sots-re/findings/subsystems/events.md

Player event posting API (lane E, 2026-09-08)

Target: recover the API the game uses to post player-visible turn events, so the reimplementation can post them and so the compare harness can see them.

Motivation: TechTree::ProcessResearch (P2-B3) failed its replace-mode oracle by exactly one item across 40,300 — an unposted EVENT_RESEARCH_OVERBUDGET. ServerPlayer:: OnTechResearched (P2-B2) has the same gap. Until events are modelled, both "0 divergence" verdicts bound the economy fields only.

Everything below with an address was read out of the instruction stream (bytes fetched with read-memory over the ReVa HTTP shim, disassembled locally with capstone) unless the line says inferred. Layout claims are additionally confirmed against three real saves via verify/save-reader/save_reader.py.

---

1. The container

ServerPlayer::Events is an EventStorage embedded at ServerPlayer+0x29c, size 0x1c.

Verified by ServerPlayer::GetEventStorage at 0x0080db00, which is the whole function:

0080db00  8d819c020000   lea eax, [ecx + 0x29c]
0080db06  c3             ret

__thiscall EventStorage* ServerPlayer::GetEventStorage(ServerPlayer* this) — no stack args, plain ret. Every research-path post site either calls it (ProcessResearch) or inlines the lea ecx,[esi+0x29c] (OnTechResearched, 0x008919ab / 0x0089241d).

EventStorage (0x1c bytes) — already in the Ghidra project, now confirmed by code

off	type	name	evidence
0x00	void*	vptr	not touched by the post path
0x04	TurnEvents*	Events._Myfirst	0x008853aa mov edx,[esi+8]; sub edx,[esi+4]
0x08	TurnEvents*	Events._Mylast	same
0x0c	TurnEvents*	Events._Myend	vector growth in 0x00885427+
0x10	allocator	Events._Alval	MSVC _Vector_val tail, 4 B
0x14	int	EvNxID	0x008863e3–0x008863f6
0x18	—	padding	struct size 0x1c

EvNxID lands at ServerPlayer+0x2b0 — exactly the byte run the harness guard reported as player+0x2b0:4. That is now explained, not merely observed.

The vector element stride is 0x18: 0x008853b3 mov eax,0x2aaaaaab; imul edx; sar edx,2 = signed divide by 24.

TurnEvents (0x18 bytes) — new

off	type	name	evidence
0x00	void*	vptr	virtual dtor called at 0x00879f21 (mov edx,[edi]; mov eax,[edx]; push 0; call eax)
0x04	int	EvTurn	0x008853d3 cmp [edx+4], ebx (ebx = the turn argument)
0x08	PlayerEvent*	Events._Myfirst	lea ecx,[esi+8] handed to vector::push_back at 0x008863db
0x0c	PlayerEvent*	Events._Mylast	0x008863f9 mov eax,[esi+0xc]
0x10	PlayerEvent*	Events._Myend
0x14	allocator	Events._Alval

PlayerEvent (0x74 = 116 bytes) — new

Stride confirmed two independent ways: the duplicate scanner's divisor at 0x00825d5f (mov eax,0x8d3dcb09; imul ecx; add edx,ecx; sar edx,6 = signed divide by 116) and the post function's mov [eax-0x70], ecx writing id at element+4 off _Mylast.

off	type	on-disk tag	set by
0x00	void*	—	ctor: vftable 0x00a21958
0x04	int	EvEID	PostEvent: EvNxID++ (or the duplicate's id)
0x08	std::string (0x1c)	EvDsc	PostEvent arg 0 (summary / title)
0x24	std::string (0x1c)	EvMsg	PostEvent arg 1 (body)
0x40	int	EvLoc	obj ? obj->[+4] : 0
0x44	float[3]	EvPos	obj ? obj->[+0x18..0x20] : (pos ? *pos : ctor default)
0x50	std::string (0x1c)	EvImg	PostEvent arg img ("" if NULL)
0x6c	int	EvAct	PostEvent arg act; forced to 2 if act==0 && !obj && !pos
0x70	int	EvCID	ctor 0; never written by PostEvent

Correction to formula-gaps.md: the default EvPos is FLT_MAX (0x7f7fffff), not infinity. PlayerEvent::PlayerEvent (0x0084ee30) copies the three floats from the global Vector3 at 0x00af0dc8, whose bytes are FF FF 7F 7F × 3. Confirmed in the save: EvPos = 2139095039 (0x7f7fffff) for EVENT_RESEARCH_OVERBUDGET. Writing +inf (0x7f800000) would produce a different save byte and a different oracle hash.

