v0.7.3 — a game that asks before it ends, and a results screen worth reading

Two issues off the tracker, and they are halves of one thing: the end of a game.
Neither ships on the 0.4.9 line — Jesse's call, that line may be complete and
these are not fixes people mid-playtest need.

EXTENDED PLAY (#11). The official result is settled at the original game length
and never changes: in a five-Day game extended to eight, the winner is whoever
led at the end of Day 5. Extending grants exactly one Day and the question is put
again at the end of it — solitaire the player decides alone, multiplayer it is
unanimous and one refusal ends it there. Only days-based endings offer it; a §3.4
collision breach is final, during an extended Day exactly as during the scheduled
game.

It could not be a client-side change. `check` refused every intent once `status`
left `active`; the server never loads a `finished` game back into memory; and a
save is `{ seed, config, history }` replayed through the engine, so a "continue"
the history does not record did not happen. Hence a fourth status,
`awaitingExtension`, and a `game.extend` intent. `config.days` never moves —
`extraDays` counts the borrowed Days and `official` freezes the outcome, the
standings and the statistics at the first ending.

THE RESULTS SCREEN (#16). `GAME OVER — revenueFloor` was `outcome.reason`, an
internal enum interpolated into the page at the one moment the game has the
player's whole attention. Every reason now has a sentence with the game's own
numbers in it. Around it: the result and winner, standings, the rules the game
was dealt under, a per-player breakdown, and the railroad — trains through the
Division and how many worked en route, loads made up and broken, passengers, cars
switched, trains destroyed. It shares the Day-end dialog's blocks rather than
reimplementing them, and stays reopenable so continuing does not cost you the
results.

Statistics are folded, not recorded: `state.tally` counts what the event stream
says happened, hooked at `applyIntent` and `advance` because `reduce` never sees
the phase driver's events — and those are the interesting ones. Nothing in the
rules reads it, and it rides the Frame, so multiplayer gets the same numbers as
solitaire from one implementation.

THREE BUGS FOUND IN TESTING, all of which would have shipped:

  - a saved game containing a vote could not be resumed (NO_ACTOR). A history is
    a flat Intent[] with no seat recorded; the replay derives who acted from the
    turn order, which cannot work for an intent every seat may send in any order.
    `game.extend` carries its voter, checked against the authenticated seat.
  - an all-bot game hung on the question for ever. `driveBots` loops on
    `currentActor`, null the moment the game stops, so it cannot cast a vote, and
    the bot-vote driver returned early with no humans to follow.
  - the balance harness became unbounded — `test/sim.test.ts` went from under a
    second to never finishing. `randomBot` took another Day about half the time,
    so every seeded game ran to playGame's 50,000-turn cap. Fixed in the driver,
    not in a policy, so it holds for bots not yet written.

All three have regression tests. 832 tests pass, against 793 before this change.

NOT BUILT, and a correction. #16's own comment said `trainStoodStill` "is emitted
per Stage, so a run of them is exactly the sat-on-a-siding streak". It is not:
reading advance.ts, it fires once per game and only for a train whose profile
sets `stopEarnsPoint` — the X18 Circus — with `stopPointClaimed` preventing a
second. The streak was built, rendered "1 Stage at (0,0)", and was taken out
again. There is no per-Stage "this train did not move" signal in the engine, so
"longest an engine sat on a siding" needs one first; TODO.md #36 records what it
would take, and the Circus set-up is reported instead. Badges remain the second
pass #16 asks for (TODO.md #33), and because the statistics are derived rather
than recorded, that pass can add any of them retroactively to games already
played and saved.

Extended play has not yet been played at a real table (TODO.md #35): the
multiplayer vote has only been driven through `session.intent`, never through two
browsers.

Closes #11
Closes #16

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EAgJSmeV8zrMh55Mj85ESb

src/engine/advance.ts

@@ -38,8 +38,9 @@ import type { GameEvent } from './events.ts';
 // the legality test cannot disagree about which train is being assembled.
 import { areaAtSeat, areaOf, trainNeedingCars } from './apply.ts';
 import { legalActions } from './legal.ts';
-import type { CrewTray, DivisionNode, GameState, PlayerIndex, RollingStock, SeatIndex, TrayId } from './state.ts';
-import { coordKey, freshTurns, playerAtSeat, playerLeftOf, pooled, subdivisions, totalRevenue, turnOf } from './state.ts';
+import type { CrewTray, DivisionNode, GameState, Outcome, PlayerIndex, RollingStock, SeatIndex, TrayId } from './state.ts';
+import { cloneTally, coordKey, freshTurns, isExtendable, playerAtSeat, playerLeftOf, pooled, subdivisions, totalRevenue, turnOf } from './state.ts';
+import { tallyEvent } from './tally.ts';
 
 export type AdvanceResult = {
   events: GameEvent[];
@@ -71,10 +72,58 @@ const step = (d: Direction): number => (d === 'east' ? 1 : -1);
 // advance
 // ---------------------------------------------------------------------------
 
