[heifner]

Under contract-pays, every action the batch operator plugin pushes bills its sysio.* contract. #750 makes subjective billing charge the first authorizer of such actions against a 300 ms / 24 h budget, and devnet batch operators each use about 450 to 780 ms a day of sysio.msgch CPU. An action with an explicit payer bills that payer instead, so these options let an operator pay from its own resources and stay clear of the budget.

--batch-operator-explicit-payer (the relay) and --batch-underwriter-explicit-payer (the underwriter) are off by default. On, each action declares [{account, sysio.payer}, {account, permission}], and the signature the role already makes for its permission satisfies both. There is one option per role because the two roles may run as different accounts, each needing its own resources.

Before turning an option on, give the account CPU and NET of its own (an ROA policy). Otherwise its transactions fail on its own limits; the node checks this at startup and stops. Size the policy for a day of pushes: the account pays for each action's whole execution, inline actions included (a chkcons that advances the epoch runs sysio.epoch::advance), and other nodes bill its failed pushes against the same limits.

explicit_payer_tests pushes sysio::reqauth on a tester chain whose operator starts with no CPU or NET:

• off, the contract pays and the operator is billed nothing;
• on, without resources, the push fails on the operator's limits;
• on, with an ROA policy, the push passes authorization with only the active key, and the operator is billed while the contract is not;
• a linked custom permission, as the underwriter uses, pays the same way with only its own key.

Other pushers: producer_plugin's snapshot provider pushes sysio::votesnaphash as <snapshot-provider-account>@active, once per attestation interval, so the new budget would charge it too, at a far lower rate. The outpost client plugins sign only Ethereum and Solana transactions. Neither is changed here.

[huangminghuang]

Reviewed all six changed files and traced authorization, startup resource checks, and CPU/NET billing. No actionable findings.

Validation: all 8 role-configuration tests passed (42 assertions). The payer integration test compiled, but could not be linked against the available local testing library because it lacks sysio::testing::default_kv_engine(). Full plugin compilation was also blocked by missing generated protobuf headers, so integration execution and the full build remain unverified.