# Meteor upgrade — 1.6.1.1 → 2.x (→ 3.x blocked)

Incremental, verified upgrade of `todos-contra-el-fuego-web`. Branch:
`meteor3-upgrade` (base `tcef-master`). Local commits only — no push until
authorized.

## ⚠️ Hard blocker for the final 3.x jump: MongoDB 3.2

Production runs against the shared replica set **rsmain on MongoDB 3.2.11**.
Meteor 3 ships the modern `mongodb` Node driver, which requires a server
**≥ 4.2/4.4**. Meteor **2.x still works against Mongo 3.2**.

Therefore this branch stops at the **highest stable 2.x** with everything green,
and the `meteor update --release 3.x` step is **deliberately not taken** until
the Comunes infra team upgrades rsmain (shared infra — coordinated in a separate
phase, not unilaterally). The 2.x server code is migrated to async/await ahead
of time so the final 3.x jump is mechanical.

## ⚠️ Deploy-ordering dependency: notifications cutover

The old push/email notification code was removed from the web (see the
notifications commit) because it now lives in the **tcef-notifications**
microservice. **Production must not run this build until tcef-notifications is
emitting in prod** — otherwise users stop receiving notifications. The web
deploy and the notifications cutover must be coordinated.

## Safety net: REST smoke test

`smoke/` is a standalone Node harness that calls every REST endpoint the Flutter
app consumes, against a seeded local dev server, and diffs the responses against
committed snapshots (`smoke/snapshots/`). See `smoke/README.md`.

**Run after every escala — it must stay byte-identical:**

```bash
docker run -d --name tcef-mongo32 -p 27018:27017 mongo:3.2   # once
export PATH="$HOME/.meteor:$PATH" MONGO_URL="mongodb://localhost:27018/fuegos"
meteor --settings settings-development.json --port 3100 &     # dev server
./smoke/smoke.sh                                              # seed + compare
```

## Escalas

### Baseline — Meteor 1.6.1.1 (starting point)

- Boots against Mongo 3.2 with `settings-development.json`.
- Dev-enabling changes (do not affect production behavior):
  - `IPGeocoder.js`: degrade gracefully when the MaxMind GeoLite2 DB is absent
    (provisioned by cron in prod) instead of crashing at boot.
  - `settings-development.json`: added dev-only `private.internalApiToken`
    (`dev-smoke-token`) — the REST API only registers its routes when this is
    set.
- **Notifications code removed** (migrated to tcef-notifications): deleted
  `notificationsObserver.js`, `notificationsProcess.js`, the "Process pending
  notif" SyncedCron job, and the `node-gcm` dependency. `subsUnion.js` kept (it
  feeds `subs-public-union`, consumed by the app).
- REST smoke baseline captured here. ✅ green.

### Escala 1 — 1.6.1.1 → 1.8.3  ✅ green

```bash
meteor update --release 1.8.3
meteor npm install --save @babel/runtime@^7.26.0
```

Core packages bumped (highlights): `meteor` 1.8.6→1.9.3, `ecmascript`
0.10.7→0.13.2, `modules` 0.11.6→0.14.0, `mongo` 1.4.7→1.7.0, `npm-mongo`
2.2.34→**3.2.0** (mongodb driver 3.x — still fine against Mongo 3.2 server),
`webapp` 1.5.0→1.7.5, `standard-minifier-js` →2.5.2. `underscore` auto-added
(1.7 dropped it from meteor-base), `fetch` + `modern-browsers` added.

**Breaking change — Babel beta → stable.** Boot failed with
`Cannot find module '@babel/runtime/helpers/objectSpread2'`: the pinned
`@babel/runtime@7.0.0-beta.44` predates helpers that 1.8's `ecmascript` emits.
Fixed by upgrading to stable **7.x** (`@babel/runtime@^7.29.7`). Note: `@latest`
resolves to `8.x`, which is too new for Meteor's 7-style helper layout — pin to
`^7`.

REST smoke test: **byte-identical to baseline.** ✅

## Dependency debt (tracked, to resolve in the noted escala)

| Dep | From | Target | Status |
|---|---|---|---|
| React / react-dom | 16.0 | 18 | pending (escala 1.11) |
| raven / flowkey:raven | 2.4 | @sentry/node + @sentry/react | pending — DSN off until GlitchTip/Sentry back |
| nodemailer | 4 | 6+ | pending |
| Babel | 7 beta | 7 stable | pending (first escala that allows) |
| i18next | 10 | current | evaluate cost; pin + note as debt if it breaks a lot |
| Leaflet | 1.3.1 | current | evaluate cost; pin + note as debt if it breaks a lot |
| node-gcm | 1.0.2 | — | ✅ removed (dead API, moved to microservice) |