+/**
+ * The phase driver, plus the two things that have to happen around EVERY batch of events it
+ * produces. `advanceInner` below is the driver itself, unchanged.
+ *
+ * ORDER IS THE WHOLE POINT of this wrapper, and it is the one subtle thing in Gitea#16.
+ * `checkVictory` runs deep inside the driver, so if the official result froze a copy of the Tally
+ * from in there it would freeze it BEFORE this batch's events had been counted — and the batch that
+ * ends a game is exactly the one carrying the last Day's work. So the Tally is folded first and the
+ * result frozen second, both out here where the whole batch is in hand.
+ *
+ * Safe because both endings `return` the moment they fire: no scoring event is emitted after a game
+ * has ended within a single batch, so "everything in this batch" and "everything up to the ending"
+ * are the same set of events. `test/tally.test.ts` pins that.
+ */
 export function advance(s: GameState): AdvanceResult {
+  const r = advanceInner(s);
+  for (const e of r.events) tallyEvent(s, e);
+  freezeOfficial(s);
+  return r;
+}
+
+/**
+ * THE OFFICIAL RESULT, written once (Gitea#11).
+ *
+ * "The winner is based upon the original game length" — so the first ending is the real one and
+ * every later evaluation is informational. Idempotent by construction: it does nothing once
+ * `official` is set, which is what stops an extended Day, or a §3.4 breach during one, from
+ * rewriting a recorded win.
+ */
+function freezeOfficial(s: GameState): void {
+  if (s.official !== null || s.outcome === null) return;
+  s.official = {
+    day: s.config.days,
+    outcome: { ...s.outcome },
+    revenues: s.players.map((p) => p.revenue),
+    collisionsTotal: s.collisionsTotal,
+    tally: cloneTally(s.tally),
+  };
+}
+
+function advanceInner(s: GameState): AdvanceResult {
   const events: GameEvent[] = [];
   if (s.status === 'finished') return { events, needsInput: false };
 
+  /**
+   * §3.3 (Gitea#11) — the timetable has run out and the table is being asked whether to play one
+   * more Day. Nothing runs itself while that question is open, so this is `needsInput` rather than
+   * an ending: `pump` stops here, the server keeps the game in memory, and the only intent the
+   * rules will take is `game.extend`.
+   */
+  if (s.status === 'awaitingExtension') return { events, needsInput: true };
+
   // The Superintendent's clearance ruling interrupts the Mainline Phase (§8.1).
   if (s.clock.pendingDecision !== null) return { events, needsInput: true };
 
@@ -1313,6 +1362,14 @@ function shiftChange(s: GameState, events: GameEvent[]): AdvanceResult {
       s.config.maxCollisionsTotal > 0 && s.collisionsTotal >= s.config.maxCollisionsTotal;
     if (perDayBreach || totalBreach) {
       s.status = 'finished';
+      /**
+       * NOT EXTENDABLE, AND IT DOES NOT REWRITE A RECORDED RESULT (Gitea#11).
+       *
+       * A breach during an EXTENDED Day ends play at once, exactly as it would during the regular
+       * game — but by then the official result already exists, and a railroad declared unsafe on
+       * Day 9 does not retract who won on Day 5. `freezeOfficial` is what keeps that true: it
+       * writes only when `official` is still null, so assigning `outcome` here is safe.
+       */
       s.outcome = { result: 'loss', winner: null, reason: 'collisionFloor' };
       return { events, needsInput: false };
     }
@@ -1356,28 +1413,55 @@ function rotateSeats(s: GameState, events: GameEvent[]): void {
 
 function checkVictory(s: GameState, _events: GameEvent[]): boolean {
   const daysElapsed = s.clock.day - 1;
-  if (daysElapsed < s.config.days) return false;
+  /**
+   * `extraDays` is Gitea#11. `config.days` is never touched by an extension — it is what the
+   * OFFICIAL result is decided at — so the Day the timetable currently runs to is the sum of the
+   * two. On the first ending they are equal, which is why `freezeOfficial` can record `config.days`
+   * as the official Day without asking anything further.
+   */
+  if (daysElapsed < s.config.days + s.extraDays) return false;
 
-  s.status = 'finished';
+  s.outcome = decideOutcome(s);
+  /**
+   * §3.3, EXTENDED PLAY — an ending the table may play past PAUSES rather than finishing.
+   *
+   * `freezeOfficial` (the `advance` wrapper) records the first of these as the official result, so
+   * by the time a second one is reached the winner is already settled and everything here is
+   * informational. The votes are cleared each time because the question is asked again at the end
+   * of every extended Day: agreeing once does not agree to the rest of the game.
+   */
+  if (isExtendable(s.outcome.reason)) {
+    s.status = 'awaitingExtension';
+    s.extensionVotes = s.players.map(() => null);
+  } else {
+    s.status = 'finished';
+  }
+  return true;
+}
 