Ctor also sets EvEID=0, EvLoc=0, EvAct=0, EvCID=0 and the three strings to "" (0x009e100c).

Serialization (matches the save exactly)

PlayerEvent::Serialize = vftable slot 1 at 0x00825970, __thiscall, ret 4. Tag pointers all come from the table at 0x00a2bd88 (stride 8): EvEID EvNxID EvTurn Events EvPos EvLoc EvMsg EvImg EvDsc EvCID EvAct sasc. Emission order read off the instruction stream: EvEID, EvDsc, EvMsg, EvImg, EvLoc, EvPos, EvAct, EvCID.

TurnEvents write 0x00825bb0 / read 0x00825c40: EvTurn then the nested collection Events. EventStorage read 0x00825cc0: EvNxID then the nested collection Events.

So on disk the shape is nested, not flat:

Events (EventStorage)
  EvNxID : int
  Events : n × TurnEvents
      EvTurn : int
      Events : m × PlayerEvent
          EvEID EvDsc EvMsg EvImg EvLoc EvPos{x,y,z} EvAct EvCID

findings/objects/save-editor-structs.md:271 models this as SimPlayerEventsSaveStruct events (Int32 evNxId; ComplexArray<SimPlayerEvent>) — a flat array of events. That is wrong (or at least the R1 C# editor's simplification): the ComplexArray elements are turn groups, each holding its own array. save_reader.py parses it correctly today because Events falls into the generic tree; nothing needs fixing in the reader, but the struct note should be corrected.

Ground truth: verify/results/saves/turn3-state.sav

Player index 1 (/Sim/Player[1]/Events, file offset 120372):

EvNxID = 4
  EvTurn = 2
    EvEID 1  EvDsc "Ships Constructed At Ke'Dolarra"
             EvMsg "1 ship built in system Ke'Dolarra"
             EvImg "EVENT_SHIPS_BUILT"  EvLoc 288  EvPos {-11.9286, 4.71900, 2.31785}
             EvAct 0  EvCID 0
  EvTurn = 3
    EvEID 2  (the same EVENT_SHIPS_BUILT record, next turn)
    EvEID 3  EvDsc "Research Over Budget"
             EvMsg "Research for Waldo Units has gone overbudget."
             EvImg "EVENT_RESEARCH_OVERBUDGET"  EvLoc 0
             EvPos {0x7f7fffff, 0x7f7fffff, 0x7f7fffff}  EvAct 1  EvCID 0

Player index 0 has two EVENT_NO_RESEARCH records (turns 2 and 3, ids 1 and 2, EvNxID 3). Players 2 and 3 have EvNxID = 0 and an empty list — note EvNxID starts at 0, and PostEvent lazily promotes 0 → 1 on the first post (0x008863e3).

---

2. The entry point

// 0x008862b0
int __thiscall EventStorage::PostEvent(
        EventStorage* this,          // ecx
        std::string   summary,       // [ebp+0x08], BY VALUE, 0x1c bytes  -> EvDsc
        std::string   message,       // [ebp+0x24], BY VALUE, 0x1c bytes  -> EvMsg
        void*         obj,           // [ebp+0x40]  may be NULL
        Vector3*      pos,           // [ebp+0x44]  may be NULL
        int           turn,          // [ebp+0x48]
        const char*   img,           // [ebp+0x4c]  may be NULL -> ""
        int           act);          // [ebp+0x50]
// returns the event id; ret 0x4c

ret 0x4c = 76 = 2 × 0x1c (the two by-value std::strings) + 5 × 4. Both string arguments are built in the caller's frame by sub esp,0x1c and a copy-construct, which is the MSVC by-value-std::string idiom; PostEvent frees their buffers itself before returning (0x00886415–0x00886446), so the caller must not.

