fix(payments): retest reuses live session instead of re-paying (double-pay #2)

With autoCancelAfterTest OFF (the default) main-pass sessions stay ACTIVE after
testing, so the in-runAudit retest blocks (internet-failure + Iron-Rule) that did
clearPaidNodes()+re-test created a SECOND paid session per node while the first
deposit was still locked — a real double-pay from the live wallet.

Fix (reviewed): remove clearPaidNodes() from those two retest blocks so nodes keep
their paid flag, and change node-test.js's retest branch to re-query
findExistingSession and REUSE the still-active session (no new payment); it clears
the paid flag and pays fresh only when no active session is found (autoCancel ON
cancelled it, or it expired). Mirrors the proven !retestMode recovery path.

Verified by adversarial review: findExistingSession returns ONLY active sessions
(status 1/'active'; cancelled inactive_pending filtered at session.js:133), so
reuse can never resurrect a dead session and autoCancel-ON correctly pays fresh.
Manual retest (clearPaidNodes at run start), TEST RUN, balance-pause, and orphan-
cancel paths unaffected. Test suite green (188/31/45/35).

Author: Sentinel-Bluebuilder

audit/node-test.js

@@ -294,10 +294,31 @@ export async function testNode(client, account, privkey, node, opts, preSessionI
     }
   }
   if (!sessionId && isPaid(node.address) && state.retestMode) {
-    // In retest: clear the stale paid flag for THIS node only, so it can be
-    // re-paid. clearPaidNodes() (clear-all) here was a double-pay vector — it
-    // dropped every other node's paid flag too, re-opening the dup-pay guard.
-    clearPaidNode(node.address);
+    // Retest of an already-paid node. With autoCancelAfterTest OFF (the default)
+    // the main-pass session is still ACTIVE on-chain — re-query and REUSE it so
+    // we don't pay twice while the first deposit is locked (double-pay vector).
+    // Only if no session is found (autoCancel cancelled it, or it expired) do we
+    // clear the paid flag so a fresh payment is made below. Mirrors the
+    // !retestMode "charged-yet-untested" recovery above.
+    let reSid = null;
+    try {
+      reSid = await findExistingSession(node.address, account.address, broadcast);
+      if (!reSid) {
+        await sleep(5_000);
+        invalidateSessionCache();
+        reSid = await findExistingSession(node.address, account.address, broadcast);
+      }
+    } catch (reErr) {
+      console.error('[node-test] retest session re-query failed:', reErr?.message || String(reErr));
+    }
+    if (reSid) {
+      sessionId = BigInt(reSid);
+      addToSessionMap(node.address, sessionId);
+      if (broadcast) broadcast('log', { msg: `  ✓ Retest: reusing existing session ${sessionId} (no new payment)` });
+    } else {
+      // Old session gone (cancelled/expired) — allow a fresh payment below.
+      clearPaidNode(node.address);
+    }
   }
 
 // Balance check — return PAUSE signal instead of failing

audit/pipeline.js

@@ -1081,7 +1081,10 @@ export async function runAudit(resume, state, broadcast, preloadedNodes = null,
     broadcast('log', { msg: `\n🌐 Retesting ${internetFailAddrs.size} nodes that failed during internet outage...` });
     state.retestMode = true;
     clearPoisonedSessions();
-    clearPaidNodes();
+    // Do NOT clearPaidNodes() here — these nodes were paid in the main pass and
+    // (autoCancel off) their sessions are still active. Keeping the paid flag
+    // lets node-test.js re-query & REUSE the live session instead of paying
+    // twice; it pays fresh only if the session is genuinely gone.
     const retestNodes = viableNodes.filter(n => internetFailAddrs.has(n.node.address));
 
     for (let ri = 0; ri < retestNodes.length; ri++) {
@@ -1154,7 +1157,9 @@ export async function runAudit(resume, state, broadcast, preloadedNodes = null,
     broadcast('log', { msg: `🔄 Auto-retesting ${failedWithPeers.length} failures with peers > 0 (Iron Rule)...` });
     state.retestMode = true;
     clearPoisonedSessions();
-    clearPaidNodes();
+    // Do NOT clearPaidNodes() here — same reason as the internet-failure block:
+    // keep the paid flag so node-test.js reuses the still-active session instead
+    // of double-paying; it pays fresh only if the session is gone.
     const failAddrs = failedWithPeers.map(r => r.address);
     const retestNodes = viableNodes.filter(n => failAddrs.includes(n.node.address));