+/**
+ * WHO WON, on the evidence as it stands right now.
+ *
+ * Split out of `checkVictory` for Gitea#11: it is asked once per ending, and an extended game has
+ * more than one. Unchanged in substance — the revenue floor, then co-op's shared achievement, then
+ * the highest Revenue — it simply no longer writes to the state it is reasoning about.
+ */
+function decideOutcome(s: GameState): Outcome {
   const combined = totalRevenue(s);
   if (s.config.minCombinedRevenue > 0 && combined < s.config.minCombinedRevenue) {
-    s.outcome = { result: 'loss', winner: null, reason: 'revenueFloor' };
-    return true;
+    return { result: 'loss', winner: null, reason: 'revenueFloor' };
   }
 
   if (s.config.mode === 'coop') {
-    s.outcome = { result: 'win', winner: null, reason: 'daysElapsed' };
-    return true;
+    return { result: 'win', winner: null, reason: 'daysElapsed' };
   }
 
   const best = Math.max(...s.players.map((p) => p.revenue));
-  s.outcome = {
+  return {
     result: 'win',
     winner: s.players.findIndex((p) => p.revenue === best),
     reason: 'daysElapsed',
   };
-  return true;
 }
 
 // ---------------------------------------------------------------------------

src/engine/apply.ts

@@ -52,6 +52,7 @@ import type {
   TrayId,
   TurnoutOrientation,
 } from './state.ts';
+import { tallyEvent } from './tally.ts';
 import { createRng } from './rng.ts';
 import {
   carsOn,
@@ -769,6 +770,23 @@ export function passengerRefusal(
 // ---------------------------------------------------------------------------
 
 export function check(s: GameState, player: PlayerIndex, i: Intent): RejectionCode | null {
+  /**
+   * §3.3, EXTENDED PLAY (Gitea#11) — asked ABOVE the status guard, because the whole point of the
+   * vote is that it is the one thing the rules will take from a game that has stopped.
+   *
+   * Out of turn like `mainline.clearance` below, and unlike it open to every seat at once: it is a
+   * table decision rather than a ruling, so there is no actor to be.
+   */
+  if (i.type === 'game.extend') {
+    if (s.status !== 'awaitingExtension') return 'NOT_AWAITING_EXTENSION';
+    // The intent NAMES its voter so that a save can be replayed (`intents.ts`), which makes it a
+    // claim until it is checked against the seat the caller authenticated. One seat may not vote
+    // for another.
+    if (i.player !== player) return 'NOT_YOUR_TURN';
+    if (s.extensionVotes[player] !== null) return 'ALREADY_VOTED';
+    return null;
+  }
+
   if (s.status !== 'active') return 'WRONG_PHASE';
 
   // The clearance ruling is the one intent that arrives out of turn order: it interrupts the
@@ -1532,6 +1550,27 @@ export function movesFor(
 
 function execute(s: GameState, player: PlayerIndex, i: Intent): GameEvent[] {
   switch (i.type) {
+    /**
+     * §3.3, EXTENDED PLAY (Gitea#11) — the vote, and what it settles.
+     *
+     * Decided HERE rather than in `reduce` because the answer depends on the votes as they stand
+     * BEFORE this one lands, and `execute` is the half that still sees that. Three outcomes:
+     *
+     *   - a refusal ends it immediately. Unanimity means one "no" is decisive, so nobody is made to
+     *     wait on a player who has already said no (Jesse's call, 2026-08-28);
+     *   - the last outstanding "yes" grants the Day — ONE Day, and the question is put again at the
+     *     end of it;
+     *   - anything else is just a vote recorded, and the table waits.
+     */
+    case 'game.extend': {
+      const vote: GameEvent = { type: 'extensionVoted', player, agree: i.agree };
+      if (!i.agree) return [vote, { type: 'playConcluded', declinedBy: player }];
+      const after = s.extensionVotes.map((v, p) => (p === player ? true : v));
+      return after.every((v) => v === true)
+        ? [vote, { type: 'dayExtended', day: s.config.days + s.extraDays + 1 }]
+        : [vote];
+    }
+
     case 'localOps.choose':
       return [{ type: 'localOpsOptionChosen', player, option: i.option }];
 
@@ -1942,6 +1981,30 @@ function findTimetableSlot(s: GameState, from: number): number | null {
 
 export function reduce(s: GameState, e: GameEvent): void {
   switch (e.type) {
+    // -- §3.3, extended play (Gitea#11)
+    case 'extensionVoted':
+      s.extensionVotes[e.player] = e.agree;
+      break;
+
+    /**
+     * One more Day, and the votes are wiped: agreeing once does not agree to the rest of the game.
+     *
+     * `config.days` is deliberately untouched. It is what the OFFICIAL result was decided at
+     * (`state.ts`'s `FinalReport`), so leaving it alone is what makes "the winner is decided at the
+     * original game length" a fact about the code rather than a comment on it. `outcome` is left
+     * alone too — it is the last evaluation, and it is what the results screen shows while the extra
+     * Day is played.
+     */
+    case 'dayExtended':
+      s.extraDays += 1;
+      s.extensionVotes = s.players.map(() => null);
+      s.status = 'active';
+      break;
+
+    case 'playConcluded':
+      s.status = 'finished';
+      break;
+
     case 'localOpsOptionChosen':
       turnOf(s, e.player).option = e.option;
       break;
@@ -3052,6 +3115,9 @@ export function applyIntent(s: GameState, player: PlayerIndex, i: Intent): Apply
 
