Function local_user_id 

pub fn local_user_id() -> UserId

The person sitting at this machine. Actions are stamped with this so undo can tell collaborators apart (see crate::state::State::undo_as): the id must be stable across a document’s life and distinct between people, or one person’s Ctrl+Z reverts another’s work.

Mirrors the shell-side local_user_id ladder rung for rung (plus a sandboxed-app rung) so a compositor-granted capability and an app-stamped undo entry always name the same subject:

1. TILO_USER_ID — explicit override; the shell reads it first too.
2. The launcher-bound runtime identity (TILO_USER_IDENTITY) — the rung a packaged app actually lands on, since /var/lib/tilo is outside its sandbox.
3. $XDG_CONFIG_HOME/tilo/identity/primary.json, for the shell’s own unsandboxed in-process apps.
4. /var/lib/tilo/user-identity/pubkey.bin.
5. The OS account name, then a constant.

Not memoised — see auto_hello_env_uncached: a process hosting more than one identity must not be frozen into the first one.