Body, in order (all read from the instruction stream):

1. PlayerEvent ev; — default ctor 0x0084ee30 on a [ebp-0x84] temporary.
2. ev.EvDsc = summary; ev.EvMsg = message; (0x0088630d, 0x0088631a).
3. ev.EvLoc = obj ? obj->[+4] : 0 (0x00886322).
4. ev.EvImg = img ? img : "" — "" is 0x009e100c; length by inline strlen (0x00886330).
5. ev.EvAct = act; if act == 0 && obj == NULL && pos == NULL then ev.EvAct = 2 (0x00886353–0x0088636f). This default is easy to miss and changes the save bytes.
6. Position: obj wins (obj->[+0x18/+0x1c/+0x20]), else pos (pos->[0/4/8]), else the ctor's FLT_MAX triple (0x0088637a–0x008863a7).
7. PruneOldTurns(turn) — 0x00879eb0.
8. TurnEvents* bucket = GetOrCreateTurnBucket(turn) — 0x00885380.
9. PlayerEvent* dup = FindDuplicate(bucket, &ev) — 0x00825d40. If non-NULL, return dup->EvEID and post nothing.
10. else bucket->Events.push_back(ev); if (EvNxID == 0) EvNxID = 1; id = EvNxID++; back().EvEID = id; return id.

EventStorage::FindDuplicate — 0x00825d40, __thiscall (TurnEvents*, PlayerEvent*), ret 8

Linear scan of the bucket. Two events are the same when all of these match: EvAct (+0x6c), EvLoc (+0x40), the three EvPos floats (fucompp, so bitwise-unequal NaNs never match but the FLT_MAX sentinels always do), EvMsg (+0x24) and EvImg (+0x50). EvDsc is NOT compared. A NULL bucket returns 0 immediately.

This is why the two identical EVENT_SHIPS_BUILT records in turn3-state.sav survive as separate events: they are in different turn buckets, and dedup is per-bucket.

EventStorage::GetOrCreateTurnBucket — 0x00885380, __thiscall (int turn), ret 4

Scans Events for EvTurn == turn; keeps scanning to the end and returns the last match (0x008853d0–0x008853de has no early exit). If none, constructs a bucket (0x00884cb0, vtable 0x00a0f07c), appends, and sets _Mylast[-1].EvTurn = turn (0x0088542d, mov [eax-0x14], ecx, i.e. +4 off the new element at _Mylast-0x18).

EventStorage::PruneOldTurns — 0x00879eb0, __thiscall (int turn)

Cutoff is turn - 0x32 (50 turns), constant, not from config: 0x00879ec3 add ebx,-0x32.

Precisely as coded — and this is a quirk worth reproducing rather than "fixing": it walks the leading run of buckets with EvTurn < cutoff, leaves edi pointing at the last one of that run, and then shifts from edi down to _Myfirst. So it erases n-1 buckets, not n: one stale bucket always survives, and a single leading stale bucket is never removed at all (0x00879ee2 cmp esi,edi; je returns). It also stops at the first non-stale bucket, so a stale bucket after a fresh one is never reached.

Convenience wrapper

0x00886470 (ret and prototype not verified by this lane) posts via PostEvent twice at 0x00886802 / 0x00886b22. 161 call sites in 113 functions reference PostEvent directly — this is the single event API for the whole simulation, not a research-specific helper.

Turn number

Every research-path site computes the turn as *(int*)(*(char**)(player + 8) + 8). ServerPlayer+8 is the StrategyServer second base; 0x0080e320 is __thiscall void* ServerPlayer::GetServer() = [this+8] ? [this+8]-4 : 0, so the field is StrategyServer(primary base)+0x0c. This matches the B4 finding that StrategyServer has two bases four bytes apart.

