meteor3: web Fires publications to async (findOneAsync/countAsync/awaited firesUnion)

fireFromId, fireFromAlertId, fireFromActiveId and fireFromHash now use the
async collection APIs and async publish handlers (so try/catch catches
rejections). falsePositivesMyloc/industriesMyloc/comments.forReference are
cursor-only and needed no change. Verified over raw DDP against the seeded
dev Mongo 7; REST smoke stays byte-identical (12/12).

UPGRADE.md

@@ -224,10 +224,20 @@ MONGO_CONTAINER=tcef-mongo7 MONGO_SHELL=mongosh MONGO_PORT=27019 ./smoke/smoke.s
 - **fixtures.js / sitemaps.js** disabled (sync-only `@cleverbeagle/seeder` /
   pre-0.9 `gadicohen:sitemaps`) — not on the REST path. Debt.
 
+### Web-UI async migration (beyond the REST contract)
+- ✅ **Fires publications → async** (`fireFromId`, `fireFromAlertId`,
+  `fireFromActiveId`, `fireFromHash`): `findOne`→`findOneAsync`,
+  `count()`→`countAsync()`, `firesUnion` awaited, handlers `async` so the
+  try/catch actually catches rejections. Verified over raw DDP (all subs
+  `ready`, docs flow; fire + falsePositives docs delivered for the seeded
+  fire). `falsePositivesMyloc` / `industriesMyloc` / `comments.forReference`
+  needed **no change** — they return bare `find()` cursors (still sync-safe on
+  Meteor 3). `subscriptions.*` methods were already `*Async`.
+- Note: the module-level `new Counter(...)` (natestrauser:publish-performant-counts)
+  behind `falsePositivesTotal` boots fine; the publication itself is unused by
+  the current UI — watch it if re-enabled.
+
 ### Still TODO before the web (not just REST) is fully deployable on 3.x
-- Web publications (`fireFromId`, `fireFromAlertId`, `falsePositivesMyloc`,
-  `industriesMyloc`) + remaining methods (comments, `subscriptions.remove`) →
-  `*Async` (not exercised by the smoke).
 - **React 16 → 18** render root + verify ancient react-* libs.
 - Re-enable dev fixtures / sitemaps / email default template with async ports.
 - SCSS `@import`→`@use`, `lighten`/`darken`→`color.adjust` (dart-sass deprecations).