your instances have to be disposable and reproducible, at the first hint of a break in my default action is to torch and rebuild.

Or rather shutdown, preserve, start replacements. IMHO your automation should be able to deal with the old preserved instances being left alone.