fix(payments): clear only the retested node's paid flag (double-pay fix)

audit/node-test.js retest branch called clearPaidNodes() — which wipes the ENTIRE
paid-set — when it only meant to clear the one node about to be re-paid. That
dropped every other node's paid flag and re-opened the duplicate-payment guard
for the whole run: any node re-encountered after that point could be paid a
second time from the live wallet.

Add core/session.js clearPaidNode(addr) (deletes one entry) and call it in the
retest branch instead. clearPaidNodes() (clear-all) stays for the legitimate
run-/pass-start resets in pipeline.js.

Adversarially reviewed: fix correct + complete for its target; no TEST RUN/import
regressions; test suite green (188/31/45/35). NOTE (follow-up, pre-existing): the
mid-run retest blocks at pipeline.js:1064/1137 still clearPaidNodes()+re-pay
already-paid nodes — a separate MEDIUM double-pay vector to fix next.

Author: Sentinel-Bluebuilder

audit/node-test.js

@@ -14,7 +14,7 @@ import { BRIDGE_AVAILABLE, bridgeNodeStatus, bridgeHandshakeWG, bridgeHandshakeV
 import { TKD_AVAILABLE, tkdNodeStatus, tkdHandshakeWG, tkdHandshakeV2Ray } from '../core/tkd-bridge.js';
 import {
   getCredential, saveCredential, clearCredential,
-  markSessionPoisoned, isPaid, markPaid, clearPaidNodes,
+  markSessionPoisoned, isPaid, markPaid, clearPaidNode,
   addToSessionMap, findExistingSession, invalidateSessionCache,
   waitForSessionActive, parseNodePriceUdvpn,
 } from '../core/session.js';
@@ -294,8 +294,10 @@ export async function testNode(client, account, privkey, node, opts, preSessionI
     }
   }
   if (!sessionId && isPaid(node.address) && state.retestMode) {
-    // In retest: clear stale paid flag, allow fresh payment
-    clearPaidNodes();
+    // In retest: clear the stale paid flag for THIS node only, so it can be
+    // re-paid. clearPaidNodes() (clear-all) here was a double-pay vector — it
+    // dropped every other node's paid flag too, re-opening the dup-pay guard.
+    clearPaidNode(node.address);
   }
 
 // Balance check — return PAUSE signal instead of failing

core/session.js

@@ -81,6 +81,12 @@ export function isPaid(nodeAddr) {
 export function clearPaidNodes() {
   paidNodesThisRun.clear();
 }
+// Clear the paid flag for ONE node (retest re-payment of a single node). Do NOT
+// use clearPaidNodes() for that — it wipes every node's flag and re-opens the
+// duplicate-payment guard for the whole run (double-pay vector).
+export function clearPaidNode(nodeAddr) {
+  paidNodesThisRun.delete(nodeAddr);
+}
 
 /** Invalidate session map after payment creates new sessions */
 export function invalidateSessionCache() { sessionMap = null; }