feat(actions): stop_project ActionCue, the authored end of an unattended show (869fhjdq5)

[ibiltari]

A stop_project ActionCue is the authored end of an unattended show (museums, kiosks; ClickUp 869fhjdq5). When revealed, it stops the show exactly as an operator STOP does: running no, every cue reset to 0, nodes re-armed. The next GO plays from the top. The engine still never infers an end. After the last cue it keeps running = yes by design, which is now documented.

How it works

• Every node reveals the cue, because ActionCues are local everywhere. The handler is pure.
• NodeEngine._action_result_sink sends the controller a STATUS op stop_project {cue, run_seq} without waiting. It skips the send when a STOP or load is already pending, or when no run is in progress.
• The controller validates the op like _relay_follow: adopted sender, cue in the project and of the right type, show running, current run_seq. It then releases the lock and calls stop_script. The first valid op wins; the other nodes' copies are dropped at INFO.
• The node never stops itself. A 3 s watchdog compares STOP/load receipts and only logs a WARNING if no STOP arrived.
• On the node, the cue is a hard chain break: nothing after it is dispatched, and no go_at_end fires from it. A disabled stop cue is transparent, which gives a rehearsal mode.

Hardenings shipped with it

• Cue ADD/UPDATE ops are ignored while running != yes. Before this, a node's late start report after a STOP could leave a cue at 1, then 100.
• stop_script restarts the arm watchdog, so a failed re-arm logs Re-arm after STOP stalled instead of every /go getting a silent 409.

Cleanup

• Removes the dead script_finished aggregator and _finished_nodes, left over since dec95e9 (ClickUp 869fhjdp8).

Packaging

• Requires cuemsutils >= 0.1.0rc17 (utils PR) for the schema value. The whole cluster must run the same engine, as with the follow relay.

Docs

• CLAUDE.md describes the contract and the journal lines.
• docs/unattended-playback.md gives the operator recipes: stop at the end, the play loop-back, rehearsal mode, an end-show button, versions.

Tests

• test_action_cue, test_controller_stop_project and test_node_stop_project; test_controller_gating cleaned up.
• The full suite passes on the .111 test box: 1428 passed.

Rig
On test2 (controller + node01), drills D0–D8 all pass:

• the stop lands about 70 ms after the last media ends, and the cluster re-arms in about 150 ms;
• the cross-node case works through the follow relay;
• the remaining drills cover rehearsal mode, /gocue on the stop cue, the Auto-continue chain break, a simultaneous operator STOP and the kiosk flow.

Details are in cuems-RELATIONS/Plans/2026-10-15-engine-stop-project-actioncue.md §12. The plan was reviewed by Opus: APPROVE-WITH-CHANGES, with all findings folded in.