PyMemoryEditor 3.1.0__tar.gz → 3.3.0__tar.gz

pymemoryeditor-3.3.0/CONTRIBUTING.md

@@ -0,0 +1,199 @@
+# Contributing to PyMemoryEditor
+
+Thanks for your interest in contributing!
+
+## Development setup
+
+```bash
+python -m venv venv
+source venv/bin/activate    # On Windows: venv\Scripts\activate
+make install-dev            # pip install -e ".[dev]"
+```
+
+The `dev` extra installs the full toolchain and the GUI deps.
+
+The `Makefile` is the single source of truth for the dev commands below — run
+`make help` to see every target (docs, build, coverage, etc.). The raw command
+each target wraps is shown in parentheses if you'd rather run it directly.
+
+## Running the test suite
+
+The tests read and write the memory of the test process itself; they should run
+on any supported platform without elevated privileges.
+
+```bash
+make test-fast              # pytest tests -m "not slow"  (~20 s: unit, GUI and MCP tests)
+make test                   # pytest tests -v             (everything, incl. live whole-process scans)
+make test-mcp               # pytest tests/mcp_server     (the MCP server suite, ~10 s)
+```
+
+`test-fast` is the loop to iterate on; the `slow` and `scan_heavy` markers
+(defined in `pyproject.toml`) hold the tests that scan the test process's whole
+address space, which takes minutes on CI runners. The scan property tests
+(`tests/scan/test_scan_properties.py`) are marked `slow` too, so run them
+directly when you touch the scan kernels:
+
+```bash
+pytest tests/scan/test_scan_properties.py
+```
+
+On CI the Hypothesis tests run under a derandomized `ci` profile (selected
+automatically when `CI` is set, or with `HYPOTHESIS_PROFILE=ci`), so a failure
+reproduces on re-run; locally they keep exploring new examples.
+
+### Testing one platform
+
+The suite always exercises the backend of the OS it runs on (`win32/`,
+`linux/` or `macos/`); tests written for another platform's backend skip
+themselves.
+So testing a platform means running the suite on it -- locally, in a VM, or
+by opening a PR and reading that OS's CI cells. To mirror one CI cell on its
+own OS:
+
+```bash
+QT_QPA_PLATFORM=offscreen pytest tests --ignore=tests/mcp_server   # build / build-macos
+pytest tests/mcp_server -p no:pytest-qt                            # build-mcp (Linux)
+pytest tests/mcp_server -p no:pytest-qt -m "not scan_heavy"        # build-mcp (Windows, macOS)
+```
+
+`pytest tests/platforms` runs only the platform-specific regression tests;
+add `-k linux` (or `win32`, `macos`, `bitness`) to narrow them further. The
+`speed` extra (NumPy) switches the scans to the vectorized path, which is what
+the `build-speed` and macOS jobs run; leave it out to test the pure-Python one.
+
+`tests/process/test_foreign_process.py` attaches to a child process. On macOS
+that needs the `com.apple.security.cs.debugger` entitlement (see below), which
+CI runners do not have, so it skips there: run it locally on a signed Python
+before changing how the macOS backend opens a foreign task.
+
+## Linting
+
+```bash
+make lint                   # flake8 PyMemoryEditor tests
+```
+
+## Type checking
+
+```bash
+make type-check             # mypy PyMemoryEditor
+```
+
+## Before you push
+
+Run lint, type-check and the test suite in one go:
+
+```bash
+make pre-commit             # lint + type-check + test
+```
+
+The CI pipeline runs the same lint, mypy and tests, and blocks merges on failure.
+The library matrix runs Python 3.10–3.15 on Ubuntu and Windows plus Python
+3.10, 3.12 and 3.14 on macOS, so all three platform backends are exercised on
+every push. Dedicated jobs also run the suite with the `speed` extra (NumPy) to keep
+the vectorized scan path covered, and the MCP server suite once per OS. Even so,
+contributors touching a specific backend are encouraged to run `pytest tests`
+locally on that platform before submitting. `make ci` runs the same lint,
+type-check and coverage-gated test invocations the workflow does.
+
+## Project layout
+
+```
+PyMemoryEditor/
+├── __init__.py          # Public API + platform dispatch
+├── enums.py             # ScanTypesEnum (cross-platform)
+├── process/             # Abstract base, errors, process info, util
+├── util/                # Cross-platform helpers: scan and type conversion
+├── win32/               # Windows implementation (kernel32, user32)
+├── linux/               # Linux implementation (process_vm_readv/writev, /proc/<pid>/maps)
+├── macos/               # macOS implementation (task_for_pid, mach_vm_*)
+├── mcp/                 # Model Context Protocol server exposed as `pymemoryeditor-mcp`
