- MapBackend enum (Anonymous/FileBacked) in memory_set.rs
- MapArea gains backend field, defaults to Anonymous
- mmap_register() / munmap() on MemorySet
- handle_page_fault: FileBacked branch reads from inode
- sys_mmap / sys_munmap in syscall/process.rs
- PCB gains mmap_base field
- syscall args extended to [usize; 6]
- Remove write_volatile debug markers from vendor polyhal change()
- Fix user/src/linker-riscv64.ld (was broken symlink text)
Known issue: kernel hangs after page table switch — low VA kernel code not mapped in user page table after restore() zeros entries[0..0x100]. Need to investigate high-VA kernel mapping.