repair: say "once per (pid, attribution)", because that is what it is now

Codex's non-blocking round-7 nit. The comment and test name still claimed liveness
is asked once per pid, which stopped being true when one pid became two questions.
No behaviour change; the wording was the last thing pointing at the old model.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/repair/plan.rs

@@ -675,8 +675,10 @@ pub fn plan(
         }
     }
 
-    // Liveness is asked once per distinct pid, not once per module: a host with
+    // Liveness is asked once per distinct (pid, attribution), not once per module:
-    // three modules must not be able to change its own verdict mid-plan.
+    // a host with three modules must not be able to change its own verdict mid-plan.
+    // The attribution is part of the key because one pid can be two questions — see
+    // the verdict cache below.
     let mut live_pids = BTreeSet::new();
     let mut dead_pids = BTreeSet::new();
     let mut unknown_pids = BTreeSet::new();
@@ -1070,13 +1072,15 @@ mod tests {
         );
     }
 
-    /// Liveness is asked once per pid. Without this, a `liveness` that flips
+    /// Liveness is asked once per `(pid, attribution)`. Without this, a `liveness`
-    /// mid-plan could unload some of a host's modules and keep others — the
+    /// that flips mid-plan could unload some of a host's modules and keep others —
-    /// worst possible outcome, since a half-repaired host is neither working
+    /// the worst possible outcome, since a half-repaired host is neither working
     /// nor cleanable. Two pids, counted separately: one pid cannot prove
-    /// "once *per* pid".
+    /// "once *per* pid". (Both modules here are tokened, so one pid is one
+    /// question; `one_pid_with_two_attributions_gets_two_verdicts` covers the case
+    /// where it is two.)
     #[test]
-    fn liveness_is_decided_once_per_pid_not_once_per_module() {
+    fn liveness_is_decided_once_per_pid_and_attribution_not_once_per_module() {
         use std::cell::RefCell;
         let calls: RefCell<BTreeMap<u32, u32>> = RefCell::new(BTreeMap::new());
         let modules = [