+└── app/                 # PySide6 (Qt) demo app exposed as `pymemoryeditor` CLI
+```
+
+The three platform packages implement `AbstractProcess` from `process/abstract.py`.
+The public alias `OpenProcess` is chosen at import time in `__init__.py` based on
+`sys.platform`.
+
+### Platform-specific test notes
+- **Linux**: requires `/proc/sys/kernel/yama/ptrace_scope=0` to attach to processes
+  not descended from the test runner. Self-process tests work without changes.
+- **macOS**: opening another process requires the Python binary to be signed with
+  the `com.apple.security.cs.debugger` entitlement (or SIP off + root). Self-
+  process tests work without changes.
+- **Windows**: no special privileges needed for self-process tests.
+
+## Submitting changes
+
+1. Open an issue first for bug reports or substantial features.
+2. Branch from `main`. Keep commits focused.
+3. Run `make pre-commit` (lint + type-check + tests) locally before pushing.
+4. Open a PR describing the change and how it was tested.
+5. Give the PR a [Conventional Commits](https://www.conventionalcommits.org/) title,
+   e.g. `fix: reject empty search targets` or `docs(mcp): document --allow-write`.
+   A required check lints it: the type must be one of `feat`, `fix`, `perf`,
+   `refactor`, `revert`, `docs`, `ci`, `build`, `chore`, `test`, `style`, and
+   the subject must start lowercase and not end with a period. PRs are
+   squash-merged, so the title becomes the commit message on `main`.
+
+## Versioning
+
+PyMemoryEditor follows [Semantic Versioning](https://semver.org/). The public
+API is everything documented on Read the Docs, and its *behaviour* counts as
+much as its signatures: a call that keeps its name and arguments but returns
+a different value, accepts or rejects different input, or touches different
+memory is a breaking change.
+
+- **Major** (`4.0.0`): any breaking change, including a behaviour change to a
+  documented default -- even when the old behaviour was a bug that someone
+  could reasonably depend on (3.0.0's signed 3-byte reads are the model: the
+  release notes lead with it, show the before/after and the way back).
+- **Minor** (`3.3.0`): new features, and behaviour changes that only reject
+  what was memory-unsafe or meaningless before. When a minor release does
+  change a default (an opt-out such as `aligned=False` must exist), its
+  release notes say **Behaviour change** in bold.
+- **Patch** (`3.2.1`): fixes that make the code do what the docs already
+  said.
+
+The changelog is the
+[GitHub Releases](https://github.com/JeanExtreme002/PyMemoryEditor/releases)
+page: describe every user-visible change in the PR so it can be carried into
+the release notes.
+
+## Release process
+
+Releases are cut by publishing a GitHub Release; nothing is uploaded from a
+laptop.
+
+1. Open a `chore: bump version to X.Y.Z` PR that sets the version in five
+   places: `__version__` in `PyMemoryEditor/__init__.py`, the fallback
+   `release` in `docs/conf.py`, and in `server.json` both `version` fields
+   plus the `PyMemoryEditor[mcp]==X.Y.Z` pin in the package arguments.
+   `tests/mcp_server/test_registry.py` fails if the package and `server.json`
+   disagree.
+2. Merge it and wait for the `Python Package` run on `main` to go green.
+3. Publish a GitHub Release with the tag `vX.Y.Z` on that commit; its notes
+   are the changelog for the version.
+   `.github/workflows/publish.yml` then checks that the tag matches
+   `__version__` and that the commit has a green `Python Package` run (it
+   waits for one still in progress), builds and `twine check --strict`s the
+   distributions, uploads them to PyPI by trusted publishing (no token), and
+   lists the version on the MCP Registry.
+
+If the CI gate fails because `main`'s run was cancelled by a later push, run
+`gh workflow run python-package.yml --ref vX.Y.Z` and re-run the release
+workflow once it is green. `make publish` is a manual fallback for when the
+workflow itself is unavailable: it refuses to run outside a clean checkout of
+the `v<__version__>` tag, but it uploads by API token and does not update the
+MCP Registry.
+
+## Reporting bugs
+
+Please include:
+- Operating system and architecture (e.g. Windows 11 x64, Ubuntu 22.04 x64).
+- Python version (`python --version`).
+- A minimal reproducer if possible.
+- For Linux: whether `/proc/sys/kernel/yama/ptrace_scope` is `0` or `1`.
+
+## Security
+
+If you find a security issue, please see [`SECURITY.md`](https://github.com/JeanExtreme002/PyMemoryEditor/blob/main/SECURITY.md). **Do not** report via GitHub issues.

