RUNTIME-001 — Prepare profile backend for Node.js 22 #691

Outcome

Move the existing first-generation Functions source runtime from Node.js20 to Node.js22 before the limited profile backend release. Google's current schedule lists Node20 decommissioning on2026-10-30; Node22 supports first-generation Functions and is the compatible maintained runtime choice without a generation migration.

This is a source/test prerequisite for #136 and #683, not billing, IAM, deployment, membership-policy or live-release authority.

Invariants and scope

• Keep CommonJS, existing function identities/triggers, schema, authorization, App Check and create-once/retry behavior unchanged.
• Keep first release limited to createMemberOnSignUp and ensureMemberProfile. Preserve zero minimum/two maximum instances,256MB and30s timeout.
• Align Functions manifest/lock metadata and exact provider-readback verification to nodejs22; reject stale/missing/other runtime proof.
• Retain Node20 baseline checks; add a separately required Node22 backend compatibility job using committed installs and synthetic/emulator tests only. Both protected-release CI reads must require it.
• No dependency version/resolution upgrades, no new package, no production secret/data/provider use.
• No automatic deployment or grant of cloud authority. Existing BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113/CI-001C — Configure protected short-lived Firebase deployment identity #133/CI-001D — Prove backend-first staging and deploy the profile repair #136 gates remain.

Acceptance

• Focused failing-before/passing-after source/runtime/readback and CI omission/skip/weakening tests.
• Exact Node22 manifest/lock/readback contract; no mixed-generation or broad-deployment change.
• Node20 baseline and Node22 full Functions tests; Node22 Auth/Firestore integration; applicable rules/frontend/build/release checks.
• Dependency audit recorded without forced upgrades; exact lock diff inspected.
• Independent evidence-based review, officer documentation and migration/rollback limits.
• Exact PR and post-merge CI, with actual steps inspected. No hosted proof inferred.

Officer impact: Prepares the two profile operations for a supported server runtime; no live account or website behavior changes.
Officer documentation: Update the low-cost community and publish/check guides, entry/handbook notice and matching root records.
Deployment evidence: None. Staging billing remains disabled with zero accessible club-account billing accounts on today's read-only preflight; Functions/Cloud Build/Artifact Registry APIs remain disabled. No provider setting changed.

References

• https://docs.cloud.google.com/functions/docs/runtime-support
• https://firebase.google.com/docs/functions/1st-gen/manage-functions-1st

Stop conditions

Stop for dependency-major migration, generation/trigger change, billing/IAM/API enablement, real data/credentials, a widened deploy set, or an unresolved compatibility failure. Escalate rather than weakening a guard.

Completion evidence

Source-only completion: PR #692 merged as a4e8b0e; merge tree equals reviewed head dae66f0. Exact PR CI36316587964 and main-push CI36316761613 both passed all six jobs with every step successful. Logs confirm Node22 profile persistence ran (7,577 passed/63 commerce skipped), Node20 Functions7,576/64 skipped, separate commerce63, frontend1,346, Rules418, guards138, SPA11, scrubber37, and successful build/artifact verification. Independent review found no actionable issues. No schema/backfill or dependency-version change. Officer no-terminal review, stop, proof, compatible recovery and escalation paths are documented; provider setup/release/rollback still needs a specialist. Existing dependency findings are unresolved, not accepted as safe. No Firebase/provider deployment or billing change. Public runmprc.com marker remains #685 source41a9ae4. #113/#133/#136 and approved billing/cost controls remain prerequisites; PR690 remains open/draft and disabled. This closes only the runtime source prerequisite, not the hosted-backend goal.