   const events = execute(s, player, i);
   for (const e of events) reduce(s, e);
+  // Gitea#16 — the intent half of the fold; `advance` does the phase driver's half. See `tally.ts`
+  // for why it cannot simply live inside `reduce`.
+  for (const e of events) tallyEvent(s, e);
   return { ok: true, events };
 }
 

src/engine/events.ts

@@ -195,6 +195,23 @@ export type GameEvent =
   | { type: 'unloadBegan'; player: PlayerIndex; at: GridCoord; carType: CarType; carIndex: number }
   // -- consequences
   | { type: 'revenueChanged'; player: PlayerIndex; delta: number; total: number; reason: string }
-  | { type: 'phaseEnded'; player: PlayerIndex; phase: string };
+  | { type: 'phaseEnded'; player: PlayerIndex; phase: string }
+  // -- §3.3, extended play (Gitea#11)
+  /**
+   * One seat's answer to "play one more Day?". Every seat votes; the vote is unanimous, and one
+   * refusal ends it. In the log so that a table can see who is still being waited on, and who
+   * called time.
+   */
+  | { type: 'extensionVoted'; player: PlayerIndex; agree: boolean }
+  /** The table agreed. `day` is the Day the extra one becomes — `config.days + extraDays`. */
+  | { type: 'dayExtended'; day: number }
+  /**
+   * Play is over for good — somebody declined the extension.
+   *
+   * Distinct from the ending itself, which `checkVictory` already announced by way of the result: an
+   * ending that COULD have been played past and was not is a decision the table made, and the log
+   * should say so rather than simply stopping.
+   */
+  | { type: 'playConcluded'; declinedBy: PlayerIndex };
 
 export type EventType = GameEvent['type'];

src/engine/intents.ts

@@ -147,7 +147,28 @@ export type Intent =
   | { type: 'laborer.startLoad'; at: GridCoord }
   | { type: 'laborer.advanceLoad'; at: GridCoord; box: number }
   | { type: 'laborer.beginUnload'; at: GridCoord; carIndex: number }
-  | { type: 'loadUnload.end' };
+  | { type: 'loadUnload.end' }
+  /**
+   * §3.3, EXTENDED PLAY (Gitea#11) — one vote on whether to play one more Day.
+   *
+   * ARRIVES OUT OF TURN, like `mainline.clearance`, and unlike it goes to EVERY seat rather than to
+   * the Superintendent: it is a table decision, not a ruling. Unanimous, and one `agree: false`
+   * ends the game immediately — nobody waits on a player who has already refused.
+   *
+   * It is an intent, rather than a button the client handles by itself, because a save is
+   * `{ seed, config, history }` replayed through the engine: a decision that is not in the history
+   * did not happen, and an extended game would evaporate on the next reload, Undo, or server
+   * restart. This is the record of the table agreeing.
+   *
+   * CARRIES ITS VOTER, uniquely among intents, and it has to. A saved history is a flat `Intent[]`
+   * with no seat recorded against each move: the replay DERIVES who acted from the turn order
+   * (`fromMultiplayerSave`). That works for every other intent, including `mainline.clearance`,
+   * because there is exactly one seat it could have been. Here there is not — every seat may vote,
+   * in any order — so a vote whose voter is not written down cannot be replayed at all, and a
+   * resumed server would refuse the save with `NO_ACTOR`. The server checks this against the seat
+   * it authenticated (`NOT_YOUR_TURN`), so it is a record, never a claim.
+   */
+  | { type: 'game.extend'; player: PlayerIndex; agree: boolean };
 
 export type IntentType = Intent['type'];
 
@@ -276,7 +297,11 @@ export type RejectionCode =
    * §6.2, Jesse's ruling (Gitea#6) — a train card is never discarded. Hold it as long as you like;
    * the only way it leaves your hand is onto the timetable.
    */
-  | 'TRAINS_ARE_NEVER_DISCARDED';
+  | 'TRAINS_ARE_NEVER_DISCARDED'
+  /** §3.3 (Gitea#11) — `game.extend` when the game is not waiting on an extension vote. */
+  | 'NOT_AWAITING_EXTENSION'
+  /** §3.3 (Gitea#11) — this seat has already voted on this extension. */
+  | 'ALREADY_VOTED';
 
 export type Rejection = { code: RejectionCode; message: string };
 

src/engine/legal.ts

@@ -68,6 +68,23 @@ export function isLegal(s: GameState, player: PlayerIndex, i: Intent): boolean {
 function candidates(s: GameState, player: PlayerIndex): Intent[] {
   const out: Intent[] = [];
 
