I realise this came from me :) but I see now that the argument order of `for_vm` and `associate` is inconsistent, and one takes the UUID (`vm.identity`), the other takes the `vm` itself.  I slightly prefer the CR first, and prefer passing the VM - as long as we always have an object to pass (and not just a UUID) then this is probably better.