Report file writes run one at a time (closes #150)

Two writes that failed at the same time put their reports back in the
wrong order when the older one failed first. A mutex is now held
across each write, from taking the waiting reports out of the buffer
to putting them back if the write fails, so the next write takes them
in order. The write Append starts at the 10 MiB threshold waits for
one under way, and Append starts no other while it waits. Files
written since the start are now deleted to make room in the order they
were written. A test that needed two writes at once is removed; new
tests cover the one waiting write and the order files are deleted in.

Model: opus-5-5

README.md

@@ -271,13 +271,15 @@ toward `DATA_DIR_MAX_BYTES` from the next start, only if removing it fails too.
 Files are created with `O_EXCL` to prevent overwrites.
 
 The reports of a failed write stay in memory, and the next flush, within a
-minute, tries again to write them. From the failed write until a write succeeds,
-`POST /api/v1/reports` refuses every report with 500 and keeps nothing of it.
-The page sends the refused samples again in its next report, as long as it still
-holds them: at the 1-second interval one refused report already loses some of
-those in the history (see [Reporting](#reporting)). Reports already answered 200
-are lost only if the server stops before a write succeeds; the final flush at
-stop tries them too, and if it fails, the process exits non-zero.
+minute, tries again to write them. The server writes one file at a time, so a
+file holds its reports in the order they arrived, those of a failed write
+included. From the failed write until a write succeeds, `POST /api/v1/reports`
+refuses every report with 500 and keeps nothing of it. The page sends the
+refused samples again in its next report, as long as it still holds them: at the
+1-second interval one refused report already loses some of those in the history
+(see [Reporting](#reporting)). Reports already answered 200 are lost only if the
+server stops before a write succeeds; the final flush at stop tries them too,
+and if it fails, the process exits non-zero.
 
 #### Report limits