+  /**
+   * §3.3, EXTENDED PLAY (Gitea#11) — the only thing on offer when the timetable has run out and the
+   * table is being asked whether to play on.
+   *
+   * Returned EARLY rather than added to the list, because nothing else is legal in this state and
+   * the phase switch below would otherwise generate a boardful of candidates for `check` to reject
+   * one at a time. It also puts the vote in front of the bot driver through the ordinary path, which
+   * is what lets a bot seat answer without the engine having to know which seats are bots.
+   */
+  if (s.status === 'awaitingExtension') {
+    if (s.extensionVotes[player] === null) {
+      out.push({ type: 'game.extend', player, agree: true });
+      out.push({ type: 'game.extend', player, agree: false });
+    }
+    return out;
+  }
+
   // The clearance ruling arrives out of turn order and goes to the Superintendent (§8.1).
   if (s.clock.pendingDecision !== null) {
     out.push({ type: 'mainline.clearance', allow: true });

src/engine/setup.ts

@@ -43,7 +43,7 @@ import type {
   TrackCard,
   TrayId,
 } from './state.ts';
-import { coordKey, freshTurns } from './state.ts';
+import { coordKey, emptyTally, freshTurns } from './state.ts';
 
 export type SetupOptions = {
   id: string;
@@ -434,6 +434,10 @@ export function createGame(opts: SetupOptions): GameState {
     collisionsTotal: 0,
     status: 'active',
     outcome: null,
+    extraDays: 0,
+    extensionVotes: players.map(() => null),
+    official: null,
+    tally: emptyTally(playerCount),
   };
 }
 

src/engine/state.ts

@@ -684,6 +684,139 @@ export type Outcome = {
   reason: OutcomeReason;
 };
 