CORRECTION (lane EV 2026-09-08): that field is the FRAME (the turn counter), not ModCount. The two are different words and the saves separate them cleanly: turn2-state.sav has Summary/Turn = 2, Sim/Frame = 2 and Sim/ModCount = 12, and every event the turn posted landed in bucket EvTurn = 2. If the argument were ModCount the buckets would be 12 and 24. The value is the post-increment turn — a turn run from a save at turn N posts into bucket N+1 — because the frame is bumped in BeginProcessTurn, before either turn driver runs.

---

3. Which events the research path posts

Order within ServerPlayer::ProcessTurn (0x00891340):

#	site	event	condition
1	TechTree::ProcessResearch 0x00587b97	EVENT_RESEARCH_OVERBUDGET	per node, see below
2	→ SetResearched → OnTechResearched 0x008919b5	EVENT_RESEARCH_COMPLETE / _UNDERBUDGET	see below
3	→ OnTechResearched 0x00892427	EVENT_TEMPERANCE	temperance tech cured ≥1 addicted system
4	TechTree::ProcessResearch 0x00587ff4	EVENT_TECHS_UNLOCKED	tail loop, ≥1 newly available node
5	ProcessTurn 0x0089168c	EVENT_NO_RESEARCH	no target, no affordable tech, tree not exhausted

ProcessResearch's two posts bracket the per-node loop: OVERBUDGET fires inside the loop (so once per over-budget node), TECHS_UNLOCKED once after it.

3.1 EVENT_RESEARCH_OVERBUDGET — the B3 defect, fully explained

Posted at 0x00587b97, in TechTree::ProcessResearch (0x005876c0).

Per-node arithmetic recovered from 0x00587732–0x00587907 (naming cost = TechTree::GetNodeCost(node) = 0x0057da00, pts = node->points at node+0x1c):

minPts  = max(cost * 50  / 100, 0)          ; 0x51eb851f/sar 5 = /100
maxPts  = max(minPts, cost * 150 / 100)
wasDone = (pts >= cost)                     ; [ebp-0xcd], setge @0x005877e1
granted = min(requested, maxPts - pts)
*overbudgetOut += requested - granted       ; the out-param accumulates unspent points
pts    += granted
nowDone = (pts >= cost)                     ; [ebp-0xce], setge @0x00587828

if      (pts >= maxPts)  chance = 1.0f, draw = 0.0f          ; always completes
else if (granted == 0)   chance = 0.0f, draw = 1.0f          ; never completes, no draw
else                     chance = (float)(pts - minPts) / maxPts   ; NOTE: / maxPts, not /(max-min)
                         draw   = rng.NextFloat()*(1.0-0.0) + 0.0  ; [0x009e1e68] == 0.0
                         if (owner && owner->Species == 5)   ; Zuul
                             draw = max(draw, rng.NextFloat()*(1.0-0.0)+0.0)

if (chance < draw) {                         ; roll FAILED -> tech not completed this turn
    if (!wasDone && nowDone && owner) {
        PostEvent(EVENT_RESEARCH_OVERBUDGET); node->flag(+0x2c) = 2;
    }
} else {                                     ; roll succeeded
    log("Research completed at %d of %d (%.1f%%). (Odds: %.2f, Roll: %.2f)\n", ...)
    if (pts/cost < 0.8) node->flag(+0x2c) = 0;
    SetResearched(node->def, 2);             ; 0x00581e10 -> OnTechResearched
}

So over budget means: the node has accumulated at least its full cost, but the completion roll failed, and this is the first turn that has been true. !wasDone is what makes it fire exactly once per node.

The record it posts:

field	value	evidence
EvDsc	"Research Over Budget"	key EVENTSUM_RESEARCH_OVERBUDGET, slot 0x00ae48e0, thunk key at 0x00a00cac
EvMsg	"Research for %s has gone overbudget." % node->def->name	key EVENTMSG_RESEARCH_OVERBUDGET, slot 0x00ae48e8, key at 0x00a00ccc
EvImg	"EVENT_RESEARCH_OVERBUDGET"	literal 0x00a0078c, pushed at 0x00587b24
EvLoc	0	obj = NULL (0x00587b2c)
EvPos	{FLT_MAX, FLT_MAX, FLT_MAX}	pos = NULL → ctor default
EvAct	1	literal, 0x00587b22
EvCID	0	ctor

Both strings go through 0x008c97f0 (__cdecl format-into-std::string, 8 stack args: out, fmt, a1..a6) with the tech name as the single substitution; the summary format contains no %s, so it comes out literal. The tech name is def+0x40 (a std::string; _Myres at +0x54 selects heap vs. inline buffer, 0x00587a1d).

