[BUG] Servers added to darling.json after the first seed are silently ignored, and --test-connection still validates them #2254

Field report #2252. An operator added a second server to darling.json, confirmed it with --test-connection (both servers PASS), restarted the service, and the server never appeared. Nothing in any log said why.

Mechanism

StoreConfigProvider seeds the server list only when the table is empty:

if (await CountAsync(connection, "config_monitored_servers", cancellationToken) == 0)
{
    await SeedMonitoredServersAsync(connection, config, now, cancellationToken);
}

After the first successful start the store is authoritative (DarlingWorker: "The initial server set comes from config_monitored_servers WHERE is_enabled = TRUE (post-seed…)"). So a server added to the file afterwards is a permanent no-op, and there is no re-read path.

That is a reasonable design. The problem is that two supported commands disagree and neither says so:

Both are correct for what they consult. Together they tell an operator the server is configured and reachable, then don't monitor it.

Fix shape

Cheapest useful change, and it needs no schema or behaviour change: on every start, compare the file's server list against the store and log the difference. Something like

darling.json lists 2 server(s); the store has 1. Ignoring 'dcvs-bd01' — the store is authoritative after the first seed. Add servers with the Viewer's Add Server dialog or the MCP add_servers tool.

Worth considering alongside:

• --test-connection should say which servers are actually monitored. It is the command an operator reaches for to answer "is my config right", and today it answers a question about the file that reads as a question about the service. Naming each server as monitored or in file only would end this class of report.
• Whether a --reseed-servers or --sync-config verb is worth having. Riskier (it invites clobbering store-side edits), so the diagnostic above is the better first move.

Note

The same report also hit an unrelated DPAPI failure when adding the server from a remote Viewer, filed separately.