Oh... so a single instance can register as more than one Almanac device?

No, it's more like this:

A bunch of different hosts can have the same device key, which serves as a login/password. When they connect to Phabricator, hosts connect as the device associated with that key. The associated device does not need to have any special relationship to the host name or actual nature of the host itself.

For instance, you can create a device called root, and pair it with a key, and put that key on your phone and your xbox and 5 hosts and your laptop. That's fine, they can all connect as root. It doesn't matter that none of them have a hostname like root.mycompany.com.

Connecting as different devices doesn't do anything different right now. They all have the same permissions (maybe logging is a little different). So there's no technical reason you shouldn't just put a root key all over the place: the behavior will be the same as if you'd created a lot of different keys. The behavior is also the same as if you created a lot of different keys, put them all on the root device, and then gave each host a unique key. The only differences are: (a) some logging might be a little different if you really create different devices; (b) cycling and revoking keys is obviously easier if you did one key per host.

All this stuff so far is only letting hosts connect to Phabricator. Phabricator might also want to connect to hosts (to run repository operations).

You can use totally different devices for this that have no keys and no relationship to the devices with paired keys, even though they might really be the same underlying hosts. It's fine to give one physical host as many different device entries as you want if you have some reason to do so. Stuff that connects to it doesn't ask it "are you <device such-and-such>", it just uses the record to figure out how to connect to it.

Basically, inbound is similar to a login/password. You can have as many things log in as "root" as you want.

Outbound is similar to DNS. You can have a.mycompany.com and b.mycompany.com and quackquack.othercompany.com all resolve to the same IP.

And the login/password and DNS can be separate. If host X sometimes logs in as "root", you don't need to pair the "root" key with every DNS record for it. Nothing checks to make sure that the host has a single identity.