Function audit_target_label 

pub(crate) fn audit_target_label(w: &AgentMuxWindowInfo) -> String

Label for a window in the AUDIT TRAIL.

Fuller than candidate_label where it can be — reagentx P2 on PR #2845 correctly spotted that reusing the caller-facing label lost a T4 window’s title on a post-resolution failure, giving foreign-app failures less audit detail than AgentMux ones for no reason.

But NOT unconditionally full, because that finding’s premise — “the audit is server-side only” — does not hold here. The trail is an NDJSON file in this instance’s own data dir, and agents have shell access; it was read with tail during this PR’s own verification. It is therefore not a confidential sink.

So audit detail follows the ALLOW decision, not AgentMux-ness:

• allowed tier → full title. The agent could capture the window and read the title off the pixels anyway, so recording it discloses nothing new.
• withheld tier → pid and tier only. Recording a T3 title would hand the agent, via a file it can read, exactly the content the tier denied it — reopening through the log the same oracle closed in the title-miss path.