fix(orders): a pending order's age comes from the filename, not the mtime

`coord-order-done --return` rewrites the order file's mtime, and both age
surfaces read mtime, so putting an order back reset the very reading that
says how long it has waited. An order returned three times could never look
old - on the one surface that exists precisely so a repo nobody opens still
shows something.

Found by reading the board right after this repo returned an order of its
own, not by looking for it: a file whose name says 2026-09-02 rendered
`ORDRE 1:0d` and `pending, 0d old` minutes later. Verified live after the
fix: the same order now reads 1d.

Two questions, two sources, and only one of them moved. A PENDING order's
age is "how long has this sat with no owner" = now - delivery time, which
only the filename carries and nothing rewrites. A CLAIMED order's age is
"how long has it been in flight", which is the claim's own mtime and was
already right. So oldest_pending_age() sits BESIDE oldest_order_age(), and
pending_age_of() beside age_of() - switching FLY to the filename would
answer the delivery question in the column that asks the flight question.
An unparseable filename yields "?" for the whole reading, never a
fabricated 0, because an unmeasured order could be the oldest one.

TDD, red first: orders-selftest section 11 (110 -> 116) and board-selftest
section 30 (360 -> 368), each asserting its own ground truth before
anything depends on it, with controls that a freshly delivered order still
reads 0d and that FLY did not move. Mutation-verified in both files:
restoring the mtime read turns exactly the defect checks red and leaves
every control green.

Section 28's fixtures were rewritten as part of this rather than
incidentally: they encoded their ages in `touch -t` while their filenames
held fixed 2026-01/2026-08 dates, which a filename-based reading makes both
wrong and time-dependent. They now compute their stems from `date -v` and
the section asserts two ground truths, the filename for ORDRE and the mtime
for FLY.

Order 20260903T185736Z-1290610855 (.claude). Version 0.32.1 across all
seven files; no catalog change in this session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/board.sh

@@ -406,6 +406,49 @@ oldest_order_age() {
 }
 
 
+# The PENDING age is read from the FILENAME's timestamp, never the mtime.
+# ORDRE 20260903T185736Z-1290610855: `coord-order-done --return` rewrites the
+# order file's mtime, and this column read mtime, so an order returned three
+# times could never look old - on the one surface that exists precisely so a
+# repo nobody opens still shows something. Measured on the live queue the day
+# the order was written: a file whose name said 2026-09-02 rendered `1:0d`.
+#
+# The filename is written once, at delivery, and nothing rewrites it, which is
+# exactly the fact "how long has this sat with no owner" is asking about.
+#
+# FLY keeps oldest_order_age above, and that is not an oversight: a claimed
+# order's age is "how long has it been in flight", which is when the CLAIM
+# happened - the mtime - and switching it to the filename would answer the
+# delivery question in a column that asks the flight question.
+#
+# Same three outcomes as oldest_order_age, for the same reasons: "-" empty,
+# "?" unmeasured (a name the grammar does not produce has no readable delivery
+# time, and an unmeasured file could be the oldest one), "Nd" measured.
+oldest_pending_age() {
+  opa_oldest=""; opa_seen=0; opa_unmeasured=0
+  for opa_f in "$1"/*.md; do
+    [ -f "$opa_f" ] || continue
+    opa_seen=1
+    opa_ts="$(basename "$opa_f")"; opa_ts="${opa_ts%%-*}"
+    case "$opa_ts" in
+      [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]T[0-9][0-9][0-9][0-9][0-9][0-9]Z)
+        opa_n="$(printf '%s' "$opa_ts" | tr -dc '0-9')"
+        opa_e="$(date -u -j -f %Y%m%d%H%M%S "$opa_n" +%s 2>/dev/null)"
+        case "$opa_e" in
+          ''|*[!0-9]*) opa_unmeasured=1 ;;
+          *) if [ -z "$opa_oldest" ] || [ "$opa_e" -lt "$opa_oldest" ]; then
+               opa_oldest="$opa_e"
+             fi ;;
+        esac ;;
+      *) opa_unmeasured=1 ;;
+    esac
+  done
+  if [ "$opa_seen" -eq 0 ]; then printf -- '-'; return 0; fi
+  if [ "$opa_unmeasured" -eq 1 ] || [ -z "$opa_oldest" ]; then printf '?'; return 0; fi
+  printf '%dd' $(( (NOW - opa_oldest) / 86400 ))
+}
+
+
 # --- Voyage project detection (ORDRE 20260831T135934Z-696228720) ------------
 # board read STATE lines and knew nothing about Voyage briefs, so a programme
 # running Voyage across several repos had no shared surface: nobody could
@@ -653,7 +696,7 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
   # measured 2026-08-23), so a claim without an age is that non-claim with its
   # only counter-evidence removed.
   ordersage="-"
-  [ "$orders" -eq 0 ] || ordersage="$(oldest_order_age "$COORD/$name/orders")"
+  [ "$orders" -eq 0 ] || ordersage="$(oldest_pending_age "$COORD/$name/orders")"
   claimedage="-"
   [ "$claimed" -eq 0 ] || claimedage="$(oldest_order_age "$COORD/$name/orders/claimed")"