docs(ops): make the deposit-enumeration pre-check trustworthy

[aliXsed]

Follow-up to #124. I tried to actually run the deposit-enumeration pre-check and found the guidance I wrote there was wrong — and wrong in the direction that produces a false pass.

What #124 said

This needs an indexed RPC (Etherscan/Alchemy); a 2M-block eth_getLogs range will not complete on a public endpoint.

Wrong reason. The range completes fine. The actual problem is that the bridge deployed at block 23579563, so any full-history scan is an archive request, and free endpoints refuse those — several of them silently.

What actually happens

Endpoint	Behaviour on an archive eth_getLogs
ethereum-rpc.publicnode.com	-32602 Archive requests require a personal token — cast logs reports this as [] with exit 0
eth.drpc.org	serves single requests, 403 on sustained scanning
cloudflare-eth.com / rpc.ankr.com/eth / eth.merkle.io	internal error / unauthorized / method not found

A scan of the old bridge's full history returned [] for DepositInitiated. That looks like "no deposits, nothing to claim, safe to cut over." It is not a result at all.

Proof it was a false negative: the deployment receipt at block 23579563 contains an OwnershipTransferred log (0x8be0079c…) emitted by the Ownable constructor, and eth_getLogs for that exact single block on the same endpoint returns zero. isWithdrawalFinalized(503366, 17) is also true on the old bridge, so WithdrawalFinalized events demonstrably exist — a full-range query for them likewise returned zero.

Why it matters

The pre-check exists to catch failed deposits that still need claimFailedDeposit while the old bridge holds MINTER_ROLE. A silent empty result means skipping them and stranding user refunds — the exact failure the pre-check is meant to prevent, reached by appearing to pass.

Changes

• Record what each public endpoint actually does
• Give a known-present log (block 23579563 → 0x8be0079c…) to sanity-check any zero against before trusting it
• Provide a working Etherscan v2 invocation and the zks_getTransactionReceipt follow-up for checking L2 status per deposit

Status

The pre-check itself is still not done — it needs a key I don't have. The runbook now makes it runnable in one command and hard to fool.

🤖 Generated with Claude Code

[github-actions]

LCOV of commit 32c6d2d during checks #760

Summary coverage rate:
  lines......: 26.5% (939 of 3550 lines)
  functions..: 27.0% (150 of 555 functions)
  branches...: 27.1% (164 of 605 branches)

Files changed coverage rate: n/a