Implement startup string and block copy opcodes

docs/engine-re.md

@@ -2197,11 +2197,33 @@ It is therefore an equality predicate, not a string assignment. The release corp
 conditional branches; `GAMESTART@0x134c` compares `INPUTNAME` with `"?"`, while INIT2 also compares
 `INPUTNAME` with an empty string during default-name initialization.
 
-`op_0x1b0_copy_dwords@0x427060` fetches operand 3 as a cell count, resolves operands 1 and 2 as source and
-destination pointers, and calls `memcpy(destination, source, count * 4)`. The capture reached it three times
-inside `UNITECH`/`CALCCC`, immediately after opcode `0x63`. The copy itself is proven; the pointer-producing
-semantics of `0x63` remain unresolved, so the pair should be implemented only after that companion handler
-is understood.
+The port now executes `0x194` through the common string resolver and ordinal equality, so every operand
+form accepted by that resolver shares one contract: inline literal, global string, local string, global
+string pointer, and local string pointer. Focused tests cover equality and inequality across those forms
+plus the release GAMESTART compare-then-`jcc` shape. The full traced SYSTEM4-to-SC0000 regression reaches
+GAMESTART without emitting a `0x194` fallback.
+
+`op_0x63_take_address@0x426ac0` is the companion address operation. It passes operand 2 and unsubscripted
+indices `-1/-1` to `vm_operand_resolve_address@0x425a50`, then stores the returned address in operand 1
+through `vm_pointer_operand_write@0x416090`. The resolver returns the backing-cell address for direct
+global/local integer or string operands; for pointer operands it returns the target already held by the
+pointer, not the address of the pointer slot. Thus `0x63(dst_ptr, source)` is typed address aliasing. All 92
+release-corpus sites use a local integer-pointer destination; sources are local pointers 81 times, local
+integers seven times, and global integers four times.
+
+`op_0x1b0_copy_dwords@0x427060` fetches operand 3 as a cell count, resolves addressable operands 1 and 2 as
+source and destination, and calls `memcpy(destination, source, count * 4)`. The corpus has 65 calls: direct
+global/local spans as well as local pointers, with 43 immediately preceded by `0x63`. The boot capture
+reached the pair in `UNITECH`/`CALCCC`; those scripts use it to copy record-shaped arrays between per-entity
+tables and working buffers.
+
+The port now maps both operations onto its domain-preserving `VmAddress` model. Direct local/global cells
+retain their bank, aliasing an existing pointer retains its target bank, and `0x1b0` copies consecutive
+32-bit integer cells through the resolved endpoints. Focused tests cover local-to-global, global-to-local,
+an alias of a `lookup-array` result, direct spans, and the native string-pointer destination form of
+`0x63`. The step-traced SYSTEM4-to-SC0000 regression reaches both operations without fallback. Static
+coverage is consequently 31/31 handled for UNITECH and 14/15 for CALCCC; CALCCC's only remaining gap is
+the deliberately deferred shared-profile write `0x1a2`.
 
 ---
 

docs/opcode-reference.md

@@ -186,6 +186,11 @@
 
 Operand 2 names the base cell itself: a global-bank operand produces a global reference and a local-bank operand produces a local reference. Operand 3 is added as the element offset. Pointer destinations retain that address domain; reading or writing the pointer dereferences the corresponding bank. Non-pointer destinations receive the addressed value. The same domain-preserving address model applies to lookup-array-2d (0x12c).
 
+### 0x63 `take-address` (take-address, argc 2)
+- **summary:** (destination_pointer)(source) - store the underlying typed storage address of source in destination_pointer; a pointer source aliases its existing target.
+- **grounding:** source=investigation, confidence=high
+- **evidence:** Ghidra /v2 op_0x63_take_address@0x426ac0 calls vm_operand_resolve_address@0x425a50 for operand 2 with unsubscripted indices -1/-1, then vm_pointer_operand_write@0x416090 for operand 1. The resolver returns a backing-cell address for direct global/local integer or string operands and the already-stored target for pointer operands. Corpus: 92 calls; destination is always local-ptr, while sources are local-ptr x81, local-int x7, and global-int x4. The C# VM preserves the local/global address domain and supports the native string-pointer destination forms; the traced natural boot reaches the UNITECH/CALCCC pair without fallback.
+
 ### 0x64 `copy-inline-int-array` (copy-inline-int-array, argc 2)
 - **summary:** (destination)(inline_blob_offset) - decode the count-prefixed integer literal blob at codebase + offset*4 and copy its values to consecutive VM integer cells beginning at destination.
 - **grounding:** source=investigation, confidence=high
@@ -209,12 +214,12 @@ Operand 2 names the base cell itself: a global-bank operand produces a global re
 ### 0x194 `string-equals` (string-equals, argc 3)
 - **summary:** (out)(left)(right) - compare two complete SYS4 strings and write 1 when equal, otherwise 0.
 - **grounding:** source=investigation, confidence=high
-- **evidence:** Ghidra /v2 op_0x194_string_equals@0x426e20 fetches operands 2 and 3 through the string resolver, compares their byte ranges through FUN_004017a0, and writes compare_result==0 to integer operand 1. INIT2 and GAMESTART use it as a branch predicate for INPUTNAME/default-name handling; the natural Game Start diagnostic reached one GAMESTART call at 0x134c.
+- **evidence:** Ghidra /v2 op_0x194_string_equals@0x426e20 fetches operands 2 and 3 through the string resolver, compares their byte ranges through FUN_004017a0, and writes compare_result==0 to integer operand 1. INIT2 and GAMESTART use it as a branch predicate for INPUTNAME/default-name handling; the natural Game Start diagnostic reached one GAMESTART call at 0x134c. The C# VM implements ordinal equality through the shared string resolver, covering literal, global, local, global-string-pointer, and local-string-pointer operands; the traced natural-boot regression proves the reached GAMESTART call no longer falls back.
 
