Groan - while documenting it, I realised the current code can have the unfortunate side effect of causing the service to quickly migrate to another node and back again, in these two cases:

* the resource is a clone but it is not running on every node in the cluster (e.g. if `clone-max` is less than the number of nodes in the cluster)
* the resource is not a clone

So maybe we can still do better.  Please don't merge yet.