+/**
+ * §3.3, EXTENDED PLAY (Gitea#11) — which endings may be played past.
+ *
+ * Both days-based endings offer another Day: running out of timetable, and closing short of the
+ * combined Revenue floor, are the same event seen twice — the last Day ended and this is what the
+ * books say. A `collisionFloor` ending is NOT extendable, and neither is a collision breach that
+ * happens during an extended Day: §3.4 stopped the game because the railroad was declared unsafe,
+ * and carrying on regardless would contradict the rule that stopped it (Jesse's call, 2026-08-28).
+ */
+export function isExtendable(reason: OutcomeReason): boolean {
+  return reason === 'daysElapsed' || reason === 'revenueFloor';
+}
+
+/**
+ * Running counts of everything interesting that has happened, tallied from the event stream
+ * (Gitea#16).
+ *
+ * WHY IT LIVES ON `GameState` rather than being computed by whoever happens to want it. Three
+ * reasons, in ascending order of how much they cost to work around:
+ *
+ *   1. `snapshot()` already takes a `GameState`, so every number here reaches a MULTIPLAYER client
+ *      through the `Frame` it is already being sent — no new server route, no new `Push` field, no
+ *      new `Session` method, and no second implementation that can disagree with the first.
+ *   2. It is REPLAY-EXACT. A save is `{ seed, config, history }` replayed through the engine
+ *      (`web/game.ts`'s `fromSave`), so a tally folded from the events that replay emits is rebuilt
+ *      identically every time — which is what makes Undo and a server restart correct here for free.
+ *   3. The official result freezes a COPY of this at the moment the timetable ran out (`official`
+ *      below), and a frozen copy has to be taken from something that already exists.
+ *
+ * Aggregate counts only. Nothing here is seat-secret — no card ids, no hands — which is why
+ * `test/redaction.test.ts` stays green with the whole thing on the Frame.
+ *
+ * NOT SCORING. Nothing in here feeds a rule; it is read by the results screen and by the badge work
+ * that Gitea#16 leaves to a second pass. Adding a counter is always safe.
+ */
+export type Tally = {
+  /** §8.3 — a train that ran the length of the Division and left it. */
+  trainsCompleted: number;
+  /**
+   * Of those, how many did some switching between being made up and leaving.
+   *
+   * The join Gitea#16 asks for by name ("a player who completes an entire game where every train
+   * that passed through did some switching on"). Counted as the train completes, against whether
+   * that tray has coupled or dropped anything since it was made up — which is why `switchedSince`
+   * below exists rather than this being derivable afterwards.
+   */
+  trainsCompletedWithWork: number;
+  /** §10 — trains lost to a collision, and the cars that went with them. */
+  trainsDestroyed: number;
+  carsDestroyed: number;
+  /** §6 — switching volume, both directions. */
+  carsCoupled: number;
+  carsDropped: number;
+  /** §9.1 — the MEN | AT | WORK pipeline: begun, and carried all the way through. */
+  loadsStarted: number;
+  loadsCompleted: number;
+  unloadsBegun: number;
+  unloadsCompleted: number;
+  /** §9.2 — passenger work. */
+  passengersBoarded: number;
+  passengersDetrained: number;
+  /** Colour, and the vocabulary the badge pass will draw on. */
+  flyingSwitches: number;
+  officeUpgrades: number;
+  dispatchBonusesUsed: number;
+  facilitiesUnjammed: number;
+  expediteFaults: number;
+  trainsHeld: number;
+  trainsDiverted: number;
+  secondSections: number;
+  extrasStarted: number;
+  cardsDrawn: number;
+  cardsPlayed: number;
+  cardsDiscarded: number;
+  clearancesRequested: number;
+  /** §8.1 — rulings that let the other train through. A refusal is a ruling too, but not this one. */
+  clearancesAllowed: number;
+  /**
+   * X18 CIRCUS SET-UPS — a train that spent a Stage standing still and was paid for it (§X18).
+   *
+   * NOT "the longest an engine sat on a siding", which is what Gitea#16 asks for and what the
+   * comment on that issue assumed this was. `trainStoodStill` is emitted ONCE IN A GAME PER SUCH
+   * TRAIN — only for a train whose profile has `stopEarnsPoint`, and `advance.ts` sets
+   * `stopPointClaimed` so it can never fire twice. There is no per-Stage "this train did not move"
+   * signal in the engine at all, so a longest-stand streak cannot be folded from the event stream:
+   * it needs an engine-side signal that does not exist yet. Recorded in `TODO.md` for the badge
+   * pass rather than shipped as a statistic that would read "1 Stage" for ever.
+   */
+  circusStops: { trainNumber: number; where: string }[];
+  /**
+   * Train numbers that have coupled or dropped something since they were made up, for
+   * `trainsCompletedWithWork`. Cleared when the train is made up and when it leaves the Division.
+   */
+  switchedSince: number[];
+  /** Indexed by PLAYER. Only events that name a player reach these. */
+  byPlayer: PlayerTally[];
+};
+
+export type PlayerTally = {
+  loads: number;
+  unloads: number;
+  passengersBoarded: number;
+  passengersDetrained: number;
+  cardsPlayed: number;
+  /** §10 — collisions this player was faulted for, not collisions they were caught in. */
+  collisions: number;
+  /** Revenue gained and Revenue lost, kept apart: the net is already on `players[i].revenue`. */
+  revenueGained: number;
+  revenueLost: number;
+};
+
+/**
+ * THE OFFICIAL RESULT, frozen at the moment the timetable ran out (Gitea#11).
+ *
+ * "The winner is based upon the original game length. In a five-day game, even if it's extended to
+ * eight or nine days, the winner and the official answer is the winner at the end of five days"
+ * (Jesse, 2026-08-28). So this is written ONCE, at the first ending, and never overwritten —
+ * including by a §3.4 collision breach during an extended Day, which ends play without touching it.
+ *
+ * `state.outcome` keeps moving: it is always the CURRENT evaluation, which is what the live game
+ * wants. Once `official` exists, everything after it is informational.
+ */
+export type FinalReport = {
+  /** The Day the game was scheduled to end on — always `config.days`. */
+  day: number;
+  outcome: Outcome;
+  /** Every player's Revenue at that moment, in player order. */
+  revenues: number[];
+  collisionsTotal: number;
+  /** The Tally as it stood when the timetable ran out. */
+  tally: Tally;
+};
+
 /**
  * Per-Stage transient bookkeeping for the acting player. Reset when the actor changes.
  *
@@ -726,6 +859,66 @@ export function freshTurns(players: number, moves: number): Map<PlayerIndex, Tur
   return turns;
 }
 
