docs(memory): describe standard-library allocation and explicit imports

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

7 files changed, 24 insertions, 11 deletions

diff --git a/doc/cpsc.1.md b/doc/cpsc.1.md
index caa829c..e0e92e0 100644
--- a/doc/cpsc.1.md
+++ b/doc/cpsc.1.md
@@ -20,7 +20,7 @@ Each input is a compilation unit. Use top-level `INCLUDE "lib.cps"` to import an
 
 Exactly one file may contain top-level executable statements (including top-level DECLARE). Alternatively, define a parameterless `FUNCTION MAIN RETURNS INTEGER` in one file and have no top-level executable statements anywhere. Builds containing only definitions and no MAIN fail with `error: no main program`. GLOBAL blocks declare shared primitive variables. INCLUDE, GLOBAL and MAIN entry points are compiler extensions beyond the Cambridge guide.
 
-The embedded standard library is loaded and linked automatically. Its std.cps imports string.cps, which defines the STRING class and ordinary string functions. No extra files are needed for default compilation. With **-no-std**, supply any required library inputs explicitly; ordinary string literals require a visible STRING class. A literal with an adjacent uppercase C suffix, such as `"hello"C`, has type C_STRING and does not require that class.
+The embedded standard library is loaded and linked automatically. Its std.cps imports string.cps, which defines the STRING class and ordinary string functions, and memory.cps, which provides MALLOC/REALLOC/FREE and the allocation runtime used by keyword NEW/DELETE. No extra files are needed for default compilation. With **-no-std**, supply any required library inputs explicitly; ordinary string literals require a visible STRING class, and keyword NEW/DELETE require memory.cps. A literal with an adjacent uppercase C suffix, such as `"hello"C`, has type C_STRING and does not require that class.
 
 # OPTIONS
 
@@ -31,7 +31,7 @@ The embedded standard library is loaded and linked automatically. Its std.cps im
 :   Save to the specified path. Without **-S**, save a native executable; with **-S**, save LLVM IR. Use the path exactly as given; its extension does not select the output format. May be specified only once. With **-r**, keep this file even if execution fails.
 
 **-S**
-:   Save textual LLVM IR instead of a native executable. Without **-o**, use the entry source filename with a `.ll` extension beside the source file. May be combined with **-r** to save IR and run the program. Manually linking saved IR that uses the standard library requires the matching string.o and C++ runtime; native output and **-r** supply them automatically.
+:   Save textual LLVM IR instead of a native executable. Without **-o**, use the entry source filename with a `.ll` extension beside the source file. May be combined with **-r** to save IR and run the program. Manually linking saved IR that uses the standard library requires the matching string.o, memory.o and C++ runtime; native output and **-r** supply them automatically.
 
 **-r**
 :   Run the compiled program with the runner selected at build time (see EXECUTION MODES). Save output first when **-S** or **-o** is also present; otherwise do not save a file. The program inherits stdin, stdout and stderr; `INPUT` can read terminal or piped input.
diff --git a/doc/language/cpsc-language-overview.7.md b/doc/language/cpsc-language-overview.7.md
index fcdb4b5..2c2019c 100644
--- a/doc/language/cpsc-language-overview.7.md
+++ b/doc/language/cpsc-language-overview.7.md
@@ -80,14 +80,19 @@ These ordinary functions and the STRING class come from the embedded standard li
 - [cpsc-function-num_to_str(7)](function/cpsc-function-num_to_str.7.md): convert a number to text.
 - [cpsc-function-str_to_num(7)](function/cpsc-function-str_to_num.7.md): convert text to a real number.
 
-# BUILT-IN FUNCTIONS
+# MEMORY LIBRARY FUNCTIONS
+
+These ordinary extension functions come from memory.cps, imported by std.cps automatically. Keyword NEW/DELETE use the same allocation runtime. With **-no-std**, import and supply memory.cps explicitly.
 
-- [cpsc-function-eof(7)](function/cpsc-function-eof.7.md): test for the end of a text file.
-- [cpsc-function-int(7)](function/cpsc-function-int.7.md): take the integer part of a number.
 - [cpsc-function-malloc(7)](function/cpsc-function-malloc.7.md): allocate raw memory.
 - [cpsc-function-realloc(7)](function/cpsc-function-realloc.7.md): resize an explicit allocation.
 - [cpsc-function-free(7)](function/cpsc-function-free.7.md): release an explicit allocation.
 
