The fallback wrote <.mam>/herdr-server-config.toml unchecked, so it could replace a foreign file there, the source itself, or a link to it. It now goes through output_path like the normal path (source identity incl. aliases, generated-for-this-source ownership, then a per-source name) and writes nothing when no name is safe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>