Major Description
Currently a server must appear in its own config when it starts up. One of the reasons is that the server spec has LE ports through which it can connect to the leader. This means that when creating an initial configuration file of a server we'd like to add to the ensemble, we have to specify an invalid config where the new server already appears. This config is different from the current config and potentially from the new config that may eventually be installed.
Besides being a bogus config, this method means we have to be careful when adding multiple servers to the ensemble. If, for example, the current config is (A, B, C) and we'd like to add D and E, server D can have the initial config of (A, B, C, D) and server E the config (A, B, C, E) but not (A, B, C, D, E) since this risks C, D, E forming a quorum and loosing data (suppose that C was initially down and now C, D, E don't know the state of A, B and don't know that their own config is bogus). To see why its risky consider the indistinguishable case where A, B, C, D, E are all just starting from scratch and A and B are down.
One cleaner way to implement this would be to mark somehow the config rows corresponding to joining servers to indicate that they are not part of the config. Then take this information into account during leader election so that the joining servers can't vote to elect a leader. Such as server.5.joining=...
There are probably other good options to address the issue.