Hi @bonnietwin, thank you for that eye-opening link 
I had not done this and will try that tomorrow.
All, changing over to a completely different subnet on Blue and explicitly permitting the device on Blue to access the internet (thank you @bonnietwin) was the solution. Everything works as it should now.
Thanks all!
I agree with @bbitsch analysis of the DHCP protocol in that I believe the effect I saw (Green-connected devices getting a Blue DHCP address) is a bug.