Function slot_tmp_file_name 

pub fn slot_tmp_file_name(model_id: u32, session_id: &str, nonce: u64) -> String

Filename for an in-flight save: {model_id}__{session_id}.{nonce}.tmp.

llama-server is asked to write here instead of directly to the final .bin name, so a save that times out or is retried while the server is still writing can never produce a torn file at the name restore/eviction actually read — those only ever see *.bin (see slot_file_name). The caller renames this to the final name only after a confirmed-complete write; nonce (a per-attempt counter) keeps concurrent attempts for the same session from writing the same temp file.