{pymemoryeditor-3.1.0 → pymemoryeditor-3.3.0}/Makefile

@@ -31,7 +31,7 @@ help:
 	@echo "  $(YELLOW)run-app$(NC)          - Run the PyMemoryEditor App"
 	@echo "  $(YELLOW)install-dev$(NC)      - Install development dependencies"
 	@echo "  $(YELLOW)test$(NC)             - Run the full test suite (incl. live whole-process scans)"
-	@echo "  $(YELLOW)test-fast$(NC)        - Run the fast lane only (-m \"not slow\", ~20 s)"
+	@echo "  $(YELLOW)test-fast$(NC)        - Run the fast lane only (-m \"not slow\", ~20 s; skips the scan property tests)"
 	@echo "  $(YELLOW)test-mcp$(NC)         - Run the MCP server suite"
 	@echo "  $(YELLOW)test-verbose$(NC)     - Run tests with verbose output"
 	@echo "  $(YELLOW)test-coverage$(NC)    - Run tests with coverage report"
@@ -42,7 +42,8 @@ help:
 	@echo "  $(YELLOW)build-wheel$(NC)      - Build wheel package"
 	@echo "  $(YELLOW)build-sdist$(NC)      - Build source distribution"
 	@echo "  $(YELLOW)validate$(NC)         - Validate package"
-	@echo "  $(YELLOW)publish$(NC)          - Publish to PyPI by token (emergency path; releases go through GitHub Releases)"
+	@echo "  $(YELLOW)publish$(NC)          - MANUAL FALLBACK: upload to PyPI by token from a checkout of the release tag"
+	@echo "                     (releases go through GitHub Releases; see CONTRIBUTING.md)"
 	@echo "  $(YELLOW)publish-test$(NC)     - Publish to Test PyPI"
 	@echo "  $(YELLOW)ci$(NC)               - Mirror the CI workflow: lint, type-check, both coverage-gated test runs"
 	@echo "  $(YELLOW)version$(NC)          - Show current version"
@@ -56,6 +57,7 @@ help:
 	@echo "  $(YELLOW)venv$(NC)             - Create virtual environment"
 	@echo "  $(YELLOW)venv-activate$(NC)    - Show command to activate venv"
 	@echo "  $(YELLOW)all$(NC)              - Run full pipeline (install, lint, test, build)"
+	@echo "  $(YELLOW)release$(NC)          - MANUAL FALLBACK: pre-publish checks, then publish (same tag guard)"
 
 # Create virtual environment
 .PHONY: venv
@@ -113,8 +115,11 @@ test:
 	$(PYTHON) -m pytest $(TEST_DIR) -v
 	@echo "$(GREEN)Tests completed!$(NC)"
 
-# Fast lane: unit, property and GUI tests only (~20 s). The markers are
-# defined in pyproject.toml.
+# Fast lane: unit, GUI and MCP tests (~20 s: ~13 s for the library and app,
+# ~5 s for the MCP suite). Everything marked `slow` is left out, which
+# includes the scan property tests in tests/scan/test_scan_properties.py --
+# run `make test` or `pytest tests/scan/test_scan_properties.py` for those.
+# The markers are defined in pyproject.toml.
 .PHONY: test-fast
 test-fast:
 	@echo "$(GREEN)Running the fast test lane (-m \"not slow\")...$(NC)"
@@ -202,15 +207,34 @@ build-sdist: clean
 .PHONY: validate
 validate: build
 	@echo "$(GREEN)Validating package...$(NC)"
-	$(PYTHON) -m twine check $(DIST_DIR)/*
+	$(PYTHON) -m twine check --strict $(DIST_DIR)/*
 	@echo "$(GREEN)Package validation completed!$(NC)"
 
