Two changes:

Where possible, use link()/remove() to move files into a directory; this
makes it easier to avoid overwriting an existing file.

Use _create_carefully() to create files in tmp/, which uses O_EXCL.

Backport candidate.