Function candidate_label 

pub(crate) fn candidate_label(w: &AgentMuxWindowInfo) -> String

Label for a window in a CALLER-FACING disambiguation/candidate list.

Stricter than audit_target_label above, because the audiences differ: this one is returned to the agent, so it withholds the TITLE of every non-AgentMux window — reagent P1 on PR #2845. Foreign windows became capturable with the tier model, so any list built from the capturable set would otherwise disclose a user’s unrelated app titles (their browser, their password manager) as a side effect of a miss or an ambiguous match, bypassing DiscoverWindows’ own include_foreign opt-in. The pid alone disambiguates, and is what the caller needs anyway.