v0.11.0

Breaking changes

• SafeBuilder::execute() now runs exactly the Safe transaction that simulate() ran. Before, the simulation used safeTxGas = 0, but execute() signed a transaction with safeTxGas = gas_used * 1.1. That meant a failing inner call could be mined as ExecutionFailure and still consume the nonce. safeTxGas is now the value you set with with_safe_tx_gas() / with_gas_limit(), or 0. execute() fails with NonceMismatch if the Safe nonce changed after simulate(), and with InvalidConfig if calls were added after it. (77dd65b)
• execute() requires the ExecutionSuccess event. call_only() rejects DelegateCall for single calls. with_nonce() rejects a stale nonce.
• Upgraded to alloy 2.5, revm 41, foundry-fork-db 0.27 and revm-inspectors 0.41.
• is_safe read errors are now IncompleteRead instead of Fetch.

Features

• Frozen Safe transactions (envelope): PreparedSafeTx / SignedSafeTx fix the nonce and use a fail-closed policy (safeTxGas = 0). SafeBuilder::prepare() returns a frozen transaction, so the same transaction can be reviewed, simulated, signed and broadcast.
• Outer transactions (outer): EIP-1559 outer transactions are signed locally, so the raw bytes and hash are available before broadcast.
• Submission (submit): raw broadcast that reports ambiguous outcomes. Receipt waits that time out still return the hash. ExecutionSuccess / ExecutionFailure are decoded by Safe address and Safe transaction hash.
• Safe state inspection (inspect): reads Safe state pinned to a block: owners, threshold, nonce, modules (paginated, with a completeness flag), guard, fallback handler and singleton.
• Fork sessions (simulation::session): ForkSession is a stateful revm session pinned by block hash. It takes an explicit next-block environment, EVM spec and gas cap.
• TxChecks has a balance flag and a MEASURE preset, which measure gas at the transaction gas cap without requiring the sender to afford the cap.
• Halted frames (for example OutOfGas) now appear by name in revert reasons. SafeExecutionOutcome::label gives stable machine-readable names.
• Helpers for the prepare → sign → simulate → broadcast flow: OuterTxParams::exec_transaction, SimTx::from_outer, ForkSession::fork_next_block, ParentHeader::block_id, WalletBuilder::deploy_detailed, create2::fetch_proxy_creation_code, and WalletConfig::owners() / validate(). safe_outcome_for_receipt, receipt_logs and is_gs013_revert are exported.

CLI

• send freezes the Safe transaction and simulates the exact outer execTransaction it will sign against the next block with strict checks. It then signs locally, broadcasts, and waits for ExecutionSuccess. New flags: --nonce, --gas-limit, --max-fee-per-gas, --max-priority-fee-per-gas, --raw-out, --no-submit, --timeout, --trace, --block, --spec, --multi-send, --multi-send-call-only.
• info reads Safe state pinned to a block (version, singleton, modules, guard, fallback handler) with --block. call runs in a fork session with --block, --spec and --trace. create accepts --singleton and --factory overrides.

Fixes

• EOA batches are simulated statefully, so call N sees the effects of the calls before it. For example, approve followed by transferFrom now simulates correctly.
• A reverted simulation in the CLI used to print Success: true. It now prints the inner revert reason and exits non-zero.
• Bundle entries with operation: 1 are sent as DELEGATECALLs. They used to be sent as plain CALLs.
• Call traces record logs, so traced simulations show emitted events.
• send --skip-simulation explains a GS013 revert when gas estimation fails.

Full changelog: v0.10.1...v0.11.0