Save cross-check: turn3-state.sav, player 1, turn-3 bucket, EvEID 3 is exactly this record, with EvMsg "Research for Waldo Units has gone overbudget." — the format string, the %s substitution, EvAct 1, EvLoc 0 and the FLT_MAX position all match byte for byte.

3.2 EVENT_RESEARCH_COMPLETE / EVENT_RESEARCH_UNDERBUDGET

Posted at 0x008919b5 in ServerPlayer::OnTechResearched (0x00891790), guarded by if (!silent) (0x00891804 cmp byte [ebp+0xc], 0; jne).

ratio = TechTree::GetProgressRatio(tree, def)      ; 0x0057e950, float
if (ratio >= 0.8f)  img = "EVENT_RESEARCH_COMPLETE"    (0x00a33368)
                    sum = EVENTSUM_RESEARCH_COMPLETE   (slot 0x00af09e8)
                    msg = EVENTMSG_RESEARCH_COMPLETE   (slot 0x00af09f0)
else                img = "EVENT_RESEARCH_UNDERBUDGET" (0x00a33380)
                    sum = EVENTSUM_RESEARCH_UNDERBUDGET(slot 0x00af09f8)
                    msg = EVENTMSG_RESEARCH_UNDERBUDGET(slot 0x00af0a00)
PostEvent(sum, snprintf(msg, 0x100, def->name), NULL, NULL, turn, img, 1)

The 0.8 constant is the double at 0x009e20c8 = 0.800000011920929, i.e. (double)0.8f — the comparison is fcomp of the float ratio against that double. Text:

• EVENTSUM_RESEARCH_COMPLETE = "Research Complete", EVENTMSG_RESEARCH_COMPLETE = "Tech %s has been acquired"
• EVENTSUM_RESEARCH_UNDERBUDGET = "Research Breakthrough!", EVENTMSG_RESEARCH_UNDERBUDGET = "Your scientists made a breakthrough with %s. Research has completed ahead of schedule!"

EvAct = 1, obj = pos = NULL, so EvLoc = 0 and EvPos = FLT_MAX³. Message buffer is a 0x100-byte stack buffer formatted with 0x008c8eb0 (_snprintf-shaped, 9 args), then assigned into a std::string, so a message longer than 255 chars is truncated — a real behaviour to reproduce.

Note the naming is counter-intuitive: UNDERBUDGET is the cheap completion (ratio < 0.8).

3.3 EVENT_TEMPERANCE

Posted at 0x00892427, same function, after the per-species temperance sweep (0x00892280–0x008922b9: for each species with flag bit 5, cure every owned addicted system via 0x00745e40 / 0x00743800). Guarded by !silent and by a local "something was cured" flag ([ebp-0x189], set at 0x008922a6). Strings EVENTSUM_ADDICTION_TEMPERENCE / EVENTMSG_ADDICTION_TEMPERENCE (slots 0x00af0a88 / 0x00af0a90, note the shipped misspelling "TEMPERENCE").

EvImg = "EVENT_TEMPERANCE" (0x00a33340), obj = pos = NULL, and EvAct = 0 — which means rule 5 of PostEvent fires and the stored EvAct becomes 2, not 0. Any reimplementation that stores the literal 0 will differ from the oracle here.

3.4 EVENT_TECHS_UNLOCKED

Posted at 0x00587ff4, at the tail of ProcessResearch (loop at 0x00587cc3). Collects every node n where n != NULL, n->def != NULL, tree->nodes[n->def->index] != NULL, that node's state (+0x14) == 2 (available), and n->turnAvailable (+0x20) == currentTurn (0x00587cfc–0x00587d42). If the collected vector is non-empty it posts once.

