crypto test fix

tools/enable-eurc.sh

@@ -90,12 +90,18 @@ if [ -n "$CHAINS_SRC" ]; then
 else
     # Several endpoints per chain, from DIFFERENT operators, because a payment
     # is confirmed only when min_confirmations of them independently agree that
-    # the money is there — no single node's word settles an order. Base gets
-    # three (Coinbase's own, Allnodes, Automata) so one being down still leaves
-    # a quorum; Ethereum gets two. All five were checked to answer
-    # eth_chainId AND a balanceOf eth_call at block_tag=finalized, which is
-    # what this rail actually asks of them (Cloudflare's endpoint refuses
-    # finalized eth_call, which is why it is not here).
+    # the money is there — no single node's word settles an order. THREE per
+    # chain, always: public RPCs differ by VANTAGE POINT as well as uptime —
+    # 1RPC answers residential IPs but 403s requests from Hetzner, which a
+    # two-endpoint quorum polled from the Hetzner box can never survive (the
+    # CI testnet gate hit exactly this: 1-of-2 forever, order never settles).
+    # Any two of three agreeing settle; the corroboration loop stops at
+    # quorum, so the third is only dialed when one of the first two fails.
+    # All were checked to answer eth_chainId AND a balanceOf eth_call at
+    # block_tag=finalized, which is what this rail actually asks of them
+    # (Cloudflare's endpoint refuses finalized eth_call, which is why it is
+    # not here) — but check them FROM THE BOX, not from home: that is the
+    # vantage point that matters.
     cat > "$WORK/chains.json" <<'JSON'
 {"chains": [
   {"name": "base",
@@ -107,6 +113,7 @@ else
    "chain_id": 8453, "note": "lowest network fees"},
   {"name": "ethereum",
    "rpcs": ["https://ethereum-rpc.publicnode.com",
+            "https://mainnet.gateway.tenderly.co",
             "https://1rpc.io/eth"],
    "min_confirmations": 2,
    "contract": "0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c",