratch storage: each call writes a plist into `~/Library/Preferences` and registers the domain with `cfprefsd`. Nothing removed them, so every `swift test` leaked one domain per store it built, permanently. On the machine this was found on there were 3154 of them, 26 MB, and 81% of the user's 3901 preference domains — the account's own preference store was, by count, mostly WOS test garbage.
The gate was under-reporting the leak by a factor of eight. Its hygiene check grepped for `com.wos.test`, which matched only the clipboard suite's 378 domains; the bookmark, persistence, corruption and partial suites all wrote under a bare `wos.test.` prefix and were invisible to it. It now matches `^(com\.)?wos\.test\.` and names the cleanup script. Files: [`release_gate.sh`](scripts/release_gate.sh).
The click-to-switch panel no longer appears for short Secure Input holds. Reported as "the horizontal one shows up next to the normal Cmd+Tab and does not look good" — and the complaint was really about *when* it appears, not what it is. Measured over 97 completed holds on the development machine, the distribution is bimodal: 73 lasted under 7 seconds — a password field taking focus, `SecurityAgent` asking for a keychain, Touch-ID UI — and released on their own, while 13 ran past a minute, up to 2 h 11 m, the leaked assertions where the panel is the only way to switch apps at all. Between 8.0 s and 10.7 s there was nothing.
The panel now says how to get the keyboard back. Someone reading it has just found Cmd+Tab dead and has no other source of that answer: the layer that would otherwise explain it is opt-in and off by default, which is exactly how a stuck hold went undiagnosed for ten hours on 2026-08-19. The footer names the holder and then the remedy for *this* kind of holder — "Quit 1Password to get Cmd+Tab back" for an app, "Lock and unlock the screen to get Cmd+Tab back" for a system or already-exited holder, which no amount of quitting can fix. Clicking a row is self-evident from the rows; which app to quit is not.
Settings → Privacy: "Show the click-to-switch panel during a hold". On by default. Off restores pre-0.1.1040 behaviour exactly — the native switcher alone, WOS silent, episodes still recorded in the diagnostics log. It is deliberately independent of the "Warn about Secure Input blockages" master switch: that one governs the warning layer, this is the product answering rather than a warning about it.