[gummy789j]

1. Require patched Node.js releases. Node 20 is end-of-life and gets no fix for the October 2026 security releases. engines now accepts only the patched versions: >=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1. CI now covers Node 22, 24 and 26; the standalone workflow moves from Node 20 to 22. check-latest: true makes CI use the newest patch even when the runner image still ships an older one. The README and CLAUDE.md state the new minimum versions.
2. Fix intermittent ECONNRESET on the x402 paid request. x402 roundtrip runs the paywall server and the payer in one process. Between the 402 challenge and the paid retry, the payer decrypts its key (scrypt) and signs, and this blocks the event loop. On a busy CI runner the block can outlast the server's keep-alive timeout. The payer then writes the paid GET /pay to the idle socket just as the server closes it, and the payment fails with ECONNRESET and an unknown payment status. The server now sends Connection: close with the 402, so the paid retry always opens a fresh connection.
3. Widen golden test timeouts. Golden tests spawn the real CLI with real scrypt. On a loaded 4-vCPU runner several of them ran close to or past their limits: backup hit 31.1s and derive 29.9s against a 30s budget. The golden project timeout goes from 30s to 60s, the x402 roundtrip subprocess guard from 20s to 40s, and bai recharge from 60s to 120s.