The system routines for archiving and unarchiving variables require the variable's name in OP1.  So you need to convert a VAT entry into a variable name.  Here's a routine that does that:
;; VATEntryToOP1:
;;
;; Copy a program, appvar, group, or list variable name from the VAT
;; to OP1.
;;
;; Input:
;; - HL = address of type byte of VAT entry
;;
;; Output:
;; - OP1 = variable name
;;
;; Destroys:
;; - AF, BC, DE, HL

VATEntryToOP1:
ex de,hl
BCALL _ZeroOP1
ld a,(de)
ld hl,-6
add hl,de
ld b,(hl)
inc b
ld de,OP1
VATEntryToOP1_CopyNameLoop:
ld (de),a
inc de
dec hl
ld a,(hl)
djnz VATEntryToOP1_CopyNameLoop
ld a,(OP1 + 1)
sub tVarLst
ret nz
dec de
ld (de),a
ret
After calling VATEntryToOP1, you can call Arc_Unarc (or one of the undocumented archiving/unarchiving routines, but those are somewhat tricky to use correctly and safely.)

Edit: Whoops, didn't see thepenguin77's reply.  Yeah, you should try to see if you can write the routine yourself.  Practice is good for you.

I don't think so.  I never heard of any USB documentation being released by TI; as far as I'm aware, everything we know about it was reverse-engineered by Dan and a few other clever people.

Actually, there is a port 14 on the TI-83 - it's the battery status port.

I'd love to know what the deal is with ports 0036, 003F, 00DF, and 00F2 (yes, the usage suggests that these are 16-bit I/O addresses), which were added to the early initialization code of later versions of the TI-83 and TI-82 STATS, as well as the TI-82 v19.006.

Also, I would suggest that, before you start trying to write to the Flash chip, you try something less potentially destructive, like reading the auto-select data.

There are many different versions of ti83plus.inc floating around out there.  Which two, specifically, did you try?

For TASM - and I assume this would also work for SPASM - you'd want to include something along these lines, at the top of the file:
#define bcall(x) rst 28h \ .dw x
#define bjump(x) call BRT_JUMP0 \ .dw x
#define equ .equ
#define EQU .equ

Back in the day, when I used TASM, I liked to add:
.addinstr B_CALL * EF 3 NOP 1
.addinstr B_JUMP * 0050CD 5 NOP 1
which lets you write "B_CALL _PutS", a little bit closer to TI's official syntax.  I don't remember if SPASM supports addinstr.

In addition, you probably need to comment out the macro definitions later in the file.

If you're using the official ti83plus.inc from TI, that file uses ZMASM syntax for macros and equates.  I don't think spasm supports that syntax, or at least, it didn't the last time I checked.

Also, the official syntax defined by TI is "B_CALL PutS", not "bcall(_PutS)", so if you're using the official ti83plus.inc, it doesn't surprise me that the latter doesn't work.

It might help if you could post a listing file.

It's true that memory addresses are different, but that's not the issue here, since we're talking about replacing the entire OS.

The most significant change between the 83 and 83+ is how the memory mapping is controlled.  The 83's hardware is based on the 82's, so it has a single port (port 2) that controls both the "bank A" and "bank B" memory mapping.  But since that only allows for 8 ROM pages, port 0 is used to switch between the lower and upper 128k of ROM.  In contrast, the 83+ has two separate ports (6 and 7) that independently control the mapping for banks A and B, and allow you to access all 32 pages of Flash.  So all of the code dealing with port 2 would need to be revised to use port 6 and/or 7.  (There actually isn't very much code you'd need to change.)

Second, the link port works differently; both models use port 0 to read and write the link port, but different input and output values are used.

Third, where the 83 reads port 3 to check the status of the ON key and interrupts, on the 83+ you need to use port 4 instead.  I think the bits are the same, and writing to port 3 works the same way (writing to port 4 does something completely unrelated.)

Fourth, the 83+ prevents execution on RAM page zero by default; you'd probably want to turn this protection off in order to run TI-83 assembly programs.  On an 83+ SE or 84+, this protection can't be disabled, but you could use RAM page 3 instead.

And finally, you'd need to make some small tweaks just to get the OS to boot, since 83+ OSes must contain a magic number at 0056h, and the boot code hands control to the OS at address 0053h.

That's great to hear.  WikiTI is a great resource already, but there's so much more stuff that could be documented.  It's a shame that it's been inactive lately.  I'll try to do my part.

Interesting.  So it is documented, in a way.

I'm not sure, but I think I've seen situations where some part of the archive gets so broken that neither resetting "Vars" nor "Apps" will work, and the only way to recover is to reset "Both" or "All Memory".  I've never had "All Memory" fail to work, but if it does, there's always the option of a boot mode self test, which resets everything except the certificate, or you could try flashing PongOS and erasing everything by hand.