v4.2 — the CLI reads the engine's own numbers

A maintenance release. One change you will see, in the CLI; the rest is accounting and CI. Every entry except the version strings and the Dependabot pins came from an outside contributor.

The one you will see

The CLI's progress line now comes from the engine's own snapshot. moon_cli.py used to keep a second copy of the byte-rate arithmetic, the counters and the lock that guarded them, so a speed or ETA fix landed in one front-end and not the other. It now samples the same Engine.snapshot() the GUI reads. The line names its phase — extracting 12/48 while provider pages are being resolved, then downloading 30/48 while files transfer — and a snapshot identical to the last one is not printed again, so a slow extraction no longer fills the terminal with repeated zero-speed lines. A stall-killed URL that is re-extracted cannot advance the count twice, and the final summary and the exit codes introduced in 4.1 read the engine's ok and fail. Documented in docs/CLI.md. Thanks to @breezeFur (#97, #154).

The rest

• A completed file's final write buffer was counted twice in bytes_acc, so any transfer smaller than the 16 MiB write buffer counted exactly double in the Downloaded card, the CLI totals and the ETA's average-file term — a 5 MiB transfer recorded 10 MiB. Nine regression tests now pin every byte to one entry. Thanks to @snowyukitty (#172, #175).
• The Extractors slider implied a concurrency datanodes never gets. Its pages are capped by Pages (1–8), so 32 extractors bought nothing there. The control now shows the effective limit, min(Extractors, Pages), updating from either slider, in both languages. Thanks to @yhuikzdtguioaert (#83, #169).
• A CI syntax gate for web/ — a pull request touching only web/ used to run no checks at all. node --check web/app.js now runs behind a web/** paths filter. Thanks to @tunglambk (#174, #176).
• The two files that control what CI checks were the two files CI did not watch. ruff.toml and pytest.ini are now in the workflow filters, and docs-cli-check.yml watches its own file on pull requests too. Thanks to @nightcityblade (#164, #165) and @StefStrg (#93, #168).
• A regression test for the download_file stub, which fails when the engine reaches the real downloader instead of the fixture; run_engine gained a mode parameter so the no-Chrome suite can exercise download mode at all. Thanks to @harshvardhan60792 (#160, #170).
• The E501 comment in ruff.toml claimed line length was enforced. It is not, and the file now says so. Thanks to @FlaggedATX (#79, #171).
• Engine._LOG_MAX_LINES, defined once and read nowhere, is gone. Thanks to @mazi-eth (#80, #167).
• Four places still said 14.x or 4.0 — SECURITY.md, web/index.html, the app.js fallback and demo mode, and the bug-report form. They now say 4.x and v4.2.

Upgrading

Pull, then reinstall if you use the constraints file: pip install -r requirements.txt -c constraints.txt. The pins moved to curl_cffi==0.16.2, cffi==2.1.1 and greenlet==3.5.5 (Dependabot, #181–#183); the ranges in requirements.txt are unchanged. No settings changed, the interface is the 3.0 one apart from the new note under the Extractors slider, and the exit codes are the 4.1 ones. One thing to check: if a script parses the CLI's progress lines, the format changed — the phase is now explicit, and unchanged lines are not repeated.

Full detail, with the reasoning behind each fix, is in CHANGELOG.md.