+# BUILT-IN FUNCTIONS
+
+- [cpsc-function-eof(7)](function/cpsc-function-eof.7.md): test for the end of a text file.
+- [cpsc-function-int(7)](function/cpsc-function-int.7.md): take the integer part of a number.
+
 # UNSUPPORTED FEATURES
 
 DATE, SET types and DEFINE, random-file operations (RANDOM/SEEK/GETRECORD/PUTRECORD), INT, RAND, whole-array assignment or return, array fields, and class inheritance (INHERITS/SUPER).
diff --git a/doc/language/function/cpsc-function-free.7.md b/doc/language/function/cpsc-function-free.7.md
index 366b317..ef4b72e 100644
--- a/doc/language/function/cpsc-function-free.7.md
+++ b/doc/language/function/cpsc-function-free.7.md
@@ -12,12 +12,14 @@ FREE(pointer)
 
 # DESCRIPTION
 
-FREE is a compiler extension. Its argument and return type are C `void*`. Explicitly cast other pointer types to a `void*` alias before passing them. A null pointer is accepted and returned. A non-null pointer must be the start of an active explicit MALLOC, REALLOC or keyword NEW allocation; internal STRING/ARRAY storage, stack addresses, interior addresses and already released allocations are rejected with a source-line diagnostic on stderr and an anonymous exception.
+FREE is an extension provided by the memory.cps standard-library unit. Its argument and return type are C `void*`. Explicitly cast other pointer types to a `void*` alias before passing them. A null pointer is accepted and returned. A non-null pointer must be the start of an active explicit MALLOC, REALLOC or keyword NEW allocation; internal STRING/ARRAY storage, stack addresses, interior addresses and already released allocations are rejected with a source-line diagnostic on stderr and an anonymous exception.
 
 FREE returns its input address after releasing the allocation. It does not clear the caller's variable. The returned address and all aliases are invalid for memory access. Calling FREE again on that address throws unless a subsequent allocation has reused the address. Tracking cannot distinguish stale aliases once an address is reused.
 
 The result can be discarded with a standalone call. No user destructor is called. Use keyword DELETE on a class object to destroy it and its fields before releasing its allocation.
 
+The default std.cps imports memory.cps automatically. With **-no-std**, explicitly INCLUDE memory.cps and pass it as a compiler input; its INCLUDE_OBJ links memory.o for native output and execution. Manual linking of saved IR requires the matching library objects and C++ runtime.
+
 # EXAMPLE
 
 ```text
diff --git a/doc/language/function/cpsc-function-malloc.7.md b/doc/language/function/cpsc-function-malloc.7.md
index 077e17f..6a2c272 100644
--- a/doc/language/function/cpsc-function-malloc.7.md
+++ b/doc/language/function/cpsc-function-malloc.7.md
@@ -12,12 +12,14 @@ MALLOC(bytes)
 
 # DESCRIPTION
 
-MALLOC is a compiler extension returning a C `void*` to the beginning of an uninitialized allocation. The size is in bytes and accepts INTEGER or a C integer, converted to the host size_t using C integer conversion rules. Negative values are not separately rejected. MALLOC(0) returns null without allocating. A nonzero allocation failure prints the source line and reason to stderr, then throws an anonymous exception catchable with TRY/CATCH. Allocation tracking failures behave the same way.
+MALLOC is an extension provided by the memory.cps standard-library unit returning a C `void*` to the beginning of an uninitialized allocation. The size is in bytes and accepts INTEGER or a C integer, converted to the host size_t using C integer conversion rules. Negative values are not separately rejected. MALLOC(0) returns null without allocating. A nonzero allocation failure prints the source line and reason to stderr, then throws an anonymous exception catchable with TRY/CATCH. Allocation tracking failures behave the same way.
 
 Declare a `void*` alias with C_TYPE and explicitly cast the result to a C or pseudocode pointer before dereferencing. MALLOC does not initialize fields or call constructors. Keyword NEW uses the same tracked allocation path, then initializes and constructs the class object. The caller of MALLOC must supply enough bytes and initialize values before reading them. User memory is not automatically released.
 
 Explicit MALLOC/REALLOC and keyword NEW allocations are tracked. Internal STRING and ARRAY buffers remain outside this ownership system. Tracking validates FREE, REALLOC and keyword DELETE addresses, not memory accesses, bounds or stale aliases after address reuse.
 
+The default std.cps imports memory.cps automatically. With **-no-std**, explicitly INCLUDE memory.cps and pass it as a compiler input; its INCLUDE_OBJ links memory.o for native output and execution. Manual linking of saved IR requires the matching library objects and C++ runtime.
+
 # EXAMPLE
 
 ```text
diff --git a/doc/language/function/cpsc-function-realloc.7.md b/doc/language/function/cpsc-function-realloc.7.md
index 7b29c45..03c5bef 100644
--- a/doc/language/function/cpsc-function-realloc.7.md
+++ b/doc/language/function/cpsc-function-realloc.7.md
@@ -12,7 +12,7 @@ REALLOC(pointer, bytes)
 
 # DESCRIPTION
 
-REALLOC is a compiler extension returning C `void*`. The pointer argument must also be C `void*`; explicitly cast other pointer types. The size accepts INTEGER or a C integer and converts to host size_t, just as MALLOC does.
+REALLOC is an extension provided by the memory.cps standard-library unit returning C `void*`. The pointer argument must also be C `void*`; explicitly cast other pointer types. The size accepts INTEGER or a C integer and converts to host size_t, just as MALLOC does.
 