+/** A Tally with everything at zero — the state every game starts in (Gitea#16). */
+export function emptyTally(players: number): Tally {
+  return {
+    trainsCompleted: 0,
+    trainsCompletedWithWork: 0,
+    trainsDestroyed: 0,
+    carsDestroyed: 0,
+    carsCoupled: 0,
+    carsDropped: 0,
+    loadsStarted: 0,
+    loadsCompleted: 0,
+    unloadsBegun: 0,
+    unloadsCompleted: 0,
+    passengersBoarded: 0,
+    passengersDetrained: 0,
+    flyingSwitches: 0,
+    officeUpgrades: 0,
+    dispatchBonusesUsed: 0,
+    facilitiesUnjammed: 0,
+    expediteFaults: 0,
+    trainsHeld: 0,
+    trainsDiverted: 0,
+    secondSections: 0,
+    extrasStarted: 0,
+    cardsDrawn: 0,
+    cardsPlayed: 0,
+    cardsDiscarded: 0,
+    clearancesRequested: 0,
+    clearancesAllowed: 0,
+    circusStops: [],
+    switchedSince: [],
+    byPlayer: Array.from({ length: players }, () => ({
+      loads: 0,
+      unloads: 0,
+      passengersBoarded: 0,
+      passengersDetrained: 0,
+      cardsPlayed: 0,
+      collisions: 0,
+      revenueGained: 0,
+      revenueLost: 0,
+    })),
+  };
+}
+
+/**
+ * A deep copy, for freezing the official result (`FinalReport`).
+ *
+ * Written out rather than reached for via `structuredClone` because a Tally is a flat bag of numbers
+ * with two containers in it, and spelling the copy out means a field added later that needs deep
+ * copying is a compile error here rather than a shared reference discovered in a results screen.
+ */
+export function cloneTally(t: Tally): Tally {
+  return {
+    ...t,
+    circusStops: t.circusStops.map((c) => ({ ...c })),
+    switchedSince: [...t.switchedSince],
+    byPlayer: t.byPlayer.map((p) => ({ ...p })),
+  };
+}
+
 /**
  * WHICH WAY TO DRAW THE ENGINE — east or west, for every train, everywhere.
  *
@@ -866,8 +1059,34 @@ export type GameState = {
   collisionsToday: number;
   /** §3.4 — never reset; checked against `config.maxCollisionsTotal`. */
   collisionsTotal: number;
-  status: 'setup' | 'active' | 'finished';
+  /**
+   * `awaitingExtension` is Gitea#11: the timetable has run out, the result is recorded, and the
+   * table is being asked whether to play one more Day. It is a PAUSE, not an ending — `advance`
+   * reports `needsInput` there, the server resumes it like any live game, and the only intent the
+   * rules will accept is `game.extend`.
+   */
+  status: 'setup' | 'active' | 'awaitingExtension' | 'finished';
+  /** The CURRENT evaluation, re-decided at the end of every Day including extended ones. */
   outcome: Outcome | null;
+  /**
+   * §3.3 (Gitea#11) — Days granted beyond `config.days`, one vote at a time.
+   *
+   * `config.days` is deliberately never touched: it is what the official result was decided at, so
+   * leaving it alone is what makes "the winner is decided at the original game length" a fact about
+   * the code rather than a comment on it.
+   */
+  extraDays: number;
+  /**
+   * Per PLAYER, while `awaitingExtension`. `null` means they have not voted yet.
+   *
+   * Unanimous, and one refusal is decisive: nobody is made to wait on a player who has already said
+   * no (Jesse's call, 2026-08-28). Solitaire is the same code with one voter.
+   */
+  extensionVotes: (boolean | null)[];
+  /** Frozen at the FIRST ending and never overwritten. See `FinalReport`. */
+  official: FinalReport | null;
+  /** Gitea#16. Folded from the event stream; see `Tally`. */
+  tally: Tally;
 };
 
