UUIDs don't serialise to JSON, so I'm now saving it as a plain
string and reconstructing a UUID object when it's returned.
Returning a UUID seems clearer than returning a string.
Retrieving metadata pre-action risks stale metadata being
returned if DirectThingClients are used. I've switched to
the safer callable dependency, which is guaranteed to be fresh.