Right. Like many, I cannot live with a yellow light, so I have to fix it. 
I realize that using the piggyback DHM is a far better way to go. Just need to recognize that it IDENTIFIES the machines, but I then need to manually TLS register them and all’s well. It means no phantom machines exist without my knowledge - and I like this a lot.
So I’ll delete the original, incorrectly named, instances and give preference to the DHM ones. Staff will just have to ensure that any new machine must be either fully setup - or erased from the cluster. No more phantoms.