A Zeroconf situation?

Will somebody help me walk through this possible zeroconf application I am
trying to formulate.

I have an appliance.  A home gateway, a home router, a Networked
Refrigerator, An ethernet connected vacuum cleaner.... whatever....
Unconfigured, out of shrink wrap.  I drop it in a static addressed or
DHCP-served network, but I *don't* want to to claim a DHCP address (there
may be a VERY limited number of IPv4 addresses from the lcoal DHCP server,
and I would not want the device to presume that it can have one of them).  I
want it to come up as IPv4LL, and unable to route, unable to claim a DHCP
address.  I want it to detect the presence of a DHCP server, but not claim
an address.

Now, a static/DHCP IPv4 addressed device on the same broadcast domain wants
to discover that type of device (or set of devices) in the domain, and
configure them, in a uPnP sort of way, or maybe through a web browser.  I
envision maybe a multicast address for discovery?

Effectively,  we have two ships-in-the-night V4 subnets on a broadcast
domain.  Most V4 stacks won't have a link local and globally scoped address
on the same interface.  Even if I multicast from a non v4LL address to a
v4LL address, how would the v4LL device be able to respond to an 'off
subnet' address (apparently, it wouldn't?)

So in short, is there a

1) Means to communicate between a link local and globally scoped address?
Is it allowed?
2) Means to discover the device(s) that have a Link Local address?

Sounds like a uPnP meets zeroconf scenario, but I can't grok the best way to
get globally and locally scoped hosts to communicate.  If it is even
possible.

The fundamenal idea is that I can drop an unconfigured device onto any
network in a non-disruptive way, and then discover and configure it while
not having to mess with the stack/addressing of the configuring machine.

Is this problem addressed?  The devices are on the same broadcast domain yet
will not be able to talk since they disagree about the subnet.