diff --git a/src/repair/plan.rs b/src/repair/plan.rs
index 5f52cb4..05c855d 100644
--- a/src/repair/plan.rs
+++ b/src/repair/plan.rs
@@ -675,8 +675,10 @@ pub fn plan(
         }
     }
 
-    // Liveness is asked once per distinct pid, not once per module: a host with
-    // three modules must not be able to change its own verdict mid-plan.
+    // Liveness is asked once per distinct (pid, attribution), not once per module:
+    // a host with three modules must not be able to change its own verdict mid-plan.
+    // The attribution is part of the key because one pid can be two questions — see
+    // the verdict cache below.
     let mut live_pids = BTreeSet::new();
     let mut dead_pids = BTreeSet::new();
     let mut unknown_pids = BTreeSet::new();
@@ -1070,13 +1072,15 @@ mod tests {
         );
     }
 
-    /// Liveness is asked once per pid. Without this, a `liveness` that flips
-    /// mid-plan could unload some of a host's modules and keep others — the
-    /// worst possible outcome, since a half-repaired host is neither working
+    /// Liveness is asked once per `(pid, attribution)`. Without this, a `liveness`
+    /// that flips mid-plan could unload some of a host's modules and keep others —
+    /// the worst possible outcome, since a half-repaired host is neither working
     /// nor cleanable. Two pids, counted separately: one pid cannot prove
-    /// "once *per* pid".
+    /// "once *per* pid". (Both modules here are tokened, so one pid is one
+    /// question; `one_pid_with_two_attributions_gets_two_verdicts` covers the case
+    /// where it is two.)
     #[test]
-    fn liveness_is_decided_once_per_pid_not_once_per_module() {
+    fn liveness_is_decided_once_per_pid_and_attribution_not_once_per_module() {
         use std::cell::RefCell;
         let calls: RefCell<BTreeMap<u32, u32>> = RefCell::new(BTreeMap::new());
         let modules = [