Yes it seems MA registers the node in both places. I would not expect that 🙂
How about the following theory: when the ePOLeafNode.LastUpdate and RSDDetectedSource.LastDetected fields values equal, (plus Detection Source equals 'McAfee Agent') then it signifies a new node being added. I would expect that these two fields are less likely to be equal later (under certain conditions, like ASCI interval and RSD detection frequency, how these two relates).
As for the deletion of a node: I have no theory just now.. 🙂