-# Publish to PyPI by API token. This is the emergency path only: releases are
-# cut by publishing a GitHub Release, which .github/workflows/publish.yml
-# uploads to PyPI via trusted publishing (OIDC, no token) and then lists on
-# the MCP Registry. Use this target only if that workflow is unavailable.
+# Refuse to upload anything but a clean checkout of the tag `v<__version__>`.
+# publish.yml checks the tag against the version before its upload; this is
+# the same guard for the manual path, plus a clean tree so the files built are
+# the files tagged. It does not replace the workflow's other gate (a green
+# python-package.yml run on the commit): check that by hand.
+.PHONY: check-release-tag
+check-release-tag:
+	@version=$$($(PYTHON) -c "import $(PACKAGE_NAME); print($(PACKAGE_NAME).__version__)") && \
+	tag="v$$version" ; \
+	found=$$(git tag --points-at HEAD | xargs) ; \
+	if ! git tag --points-at HEAD | grep -qx "$$tag"; then \
+		echo "$(RED)HEAD is not tagged $$tag (found: $${found:-no tag}). Check out the release tag first.$(NC)"; exit 1; \
+	fi; \
+	if [ -n "$$(git status --porcelain --untracked-files=no)" ]; then \
+		echo "$(RED)The working tree has uncommitted changes; publish from a clean checkout of $$tag.$(NC)"; exit 1; \
+	fi; \
+	echo "$(GREEN)HEAD is $$tag, matching __version__ $$version.$(NC)"
+
+# Publish to PyPI by API token. MANUAL FALLBACK only: releases are cut by
+# publishing a GitHub Release, which .github/workflows/publish.yml uploads to
+# PyPI via trusted publishing (OIDC, no token) and then lists on the MCP
+# Registry. Use this target only if that workflow is unavailable, and note it
+# does not list the release on the MCP Registry.
 .PHONY: publish
-publish: validate
+publish: check-release-tag validate
 	@echo "$(YELLOW)Are you sure you want to publish to PyPI? [y/N]$(NC)" && read ans && [ $${ans:-N} = y ]
 	@echo "$(GREEN)Publishing to PyPI...$(NC)"
 	$(PYTHON) -m twine upload $(DIST_DIR)/*
@@ -261,11 +285,12 @@ install-docs:
 	$(PIP) install -e .
 	@echo "$(GREEN)Docs dependencies installed!$(NC)"
 
-# Build the HTML documentation. Output lands in $(DOCS_BUILD_DIR).
+# Build the HTML documentation. Output lands in $(DOCS_BUILD_DIR). Warnings
+# are errors, the same as the `docs` job in python-package.yml.
 .PHONY: docs
 docs:
 	@echo "$(GREEN)Building HTML documentation...$(NC)"
-	$(PYTHON) -m sphinx -b html $(DOCS_DIR) $(DOCS_BUILD_DIR)
+	$(PYTHON) -m sphinx -W --keep-going -b html $(DOCS_DIR) $(DOCS_BUILD_DIR)
 	@echo "$(GREEN)Documentation generated at $(DOCS_BUILD_DIR)/index.html$(NC)"
 
 # Live-reload docs server — rebuilds on every save and reloads the browser.
@@ -331,9 +356,10 @@ info:
 	@echo "$(GREEN)Installed packages:$(NC)"
 	@$(PIP) list | grep -E "($(PACKAGE_NAME)|pytest|flake8|mypy|twine|build)"
 
-# Quick release workflow
+# Manual release (fallback for publish.yml; see `publish`). The tag guard runs
+# first so a mismatched checkout fails before the full pre-publish pipeline.
 .PHONY: release
-release: pre-publish publish
+release: check-release-tag pre-publish publish
 	@echo "$(GREEN)Release completed!$(NC)"
 