 // ---------------------------------------------------------------------------

src/engine/tally.ts

@@ -0,0 +1,201 @@
+/**
+ * The event tally — Gitea#16's statistics, folded from the event stream into `GameState.tally`.
+ *
+ * WHERE IT IS HOOKED, and why it is not in `reduce`. `apply.ts`'s `reduce` sees only the events an
+ * INTENT produced; `advance.ts` mutates state directly and pushes its events without reducing them
+ * at all — and `advance` is where `trainCompleted`, `trainsDestroyed` and `trainStoodStill` come
+ * from, which are exactly the numbers this issue asks for. So the fold is hooked at the two places
+ * every event in the game passes through exactly once on its way to a caller:
+ *
+ *   - `applyIntent` (`apply.ts`), beside its `reduce` loop;
+ *   - `advance` (`advance.ts`), which now wraps the phase driver and folds what it returns.
+ *
+ * Exactly once matters in both directions: an event folded twice inflates a count, and an event
+ * folded nowhere is a statistic that silently reads zero. `test/tally.test.ts` pins both by playing
+ * real games and checking the tally against an independent count over the same event array.
+ *
+ * NOTHING HERE IS A RULE. The tally is read by the results screen and by the badge work Gitea#16
+ * leaves to a second pass; no engine decision consults it. That is what makes adding a counter
+ * always safe.
+ *
+ * WHAT IS NOT COUNTED PER PLAYER, and why. `carsCoupled` and `carsDropped` carry a `trayId` and no
+ * `player` — switching is done BY a crew, and the event says which crew rather than which person.
+ * Rather than guess an owner from whose turn it happened to be, those two are table totals only.
+ * The events that do name a player (`loadCompleted`, `passengersBoarded`, `cardPlayed`,
+ * `revenueChanged`, `trainsDestroyed`) are the ones `byPlayer` reports.
+ */
+
+import type { GameEvent } from './events.ts';
+import type { GameState } from './state.ts';
+
+/**
+ * Fold one event into `s.tally`.
+ *
+ * The switch is deliberately not exhaustive — most of the 49 event types say nothing a player would
+ * want counted, and listing them all to `break` would bury the ones that do. A `default` that does
+ * nothing is the honest shape.
+ */
+export function tallyEvent(s: GameState, e: GameEvent): void {
+  const t = s.tally;
+  const mine = 'player' in e && typeof e.player === 'number' ? t.byPlayer[e.player] : undefined;
+
+  switch (e.type) {
+    /**
+     * §X18 — the Circus train set up and was paid for the Stage it spent standing.
+     *
+     * NOT a "longest stand" streak, which is what Gitea#16 wants and what its comment assumed this
+     * event was. It fires once in a game per such train: only trains whose profile sets
+     * `stopEarnsPoint` emit it at all, and `advance.ts` claims it once with `stopPointClaimed`. So
+     * there is nothing to count a run of, and the honest thing to report is the event itself.
+     */
+    case 'trainStoodStill':
+      t.circusStops.push({ trainNumber: e.trainNumber, where: e.where });
+      break;
+
+    /**
+     * DID THIS TRAIN DO ANY SWITCHING — Gitea#16's "switching master" join, kept as it happens
+     * rather than reconstructed afterwards.
+     *
+     * The two halves of the join are in different currencies: switching events name a `trayId` and
+     * completion names a `trainNumber`, and no event carries both. The tray is looked up in LIVE
+     * state, which is sound precisely here — a crew that has just coupled or dropped is still on the
+     * board — where re-deriving it at completion time would not be, the tray having been released by
+     * then. A lookup that misses costs one train its mark on a statistic; it cannot affect a rule.
+     */
+    case 'carsCoupled':
+      t.carsCoupled += e.stock.length;
+      markSwitched(s, e.trayId);
+      break;
+
+    case 'carsDropped':
+      t.carsDropped += e.stock.length;
+      markSwitched(s, e.trayId);
+      break;
+
+    case 'flyingSwitch':
+      t.flyingSwitches += 1;
+      markSwitched(s, e.trayId);
+      break;
+
+    // A tray is reused run after run, so a fresh train starts with a clean sheet.
+    case 'trainMadeUp':
+      t.switchedSince = t.switchedSince.filter((n) => n !== e.trainNumber);
+      break;
+
+    case 'trainCompleted':
+      t.trainsCompleted += 1;
+      if (t.switchedSince.includes(e.trainNumber)) t.trainsCompletedWithWork += 1;
+      t.switchedSince = t.switchedSince.filter((n) => n !== e.trainNumber);
+      break;
+
+    case 'trainsDestroyed':
+      t.trainsDestroyed += e.trains.length;
+      for (const train of e.trains) t.carsDestroyed += train.consist.length;
+      if (mine) mine.collisions += 1;
+      break;
+
+    case 'officeUpgraded':
+      t.officeUpgrades += 1;
+      break;
+
+    case 'dispatchBonusUsed':
+      t.dispatchBonusesUsed += 1;
+      break;
+
+    case 'facilityUnjammed':
+      t.facilitiesUnjammed += 1;
+      break;
+
+    case 'expediteFault':
+      t.expediteFaults += 1;
+      break;
+
+    case 'trainHeld':
+      t.trainsHeld += 1;
+      break;
+
+    case 'trainDiverted':
+      t.trainsDiverted += 1;
+      break;
+
+    case 'secondSectionOrdered':
+      t.secondSections += 1;
+      break;
+
+    case 'extraStarted':
+      t.extrasStarted += 1;
+      break;
+
+    case 'cardDrawn':
+      t.cardsDrawn += 1;
+      break;
+
+    case 'cardPlayed':
+      t.cardsPlayed += 1;
+      if (mine) mine.cardsPlayed += 1;
+      break;
+
+    case 'cardDiscarded':
+      t.cardsDiscarded += 1;
+      break;
+
+    case 'clearanceRequested':
+      t.clearancesRequested += 1;
+      break;
+
+    // §8.1 — a ruling is given either way; only a YES let the other train through.
+    case 'clearanceGiven':
+      if (e.allow) t.clearancesAllowed += 1;
+      break;
+
+    case 'loadStarted':
+      t.loadsStarted += 1;
+      break;
+
+    case 'loadCompleted':
+      t.loadsCompleted += 1;
+      if (mine) mine.loads += 1;
+      break;
+
+    case 'unloadBegan':
+      t.unloadsBegun += 1;
+      break;
+
+    case 'unloadCompleted':
+      t.unloadsCompleted += 1;
+      if (mine) mine.unloads += 1;
+      break;
+
+    case 'passengersBoarded':
+      t.passengersBoarded += 1;
+      if (mine) mine.passengersBoarded += 1;
+      break;
+
+    case 'passengersDetrained':
+      t.passengersDetrained += 1;
+      if (mine) mine.passengersDetrained += 1;
+      break;
+
+    /**
+     * Gained and lost are kept APART because the net is already on `players[i].revenue`. What the
+     * results screen cannot otherwise say is how much of a modest final score was earned and then
+     * handed back at a grade crossing — which is the whole difference between a quiet game and an
+     * eventful one.
+     */
+    case 'revenueChanged':
+      if (mine) {
+        if (e.delta >= 0) mine.revenueGained += e.delta;
+        else mine.revenueLost += -e.delta;
+      }
+      break;
+
+    default:
+      break;
+  }
+}
+
+function markSwitched(s: GameState, trayId: string): void {
+  const n = s.trays.get(trayId)?.trainNumber;
+  if (n === undefined || n === null) return;
+  if (!s.tally.switchedSince.includes(n)) s.tally.switchedSince.push(n);
+}