Correction to strategic-turn-internals.md:233, which reads the condition as "state==2 && turnAvailable == currentTurn && parent researched". There is no parent test: the mov ecx,[ecx]; mov eax,[eax+ecx*4] pair at 0x00587d0d–0x00587d19 dereferences n->def and then indexes tree->nodes by def->[0], which is the tech's own index (the same indirection the entry loop uses at 0x00587738–0x00587740). It resolves back to n itself; the two null checks around it are defensive. The state test is therefore on n, not on a parent.

EvDsc = EVENTSUM_UNLOCKEDTECHS (slot 0x00ae48f0) = "New Technologies Available". EvMsg = EVENTMSG_UNLOCKEDTECHS (slot 0x00ae48f8) = "The following technologies are now available for research:" followed by, per node, the separator string at 0x009e4588 and the node's def->name (0x00587f46–0x00587f82). EvImg = literal "EVENT_TECHS_UNLOCKED" (0x00a00774, length pushed as 0x14). EvAct = 1, obj = pos = NULL.

3.5 EVENT_NO_RESEARCH

Posted at 0x0089168c in ServerPlayer::ProcessTurn. Condition (0x0089162a–0x0089167e):

if (player->ResT (+0x294) == NULL)
    TechTree::CollectResearchedTechs(&out, turn, INT_MAX, sort=1)   ; 0x00584e50
    if (out.empty() && TechTree::FindFirstAvailableTech() != NULL)  ; 0x0057da90
        PostEvent(EVENTSUM_NO_RESEARCH, EVENTMSG_NO_RESEARCH, NULL, NULL, turn,
                  "EVENT_NO_RESEARCH" (0x00a3332c), 1)

Both strings are "No Research Project Assigned." — matches turn3-state.sav player 0 exactly (EvAct 1, EvLoc 0, EvPos FLT_MAX³).

CORRECTION (lane EV 2026-09-08) to this section as first written. 0x00584e50 was named here as a ListAvailableTechs and the middle test read as "no affordable tech". It is TechTree::CollectResearchedTechs (lane T read the whole body; the call site's argument order was re-read here byte for byte from 0x00891600), and the test is about what was researched, not about what is available:

1. ResT == NULL — the player holds no research target;
2. no tech has state == 4 (researched) with turnResearched (+0x24) >= turn, i.e. nothing finished on this turn or later. The turn is passed as the collector's minTurn and the range runs to INT_MAX;
3. at least one node is in state == 2 (available) — that is the availability half, and it is what excludes the four monster factions, whose entire tree is state 4.

Test 2 is not decoration and the corpus exercises it: in zuul-turn23-fleet23.sav the human posts EVENT_RESEARCH_COMPLETE on turn 22 and no no-research event that turn, then EVENT_NO_RESEARCH again on turn 23. sots-engine's P11 implements all three tests; before this lane it implemented tests 1 and 3 only, and over-fired.

Test 1 is the one a save cannot answer. ResTNm on the wire is the target the file was written with; on the reference pair all four real players start the turn with none and three of them acquire one during it, which is AI research selection. Across all eleven corpus saves no AI player ever posts EVENT_NO_RESEARCH (~90 player-turns) while the human posts it on every turn it lacks a target — stated as a hypothesis, with the operator's --ai-player roster standing in for the missing input.

Also in this window (0x008915ec–0x00891624): RollResearchEvent (0x0088df20) is called when ResT != NULL && ResErrRoll(+0x3b4) != 0 && (const at 0x00a2c788) < progressRatio, then ResErrRoll is cleared — the same draw the B2/B3 lanes measured. RollResearchAccident (0x00889dc0) posts the EVENT_LABACCIDENT_* family; not traced here.