 .PHONY: release-test

{pymemoryeditor-3.1.0 → pymemoryeditor-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: PyMemoryEditor
-Version: 3.1.0
+Version: 3.3.0
 Summary: Read, write and scan process memory in a few lines of Python — Cheat Engine-style scans, pointer chains and AOB search on Windows, Linux and macOS.
 Project-URL: Homepage, https://github.com/JeanExtreme002/PyMemoryEditor
 Project-URL: Documentation, https://pymemoryeditor.readthedocs.io
@@ -26,6 +26,8 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Games/Entertainment
 Classifier: Topic :: Scientific/Engineering
 Classifier: Topic :: Security
@@ -35,27 +37,33 @@ Classifier: Topic :: System :: Monitoring
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Provides-Extra: app
-Requires-Dist: psutil<7,>=5.9; extra == 'app'
-Requires-Dist: pyside6>=6.5; extra == 'app'
+Requires-Dist: psutil<8,>=5.9; extra == 'app'
+Requires-Dist: pyside6<7,>=6.5; extra == 'app'
 Provides-Extra: dev
 Requires-Dist: build; extra == 'dev'
 Requires-Dist: flake8; extra == 'dev'
 Requires-Dist: hypothesis; extra == 'dev'
 Requires-Dist: mcp<3,>=2; extra == 'dev'
 Requires-Dist: mypy; extra == 'dev'
-Requires-Dist: psutil<7,>=5.9; extra == 'dev'
-Requires-Dist: pyside6>=6.5; extra == 'dev'
+Requires-Dist: psutil<8,>=5.9; extra == 'dev'
+Requires-Dist: pyside6<7,>=6.5; extra == 'dev'
 Requires-Dist: pytest; extra == 'dev'
 Requires-Dist: pytest-cov; extra == 'dev'
 Requires-Dist: pytest-qt; extra == 'dev'
 Requires-Dist: pytest-xdist; extra == 'dev'
-Requires-Dist: twine; extra == 'dev'
+Requires-Dist: twine>=7; extra == 'dev'
 Provides-Extra: mcp
 Requires-Dist: mcp<3,>=2; extra == 'mcp'
 Provides-Extra: speed
 Requires-Dist: numpy>=1.24; extra == 'speed'
 Provides-Extra: tests
+Requires-Dist: hypothesis; extra == 'tests'
+Requires-Dist: mcp<3,>=2; extra == 'tests'
+Requires-Dist: psutil<8,>=5.9; extra == 'tests'
+Requires-Dist: pyside6<7,>=6.5; extra == 'tests'
 Requires-Dist: pytest; extra == 'tests'
+Requires-Dist: pytest-cov; extra == 'tests'
+Requires-Dist: pytest-qt; extra == 'tests'
 Requires-Dist: pytest-xdist; extra == 'tests'
 Description-Content-Type: text/markdown
 

{pymemoryeditor-3.1.0 → pymemoryeditor-3.3.0}/PyMemoryEditor/__init__.py

@@ -8,7 +8,7 @@ Supported platforms: Windows, Linux and macOS (32-bit and 64-bit).
 """
 
 __author__ = "Jean Loui Bernard Silva de Jesus"
-__version__ = "3.1.0"
+__version__ = "3.3.0"
 
 import logging
 import sys

{pymemoryeditor-3.1.0 → pymemoryeditor-3.3.0}/PyMemoryEditor/app/_widgets.py

@@ -6,9 +6,10 @@ Centralises tiny helpers (numeric sort items, hex address parsing) that
 previously appeared duplicated across several dialog modules.
 """
 
+import threading
 from typing import Any, Callable, Iterable, List, Optional, Tuple
 
-from PySide6.QtCore import QObject, Qt, QThread
+from PySide6.QtCore import QCoreApplication, QObject, Qt, QThread, QTimer
 from PySide6.QtGui import QStandardItem
 
 
@@ -84,6 +85,56 @@ def _reap_detached_worker(worker: QThread) -> None:
     worker.deleteLater()
 
 
+def detached_workers_running() -> bool:
+    """Whether any worker that outlived its owner is still running."""
+    return any(worker.isRunning() for worker in _DETACHED_WORKERS)
+
+
+def run_after_detached_workers(callback: Callable[[], None]) -> None:
+    """Run ``callback`` once every currently detached worker has finished.
+
+    A detached worker can still be inside a backend syscall on the process it
+    was given, so releasing that process (``close()``) must wait for it: on
+    Windows the handle value can be recycled for an unrelated object the moment
+    it is closed, and a late write from the cheat poller would land there.
+    With no worker still running, ``callback`` runs immediately.
+    """
+    pending = [worker for worker in _DETACHED_WORKERS if worker.isRunning()]
+    if not pending:
+        callback()
+        return
+
+    remaining = set(pending)
+    done = False
+    # `finished` can be delivered from the worker's own thread while the
+    # isFinished() sweep below runs on this one: guard the bookkeeping so the
+    # callback (a handle close) runs exactly once.
+    guard = threading.Lock()
+    # Whichever thread notices the last worker finishing, the callback is
+    # posted to the GUI thread (the application object lives there), so it
+    # never runs concurrently with the GUI setting up the next process.
+    gui = QCoreApplication.instance()
+
+    def _on_finished(worker: QThread) -> None:
+        nonlocal done
+        with guard:
+            remaining.discard(worker)
+            if remaining or done:
+                return
+            done = True
+        if gui is None:
+            callback()
+        else:
+            QTimer.singleShot(0, gui, callback)
+
+    for worker in pending:
+        worker.finished.connect(lambda w=worker: _on_finished(w))
+    # Same race as detach_worker: one may have finished before its connect.
+    for worker in pending:
+        if worker.isFinished():
+            _on_finished(worker)
+
+
 class TearsDownOnClose:
     """Mixin that runs a dialog's teardown on *every* way out, not just close.
 

