fix(desk): "everything else" is last UPDATED first, not last activity

The operator, on the live Desk: "how is this last activity first?" It was not,
usefully. The section sorted by `_newest_mtime`, which counts a look (`.viewed`),
so opening a booth moved it up. Tonight two post-deploy checks fetched every
booth page within half a second, which recorded 22 looks at once and collapsed
the section into reverse name order through the (mtime, name) tie-break.
Meanwhile each row shows "updated X ago", which is `landed_at`, a different
clock from the one the list was sorted by.

Operator ruling: "last activity can just be last time the booth was updated,
not necessarily operator's last activity." The section now sorts by
`(-landed_at, name)`, the date the row shows, labelled "last updated first".
Looking, flagging and blurring no longer move a booth. `list_booths` keeps its
own order for its other readers, and `_newest_mtime` still feeds lifetime.

The r2_flow contract (§3, the ordering table, INV-5) and ROADMAP's ordering row
are amended to match. Two tests and two r2_flow.toml rows cover it (25/25).

tests/mutations/r2_flow.toml

@@ -210,3 +210,21 @@ old = '''
 new = '''
       var word = WORDS[form.getAttribute('data-confirm')];
       if (word && !confirm('''
+
+[[mutation]]
+label = "everything else in activity order again (a look moves a booth up)"
+file = "booth/app.py"
+test = "tests/test_flow.py::test_everything_else_is_ordered_by_last_update_not_by_looking"
+old = '''
+        rest.sort(key=lambda b: (-b["landed_at"], b["name"]))'''
+new = '''
+        pass'''
+
+[[mutation]]
+label = "everything else breaks an update tie by name reversed"
+file = "booth/app.py"
+test = "tests/test_flow.py::test_everything_else_breaks_an_update_tie_by_name"
+old = '''
+        rest.sort(key=lambda b: (-b["landed_at"], b["name"]))'''
+new = '''
+        rest.sort(key=lambda b: (b["landed_at"], b["name"]), reverse=True)'''

tests/test_flow.py

@@ -243,6 +243,36 @@ def _desk(body: str) -> dict[str, list[str]]:
     return out
 
 
+def test_everything_else_is_ordered_by_last_update_not_by_looking(tmp_path):
+    """Operator, 2026-09-23: "last activity can just be last time the booth was
+    updated". The row shows "updated X ago" (`landed_at`), but the section
+    sorted by `_newest_mtime`, which counts a look, so opening a booth moved it
+    up, and a script that fetched every booth reshuffled the whole section into
+    reverse name order. Defeating change: `rest` left in `list_booths` order."""
+    t0 = time.time() - 100_000
+    for name, landed in (("aaa-old", t0), ("mmm-mid", t0 + 250), ("zzz-new", t0 + 500)):
+        b = _booth(tmp_path, name, {"a.png": PNG})
+        _at(b / "a.png", landed)
+        (b / ".viewed").write_bytes(b"")
+        _at(b / ".viewed", t0 + 1000)                 # every one looked at since it landed
+        _at(b, t0)
+    _at(tmp_path / "aaa-old" / ".viewed", t0 + 5000)  # ...and the OLDEST looked at last
+    body = _client(tmp_path).get("/").text
+    assert _desk(body)["rest"] == ["zzz-new", "mmm-mid", "aaa-old"]
+    assert "last updated first" in body
+
+
+def test_everything_else_breaks_an_update_tie_by_name(tmp_path):
+    """CLAUDE.md invariant 6: two booths landed by one rsync share an mtime."""
+    t0 = time.time() - 100_000
+    for name in ("bravo", "alpha", "charlie"):
+        b = _booth(tmp_path, name, {"a.png": PNG})
+        _at(b / "a.png", t0)
+        (b / ".viewed").write_bytes(b"")
+        _at(b / ".viewed", t0 + 10)
+    assert _desk(_client(tmp_path).get("/").text)["rest"] == ["alpha", "bravo", "charlie"]
+
+
 def test_the_desk_triages_needs_you_then_new_then_everything_else(tmp_path):
     """The tracer for C4: three sections, always in this order, each booth in
     exactly one of them."""