---

4. What is not verified

• 0x00886470 — the wrapper that also calls PostEvent. Its prototype and its two call paths were not read; I only established that it exists and is not on the research path.
• TurnEvents' vptr/vtable contents beyond slot 0 (the virtual dtor used by the pruner).
• The sasc tag at 0x00a2bde0 — adjacent to the event tag block, owner unknown.
• Whether PostEvent's dedup can ever collapse two research events in practice. It cannot for OVERBUDGET vs COMPLETE (different EvImg), but two different techs going over budget in the same turn differ only in EvMsg, which is compared — so both are kept. Verified by reading the comparator, not by observing it.
• EventStorage::Write (the save-side counterpart of 0x00825cc0) was not located; only the read/0x8b9d50 direction and the two TurnEvents directions were disassembled. The field order is identical in both directions and is confirmed by the save, so this is a gap in coverage, not in confidence about the layout.
• The 50-turn prune has never been observed running (our saves are at turn ≤ 3).

---

5. What a turn actually posts (lane EV 2026-09-08, measured over all 11 saves)

Read out of the corpus with verify/state-checksum/state_checksum.py, not derived. Every EvImg value, bucket and id below is a file fact.

Only two players in the whole corpus ever hold an event. PlyrIdx 0 (the human) and PlyrIdx 1 (the one AI empire that owns colonies). PlyrIdx 2..3 are the dormant shadow empires — Sav = 0, no colonies — and although they do pick research targets every turn, their EvNxID is 0 on every save. PlyrIdx 4..7 are the monster factions, whose whole tech tree is state 4 and whose EvNxID is likewise 0 throughout. So "who posts" is not a property of the event API; it is a property of who does anything.

The reference pair

pair	player	bucket	id	image	EvAct	EvLoc
turn1 -> turn2	0	EvTurn=2	1	EVENT_NO_RESEARCH	1	0
turn1 -> turn2	1	EvTurn=2	1	EVENT_SHIPS_BUILT	0	288
turn2 -> turn3	0	EvTurn=3	2	EVENT_NO_RESEARCH	1	0
turn2 -> turn3	1	EvTurn=3	2	EVENT_SHIPS_BUILT	0	288
turn2 -> turn3	1	EvTurn=3	3	EVENT_RESEARCH_OVERBUDGET	1	0

Order within a player is readable off the ids: on turn 3 player 1's construction event is id 2 and its research event id 3, so the build pass posts before the research pass. Ids are per player (EvNxID is on the player's own storage), so no cross-player order is observable from a save and none should be assumed.

EVENT_SHIPS_BUILT carries EvAct = 0 as stored, because it has a subject (EvLoc 288, a real position) — the act == 0 && !obj && !pos -> 2 rule does not fire. The only stored EvAct = 2 in the corpus is EVENT_LABACCIDENT_SMALL.

Every image the corpus contains

EVENT_NO_RESEARCH, EVENT_SHIPS_BUILT, EVENT_RESEARCH_COMPLETE, EVENT_TECHS_UNLOCKED, EVENT_RESEARCH_OVERBUDGET, EVENT_FLEET_ARRIVED, EVENT_FLEET_EXPLORED, EVENT_FLEET_MULTIPOINT_NONODE, EVENT_LABACCIDENT_SMALL, EVENT_COLONY_NEWSETTLERS, EVENT_ENEMY_INCOMING_Human. The last is worth noting: the event type is the EvImg string and it is composed at run time — _Human is a species suffix, so the type space is not a fixed enumeration and never was.

Text keys used, from Locale/EN/Strings.csv

EVENTSUM_SHIPS_BUILT = Ships Constructed At %s; EVENTMSG_SHIPS_BUILT_1SHIP = 1 ship built in system %s; EVENTMSG_SHIPS_BUILT_NSHIPS = %s ships built in system %s. So the construction event picks between two message keys on the ship count, and the count is substituted as a %s. Both EVENTSUM_NO_RESEARCH and EVENTMSG_NO_RESEARCH are the same string and take no parameter.

Wired into sots-engine

src/app/event_phase.{h,cpp} bridges the save's event subtree to game::events and P11 posts through it. On the reference pair, with the data root and the AI roster supplied and --commit-blocked=P11: 4 leaves closed on turn1->turn2 and 3 on turn2->turn3, 0 regressed, and the posted record agrees with the oracle on every one of its eight fields. Engine-side write-up: sots-engine docs/EV-events.md.