{pymemoryeditor-3.1.0 → pymemoryeditor-3.3.0}/PyMemoryEditor/app/application.py

@@ -561,6 +561,7 @@ def main(argv=None):
     from PySide6.QtCore import QSettings
     from PySide6.QtWidgets import QApplication
 
+    from ._widgets import detached_workers_running
     from .main_window import MainWindow
     from .open_process_dialog import OpenProcessDialog
 
@@ -591,12 +592,18 @@ def main(argv=None):
         with _scoped_excepthook(_qt_excepthook):
             app.exec()
     finally:
-        try:
-            # `process` is only the handle the picker opened; File → Change
-            # Process… released that one and attached the window to another.
-            window.process.close()
-        except Exception:
-            pass
+        # A worker that blew its join on close is detached, not stopped, and
+        # may still be inside a syscall on this handle; closing it now could
+        # hand its value to an unrelated object mid-write. The process is
+        # exiting, so leave it to the OS, which releases every handle then.
+        if not detached_workers_running():
+            try:
+                # `process` is only the handle the picker opened; File →
+                # Change Process… released that one and attached the window
+                # to another.
+                window.process.close()
+            except Exception:  # noqa: BLE001 — exiting anyway; keep the cause
+                _LOG.debug("Closing the process handle on exit failed", exc_info=True)
 
 
 def main_cli(argv=None):

{pymemoryeditor-3.1.0 → pymemoryeditor-3.3.0}/PyMemoryEditor/app/cheat_poll_worker.py

@@ -115,20 +115,21 @@ class _CheatPollWorker(QThread):
         with QMutexLocker(self._mutex):
             self._stop = True
 
-    def _drain_pending_writes(self) -> List[Tuple[int, type, int, str]]:
-        """Perform and clear every queued manual write.
+    def _take_pending_writes(self) -> List[Tuple[int, type, int, Any]]:
+        """Detach the queued writes. The caller holds ``self._mutex``."""
+        pending = self._pending_writes
+        self._pending_writes = []
+        return pending
+
+    def _perform_writes(
+        self, pending: List[Tuple[int, type, int, Any]]
+    ) -> List[Tuple[int, type, int, str]]:
+        """Perform manual writes taken with :meth:`_take_pending_writes`.
 
         Returns one ``(address, pytype, length, message)`` tuple per write that
-        failed, so ``run`` can surface it via ``write_failed``. Reads and clears
-        the queue under the lock, then runs the syscalls outside it so a slow
-        write never blocks a UI thread enqueuing the next edit.
+        failed, so ``run`` can surface it via ``write_failed``. Runs outside the
+        lock, so a slow write never blocks a UI thread enqueuing the next edit.
         """
-        with QMutexLocker(self._mutex):
-            if not self._pending_writes:
-                return []
-            pending = self._pending_writes
-            self._pending_writes = []
-
         failures: List[Tuple[int, type, int, str]] = []
         for address, pytype, length, value in pending:
             if self._stopping():
@@ -146,10 +147,15 @@ class _CheatPollWorker(QThread):
 
     def run(self) -> None:
         while True:
+            # Snapshot and queued writes are taken together, under one lock:
+            # an inline edit on a frozen row publishes the new frozen value and
+            # queues its write back to back, and a snapshot copied before that
+            # pair would re-freeze the old value over the write just drained.
             with QMutexLocker(self._mutex):
                 if self._stop:
                     return
                 snapshot = list(self._snapshot)
+                pending = self._take_pending_writes()
 
             # Never let an exception escape the loop body: a QThread whose
             # run() raises dies silently, and the table would then stop
@@ -158,7 +164,7 @@ class _CheatPollWorker(QThread):
             try:
                 # Apply queued manual writes before reading, so a just-typed
                 # value lands and is read back as the new current value this tick.
-                for failure in self._drain_pending_writes():
+                for failure in self._perform_writes(pending):
                     self.write_failed.emit(failure)
 
                 if snapshot: