You don’t need to call proxy_target yourself. The association proxy is built to allow you to treat it like it was the target. So the following should load the target and do what you want:
The reason I'm updating attributes in this "complicated" way is that
I've overridden the credentials= assign method, so that I can handle
CUD (create, update, delete) operations on the association from the
same form w/o special-casing in the controller. The controller just
calls