The header was the only place that knew a tab name can be a person. The sidebar,
the tab strip and a pop-out's window title drew the same "Player@World" string
untouched, so a screenshot of the default view still named the partner while the
messages underneath were anonymised. Guarding one surface out of four guards
nobody.
The rule sits in one place now and all four read it. Names are replaced rather
than blanked: a nameless tab in a strip of tabs is worse to use than a
placeholder, and the sidebar has no room to explain itself. The salt is drawn
fresh on every plugin load, the same reasoning the message path uses -- a stable
label would let two screenshots taken weeks apart be tied together.
The tab strip resolves once and both measures and draws that value. Measuring one
string and drawing another would have sized every tab wrong the moment the mode
came on, which is the kind of thing that looks like a layout bug and gets fixed
in the wrong place.