Two-line file format (expires_unix\nargon2id-PHC) keeps the C PAM module parser trivial — no json-c link needed. Atomic temp+rename means a concurrent reader never sees a half-written file. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>