Hmm, and if I disable it manually, I'm hitting another ACIError.  Will try and dig into it more tomorrow.

    [Thu Mar 27 19:27:03 2014] [error] ipa: INFO: realm-proxy@EXAMPLE.ORG: host_find(u'realm4.example.org'): SUCCESS
    [Thu Mar 27 19:27:03 2014] [error] ipa: INFO: realm-proxy@EXAMPLE.ORG: host_disable(u'realm4.example.org'): AlreadyInactive
    [Thu Mar 27 19:27:03 2014] [error] ipa: INFO: realm-proxy@EXAMPLE.ORG: host_mod(u'realm4.example.org', random=1, setattr=(u'userclass=libvirt',)): ACIError