Resolve call-script dispatch: id = raw SYS4INI file index

Native-RE (Ghidra) cracked call-script <id> (opcode 0x03): its handler
FUN_0041bc90 -> loader FUN_0040e980 -> resolver FUN_0044f390 indexes an
80-byte record table at base + id*0x50 == the SYS4INI record layout. So
`call-script <id>` is a direct RAW index into the SYS4INI global file
table (the asset index we already parse) -- there is no separate on-disk
id->code registry. This resolves name-resolution.md #1, statically, no
Frida.

Confirmed: all 297 distinct corpus call-script ids resolve to a .BIN
script with a semantically-exact name (0x1ab->ADDITEM, 0x2ae7->MES,
0x143->BUNKI, 0x329d->CALCREVISE), 0 out-of-range, 0 alternate-pack.
Companion op 0x8f `call` is an intra-script JSR (FUN_0041fba0), not
cross-script.

- parse_sys4ini.py: preserve `raw_index` per entry (= the engine file id;
  index the RAW records incl. '@' placeholders) + emit
  build/callscript-names.json (id->name).
- sys4load.py: annotate `call-script 0x1ab =ADDITEM.BIN`.
- opcodes.toml 0x03/0x8f refined (source=investigation, confidence high,
  handler VAs) + rebuilt opcode-reference.md.
- docs: engine-re.md (op 0x03 section + backlog re-aimed),
  name-resolution.md #1 (SOLVED), script-inventory.md (call graph +
  living-reference decision), tools-reference.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vm-map/opcodes.toml

@@ -77,17 +77,36 @@ abi_source = "kelebek+decode-validated"
 
 [opcode.semantics]
 name = "call-script"
-category = "unknown"
-summary = ""
+category = "control"
+summary = "load & call another SYS4 script by id; id = RAW index into the SYS4INI file table (asset-index). Pushes a script frame; returns to caller when the callee ends."
 noop_headless = false
-source = "kelebek"
-confidence = "med"
+source = "investigation"
+confidence = "high"
 depends_on = []
-evidence = ""
+evidence = "native-RE (Ghidra): handler FUN_0041bc90 -> loader FUN_0040e980 -> resolver FUN_0044f390 indexes an 80-byte record table (base [ctx+0x414], count [ctx+0x40c]) at base+id*0x50 = the SYS4INI record layout {name[64],arc_id@0x40,file_number@0x44,offset@0x48,size@0x4c}. Confirmed statically: all 297 distinct corpus call-script ids resolve to a .BIN script with a semantically-exact name (0x1ab->ADDITEM, 0x2ae7->MES, 0x143->BUNKI, 0x329d->CALCREVISE), 0 out-of-range, 0 pack-branch. See docs/engine-re.md + name-resolution.md #1."
+confirm_by = ""
+details = """
+op 0x03 (call-script, argc 1): `call-script <id>`. RESOLVED — the id is a direct RAW index into
+the SYS4INI global file table (the same table parse_sys4ini.py reads, but indexed WITHOUT skipping
+'@' placeholders; SYS4INI has 13208 records / 2 placeholders). No separate on-disk id->code registry
+exists; SYS4INI *is* the call-script registry.
+Native mechanism (dispatch table `handler(op)=ctx[0x26c93+op]`, op 0x03 -> FUN_0041bc90):
+  1. FUN_0041bc90 fetches operand 1 (id), bounds-checks call depth (<=0x26), pushes a frame.
+  2. FUN_0040e980 (loader): opens the resource by id, reads the 0x20-byte SYS4 header, checks magic,
+     allocates per-frame code/local buffers from the header var-counts, reads the bytecode body,
+     pushes a script frame (stride 0x1e = 30 dwords, indexed by ctx[0x14f45]).
+  3. FUN_0044f390 (resolver): record = [ctx+0x414] + id*0x50. Tries a LOOSE OVERRIDE first
+     (CreateFileA on record.name -> mod/patch hook point), else opens archive [record.arc_id*0x100 +
+     ctx+0x410], SetFilePointer to record.offset, size = record.size.
+     (High-byte-tagged ids `id & 0xff000000` select an alternate pack via [ctx+0x3028]; UNUSED by the
+     corpus -- 0/297 ids have a high byte.)
+Companion op 0x8f `call` is INTRA-script (a local JSR), not cross-script -- see its entry.
+This also names the whole call graph statically (build/callscript-names.json).
+"""
 
 [[opcode.semantics.args]]
 i = 1
-role = ""
+role = "script id = raw SYS4INI file index"
 observed_types = ["imm", "g-int", "l-ptr"]
 
 [[opcode]]
@@ -1428,17 +1447,18 @@ abi_source = "kelebek+decode-validated"
 
 [opcode.semantics]
 name = "call"
-category = "unknown"
-summary = ""
+category = "control"
+summary = "intra-script subroutine call (local JSR): PC = frame.codebase + operand*4; pushes a return address on the per-frame return stack. NOT cross-script (that is call-script 0x03)."
 noop_headless = false
-source = "kelebek"
-confidence = "med"
+source = "investigation"
+confidence = "high"
 depends_on = []
-evidence = ""
+evidence = "native-RE (Ghidra): handler FUN_0041fba0 (= ctx[0x26c93+0x8f]) sets [frame PC @+0x53d2c] = [frame codebase @+0x53d28] + operand*4 and pushes ((pc-base)>>2)+3 onto the per-frame return stack ([ctx+0x552e8]/[ctx+0x55248]). Target is a code OFFSET within the current script (matches header table T3 tag 0x8F = local call targets), confirming it is a local JSR, not a script load."
+confirm_by = ""
 
 [[opcode.semantics.args]]
 i = 1
-role = ""
+role = "local code target (word offset within current script)"
 observed_types = ["imm", "g-int"]
 
 [[opcode]]