fix(desk): "everything else" is last UPDATED first, not last activity

The operator, on the live Desk: "how is this last activity first?" It was not,
usefully. The section sorted by `_newest_mtime`, which counts a look (`.viewed`),
so opening a booth moved it up. Tonight two post-deploy checks fetched every
booth page within half a second, which recorded 22 looks at once and collapsed
the section into reverse name order through the (mtime, name) tie-break.
Meanwhile each row shows "updated X ago", which is `landed_at`, a different
clock from the one the list was sorted by.

Operator ruling: "last activity can just be last time the booth was updated,
not necessarily operator's last activity." The section now sorts by
`(-landed_at, name)`, the date the row shows, labelled "last updated first".
Looking, flagging and blurring no longer move a booth. `list_booths` keeps its
own order for its other readers, and `_newest_mtime` still feeds lifetime.

The r2_flow contract (§3, the ordering table, INV-5) and ROADMAP's ordering row
are amended to match. Two tests and two r2_flow.toml rows cover it (25/25).

docs/contracts/r2_flow.contract.md

@@ -6,7 +6,7 @@ purpose: "Make the Booth a place where judgment happens rather than a place wher
 depends_on:
   - "booth.items.booth_items + Item (INV-1: the one resolver). Item gains `ordinal`, derived there and nowhere else."
   - "booth.items.image_chain (the zoom ring). SUPERSEDED for the review route by `review_chain`; image_chain stays importable and unchanged for its existing callers and tests."
-  - "booth.app._newest_mtime (THE definition of activity — booth-dev, 2026-09-23). The Desk's 'last activity' reuses it verbatim. The Desk's 'landed since you looked' is a DIFFERENT question and gets a DIFFERENTLY NAMED helper; see INV-5."
+  - "booth.app._newest_mtime (THE definition of activity — booth-dev, 2026-09-23). It feeds lifetime; the Desk no longer sorts by it (amended 2026-09-23, §3). The Desk's 'landed since you looked' is a DIFFERENT question and gets a DIFFERENTLY NAMED helper; see INV-5."
   - "booth.app.record_view / VIEW_MARKER (`.viewed`, U4). The Desk reads its mtime to answer 'new since you looked'."
   - "booth.app.hold_read / hold_reason / open_marks (INV-2 of U2: the one openness predicate). 'Needs you' is `open_marks(...)` non-empty, or `hold_reason(...) == \"unreadable\"` (C4); nothing else."
   - "booth.marks.as_dict, set_flag, write_note, answer_pick, delete_mark (the write API, UNCHANGED)."
@@ -292,13 +292,18 @@ rule — a second renderer in JavaScript would be the same bug in a new language
      booth that has one.
 2. **New since you looked** — `not in_needs_you and (viewed_at is None or
    landed_at > viewed_at)`. Ordered by `(-landed_at, name)`, newest first.
-3. **Everything else** — in `list_booths`' own existing order: `(mtime, name)`
-   descending, where `mtime` is today's `_newest_mtime`. That is last activity
-   first, with name as the tie-break (`test_the_index_order_has_a_tie_breaker`
-   pins it). The Desk reuses that rule rather than stating a second one.
-   - Flagging or viewing a booth moves it up this section. That is intended:
-     it is activity. It never moves the booth into (2), because (2) reads
-     `landed_at` (INV-5).
+3. **Everything else** — last UPDATED first: `(-landed_at, name)`, the date
+   the row shows as "updated". **Amended 2026-09-23 by the operator** ("last
+   activity can just be last time the booth was updated, not necessarily
+   operator's last activity"). This section used to be `list_booths`' order,
+   `(mtime, name)` descending over `_newest_mtime`, and that clock counts a
+   look: opening a booth moved it up, and a script that fetched every booth
+   (a post-deploy check) collapsed the whole section into reverse name order.
+   - Flagging, viewing or blurring a booth no longer moves it. Only content
+     does, which is also what moves a booth into (2).
+   - `list_booths` keeps its own `(mtime, name)` order for its other readers,
+     and `_newest_mtime` still feeds lifetime (INV-5). Only the Desk's
+     section stopped reading it.
 
 The side column holds:
 
@@ -469,7 +474,7 @@ path) is a 404, as any other unknown rel is — never a 500.
   | Desk sections | fixed: needs → new → everything |
   | needs you | `(open_since, name)` |
   | new since you looked | `(-landed_at, name)` |
-  | everything else | `list_booths` order: `(mtime, name)` descending |
+  | everything else | `(-landed_at, name)`: last updated first (amended 2026-09-23) |
   | bookmarks | `order_for_display` |
 
   The notes list keeps `(created, id)`.
@@ -490,7 +495,8 @@ path) is a 404, as any other unknown rel is — never a 500.
     is specified in C3 and is the one declared exception.
 - **INV-5 — two named clocks.**
   - `mtime` / `_newest_mtime`: activity. It includes dotfiles and excludes
-    locks, and it feeds lifetime and 'everything else'.
+    locks, and it feeds lifetime. (It fed 'everything else' until 2026-09-23;
+    see §3.)
   - `landed_at`: content only (non-dot entries), and it feeds 'new since you
     looked'.
   - Never the one where the other is meant: a mark or a view is not new