You did not trust my screenshot. You re-derived my desktop.

This link's tape

Paste a share fragment below (or arrive here with one after # in the URL — it is read automatically). What you see here is a display-only preview decoded in this page's JS for legibility; the authority is the replay your viewer server performs. This page never replays anything itself and holds no world.

The grammar (one line, forever)

• ts — the pinned instant. Receipt hashes bind the wall-clock, so byte-identical replay requires sharing it: the clock rides the link as a recorded, replayable input.
• act — one message of the tape, in order: a cell (by hex-id prefix) and the affordance verb sent to it. The same (cell, message) vocabulary the --replay bake flag and the dregg-mcp act log already speak.
• root — the sharer's claimed canonical ledger root after the tape. The viewer re-derives its own and shows ROOT MATCH or, honestly, ROOT MISMATCH.
• tab — the cockpit surface the sharer was looking at, so the frame reconstructs the view as well as the world.

What the viewer server does with it

• Boots a fresh demo world pinned to ts — never the live one. Two boots at one instant are receipt-identical by construction.
• Re-executes each act through the real verified executor (the same cap-gate + turn path every cockpit surface fires). A refused or unresolvable act is skipped in-band and listed — the page tells you the reconstruction is not the sharer's desktop.
• Derives the canonical ledger root and judges it against the link's claim. Then — and only then — renders the frame, as an illustration of a world you already verified.

The whole route is stateless and read-only: a stranger's link buys a bounded replay (32 acts max) against a throwaway world. It cannot drive the live cockpit, and there are no live turns from strangers — sharing a desktop hands over a derivation, not a capability.