Keep Git table headers valid during upserts

Author: myobie

CHANGELOG.md

@@ -10,7 +10,9 @@ EXPERIMENTAL, so on-disk formats and the CLI may change without notice.
 
 - **Fabric commands no longer replace the formatting in `peers.toml`.** Add,
   remove, policy, and Git remote changes update only the affected entries.
-  User comments, spacing, order, and an edited or removed file header remain.
+  User comments, spacing, order, unknown fields, and an edited or removed file
+  header remain. This preserves newer fields when an older Fabric rewrites a
+  mixed-fleet configuration.
 
 - **A failed tunnel no longer reuses one bad shared connection forever.**
   Fabric counts post-admission attach failures on the exact current connection.

src/config.rs

@@ -1044,7 +1044,17 @@ fn upsert_table_field(table: &mut Table, desired: &Table, key: &str) -> Result<(
     };
     let child_position = table.position().unwrap_or(0).saturating_add(1);
     if let Some(current_item) = table.get_mut(key) {
+        let current_is_table = matches!(current_item, Item::Table(_) | Item::ArrayOfTables(_));
+        let desired_is_table = matches!(desired_item, Item::Table(_) | Item::ArrayOfTables(_));
         replace_item_preserving_decor(current_item, desired_item, child_position);
+        if current_is_table != desired_is_table
+            && let Some(mut current_key) = table.key_mut(key)
+        {
+            // A key-value line uses one space before `=`, while a table header
+            // uses no space before `]`. Clear the old context's key decor when
+            // a field changes between these two shapes.
+            current_key.fmt();
+        }
     } else {
         let mut desired_item = desired_item;
         let mut next_position = child_position;
@@ -1651,6 +1661,19 @@ mod tests {
         assert_eq!(mode, 0o640);
     }
 
+    #[test]
+    fn first_peer_save_creates_the_document_header() {
+        let directory = tempfile::tempdir().unwrap();
+        let home = FabricHome::new(directory.path());
+        assert!(!home.peers_path().exists());
+
+        PeerBook::default().save(&home).unwrap();
+
+        let raw = fs::read_to_string(home.peers_path()).unwrap();
+        assert!(raw.starts_with("# fabric peers."));
+        PeerBook::load(&home).unwrap();
+    }
+
     #[test]
     fn peer_add_and_remove_preserve_human_formatting() {
         let directory = tempfile::tempdir().unwrap();

tests/provisioning.rs

@@ -192,7 +192,10 @@ fn git_shares_and_peer_grants_live_in_peers_toml() -> Result<()> {
             .output()?,
     )?;
     let raw = fs::read_to_string(home.join("peers.toml"))?;
-    assert!(raw.contains("[[git_remotes]]"));
+    assert!(
+        raw.contains("[[git_remotes]]"),
+        "the Git remote table header changed:\n{raw}"
+    );
     assert!(raw.contains("git/mandat/write"));
     assert!(!raw.contains("git/mandat/read"));
     assert!(raw.contains("shell"));