 ### 0x1b0 `copy-dwords` (copy-dwords, argc 3)
 - **summary:** (source)(destination)(count) - copy count consecutive 32-bit cells from source to destination.
 - **grounding:** source=investigation, confidence=high
-- **evidence:** Ghidra /v2 op_0x1b0_copy_dwords@0x427060 fetches operand 3, resolves pointer operands 1 and 2, and calls memcpy(destination, source, count*4). The natural Game Start diagnostic reached it three times in UNITECH/CALCCC initialization, paired with unresolved pointer-preparation opcode 0x63.
+- **evidence:** Ghidra /v2 op_0x1b0_copy_dwords@0x427060 fetches operand 3, resolves addressable operands 1 and 2 through vm_operand_resolve_address@0x425a50, and calls memcpy(destination, source, count*4). Corpus: 65 calls across direct global/local spans and local pointers; 43 are immediately preceded by take-address 0x63. The C# VM copies resolved integer-cell spans while retaining local/global address domains; focused tests cover direct spans and aliased pointers, and the traced natural boot reaches the UNITECH/CALCCC pair without fallback.
 
 ## control
 
@@ -918,10 +923,6 @@ op 0x90 (u0041BEB0, argc 7): `0x90 x y w h tgt_a tgt_b tgt_c`. Kelebek left it "
 - **summary:** —
 - **grounding:** source=kelebek, confidence=med
 
-### 0x63 `u00414A60` (u00414A60, argc 2)
-- **summary:** —
-- **grounding:** source=kelebek, confidence=low
-
 ### 0x6e `show-text` (show-text, argc 2)
 - **summary:** —
 - **grounding:** source=kelebek, confidence=med

docs/phase-b-framework.md

@@ -272,10 +272,17 @@ The 137 fallback events are not a single boot blocker. Most are declaration/stat
 proven safe, or deliberately deferred profile/read-text operations (`0x1a2`, `0x1a3`, `0x1cb`). The reached
 effectful unknowns divide into SYSTEM4 layout setup and unit-data initialization. Native follow-up identifies
 `0x194` as a string-equality predicate reached in `INIT2` and `GAMESTART`, and `0x1b0` as a dword-block copy
-paired with still-unresolved pointer-preparation opcode `0x63` in `UNITECH`/`CALCCC`. This makes `0x194` the
-smallest directly boot-relevant implementation slice; the `0x63`/`0x1b0` pair is the larger subsequent
-backend-data slice. Closing Godot currently releases a parked ADV wait before process teardown, so the page
-map may contain one trailing shutdown-only page; the final timeline `input-wait` is the authoritative stop.
+paired with still-unresolved pointer-preparation opcode `0x63` in `UNITECH`/`CALCCC`. `0x194` is now
+implemented for every supported SYS4 string operand form, with focused equality/inequality and
+compare-then-branch regressions. A step-traced natural-boot test reaches SC0000 without a `0x194` fallback;
+static coverage now reports 10/12 INIT2 opcodes and 44/47 GAMESTART opcodes handled, with the remaining
+GAMESTART profile operations still deliberately deferred. The reached `0x63`/`0x1b0` unit-data pair is
+also implemented: native `0x63` aliases a typed backing-cell address into a pointer, while `0x1b0` copies a
+counted dword span through direct or pointer endpoints. The traced natural boot reaches both without
+fallback; UNITECH is now 31/31 handled and CALCCC 14/15, with only deferred profile op `0x1a2` remaining.
+The next reached effectful cluster to investigate is SYSTEM4's paired `0x79`/`0x1c1` setup. Closing Godot
+currently releases a parked ADV wait before process teardown, so the page map may contain one trailing
+shutdown-only page; the final timeline `input-wait` is the authoritative stop.
 
 ## Stage B2 — Faithful full boot