Dealbot can't auto-terminate datasets when payer is a Safe multisig

[SgtPooki]

Problem

Dealbot cannot auto-terminate PDP datasets when the payer is a Safe multisig. The repair path added in #518 (data_set_creation → repairTerminatedDataSet → synapse.storage.terminateDataSet) reverts at the simulate step with CallerNotPayerOrPayee(caller=0x0).

Why

1. We run in session-key mode with a Safe multisig owner. apps/backend/src/common/synapse-factory.ts installs a safeReadTransport (PR fix: work around Lotus eth_call rejection for multisig accounts #419) that strips from from every eth_call/eth_estimateGas. Reason: Lotus rejects eth_call with from = contract (lotus#13470 still open).
2. synapse-sdk WarmStorageService.terminateDataSet calls terminateService(this._client, ...) and synapse-core does simulateContract then writeContract on the same client. Simulation runs through the strip-from read client, contract sees msg.sender = 0x0, reverts.
3. Bypassing simulation does not help today: terminateService is gated by msg.sender ∈ {payer, payee} and was not in DefaultFwssPermissions, so a session-key signed write reverts at execution.

FilOzone/synapse-sdk#796 renames the permission to TerminateServicePermission and adds signTerminateService. It does not yet wire the signed extraData into the contract call, and it does not address the strip-from interaction.

Impact

Terminated datasets at any SP we use have to be cleaned up by hand via Safe Transaction Builder, as in #545 (197 datasets, 9 multisig batches). USDFC lockup keeps accruing until we do.

Next step

Track until the auto path works end to end. We need:

• FWSS contract entry point that accepts a session-key-signed extraData for termination
• synapse-sdk PR that routes terminateDataSet through sessionClient and signs with signTerminateService
• Dealbot: re-mint the session key once the new permission is required
• Either the new entry point auths purely via sig recovery (so msg.sender = 0x0 is acceptable during simulate), or relax safeReadTransport for that method, or wait for fix(eth): allow eth_call and eth_estimateGas from contract and non-existent addresses filecoin-project/lotus#13470 to land

Refs

• Terminate 197 stuck provider-24 datasets on calibnet via Safe multisig #545 manual cleanup for provider 24
• fix: handle PDP-terminated datasets via data_set_creation repair #518 data_set_creation repair handler
• fix(deal): combine FWSS, PDPVerifier, and SP-HTTP probes for dataset liveness #537 multi-probe liveness detection
• fix: work around Lotus eth_call rejection for multisig accounts #419 safeReadTransport workaround
• fix(typehash)!: rename DeleteDataSet auth to TerminateService synapse-sdk#796
• fix(eth): allow eth_call and eth_estimateGas from contract and non-existent addresses filecoin-project/lotus#13470

[rvagg]

The easiest path here is the new termination design we're rolling out per https://www.notion.so/filecoindev/Data-Set-Terminations-Clean-up-360dc41950c1801ebf0aff017a322e7f where you just ask the SP to terminate for you, no on-chain msg necessary (unless SP is gone or refuses but even then there's a delayed cleanup anyone can do later). We're working on that now and it avoids the need to submit a message to the chain so we could just wait for that. This is what the new 712 permission is for in FilOzone/synapse-sdk#796, sign and hand off to SP.

[BigLep]

Per above, I'm viewing this as blocked until FilOzone/synapse-sdk#792 lands and is in a Synapse release for filecoin-pin.

This can happen post GA.