Secure Input left permanently enabled by loginwindow after login; no way to clear it

Product Version: Sequoia 15.7.3

After login, loginwindow (owned by launchd) acquires Secure Input via EnableSecureEventInput and never releases it for the entire session. Because the holding process is loginwindow itself, there is no application a user can quit to recover. The documented "quit the offending app" guidance is inapplicable when the offending process is the login process. The only remediation is logout or reboot, which is a poor answer for a keyboard-input security feature silently disabling third-party keyboard tooling (window managers, text expanders, macro utilities) for hours at a time.

Steps to Reproduce:

Step 1 — Log in normally (Touch ID or password).

Step 2 — In Terminal, run: "ioreg -l -w 0 | grep kCGSSessionSecureInputPID"

Step 3 — Observe kCGSSessionSecureInputPID is set to the loginwindow PID.

Step 4 — Confirm the PID: "ps -p <PID> -o pid,ppid,lstart,command" — shows loginwindow, parented to launchd (PID 1), started at session login time.

Step 5 — Quit all user apps including password managers (e.g. 1Password) individually. Secure Input remains held.

Step 6 — Lock and unlock (Ctrl+Cmd+Q + re-auth). Secure Input frequently remains held.

Expected: loginwindow releases Secure Input once login completes and the session is active.

Actual: loginwindow retains the Secure Input claim for the full session. Third-party keyboard-event consumers are blocked until logout or reboot.

Diagnostic notes:

The holder is confirmed via IORegistry, not a third-party tool's best-guess attribution, so this is not a mislabeled app-level grab. killall loginwindow clears the state but ends the GUI session, and the relaunched loginwindow can re-acquire the claim on the next login, suggesting the release path is not reliably executed at login completion. A commonly reported trigger is sleeping or closing the lid without locking first, then unlocking.

Impact: Any tool relying on keyboard event taps (tiling window managers such as AeroSpace, TextExpander, Keyboard Maestro) is silently disabled with no user-recoverable fix short of a session restart.