 A null pointer behaves as MALLOC(bytes). A non-null pointer must start an active tracked MALLOC, REALLOC or keyword NEW allocation, even when bytes is zero. Invalid addresses print the source line and reason to stderr and throw an anonymous exception before touching the memory or allocation record. Resizing or releasing memory with REALLOC does not invoke constructors or destructors.
 
@@ -20,6 +20,8 @@ For a valid pointer and zero bytes, REALLOC releases the block and returns null.
 
 On nonzero allocation failure, REALLOC prints the source line and reason and throws an anonymous exception. The original allocation and its tracking record remain valid. In `p <- REALLOC(p, bytes)`, assignment occurs only on success, so a CATCH handler can still use or release the old p. A successful resize updates the existing record without allocating a new tracking node. Internal STRING/ARRAY buffers cannot be resized with this function.
 
+The default std.cps imports memory.cps automatically. With **-no-std**, explicitly INCLUDE memory.cps and pass it as a compiler input; its INCLUDE_OBJ links memory.o for native output and execution. Manual linking of saved IR requires the matching library objects and C++ runtime.
+
 # EXAMPLE
 
 ```text
diff --git a/doc/language/keyword/cpsc-keyword-class.7.md b/doc/language/keyword/cpsc-keyword-class.7.md
index dffd4a1..2a713c0 100644
--- a/doc/language/keyword/cpsc-keyword-class.7.md
+++ b/doc/language/keyword/cpsc-keyword-class.7.md
@@ -42,7 +42,7 @@ A constructor is a PROCEDURE named NEW, following guide section 10.2. It may be
 
 An `OVERLOAD PROCEDURE NEW(BYREF Other : ClassName)` defines a copy constructor. BYVAL class lvalue arguments and RETURN of class lvalues invoke it; a same-class BYVAL constructor is rejected. Classes without one retain bitwise copying for fields without STRING ownership. Records and BYVAL arrays recursively clone STRING-bearing fields or elements. Other owning class fields retain the existing shallow-copy limitations. Class results transfer ownership directly into BYVAL arguments, RETURN and ordinary assignment without an assignment overload. Discarded results and temporary receivers live until the statement ends, including exception exits. Ordinary user BYREF calls still require bare variables; constructor calls can bind temporaries.
 
-The keyword NEW is allowed only as the complete right side of assignment: `Target <- NEW ClassName`, `Target <- NEW ClassName()` or `Target <- NEW ClassName(arguments)`. Target must have exactly the named class type. NEW uses the checked MALLOC allocation path, zeroes storage and constructs fields before calling NEW. A method-only class receives at least one byte of heap storage so its object address is non-null. Allocation failure reports a runtime error and throws; constructor exceptions also propagate to TRY/CATCH. Private constructor access and argument checks follow ordinary member-call rules.
+The keyword NEW is allowed only as the complete right side of assignment: `Target <- NEW ClassName`, `Target <- NEW ClassName()` or `Target <- NEW ClassName(arguments)`. Target must have exactly the named class type. NEW requires the memory.cps standard-library unit, imported by default; with **-no-std**, import and supply it explicitly. NEW uses the checked MALLOC allocation path, zeroes storage and constructs fields before calling NEW. A method-only class receives at least one byte of heap storage so its object address is non-null. Allocation failure reports a runtime error and throws; constructor exceptions also propagate to TRY/CATCH. Private constructor access and argument checks follow ordinary member-call rules.
 
 When Target is a declared class variable, including a function local or BYVAL parameter, NEW rebinds that variable to the heap object. No `^` dereference is needed to access it. Address-of, BYREF calls and method calls use its current object. Pointers taken before rebinding continue to refer to the previous object. Ordinary `A <- B` assigns into A's current object without rebinding A: it calls a matching member OPERATOR<- when defined, otherwise it copies the same-class value. See [cpsc-keyword-operator(7)](cpsc-keyword-operator.7.md). BYVAL parameters own their copied or transferred value and can rebind independently.
 
diff --git a/doc/language/keyword/cpsc-keyword-delete.7.md b/doc/language/keyword/cpsc-keyword-delete.7.md
index a45d5fa..c9165cc 100644
--- a/doc/language/keyword/cpsc-keyword-delete.7.md
+++ b/doc/language/keyword/cpsc-keyword-delete.7.md
@@ -26,9 +26,11 @@ Destructors, keyword DELETE and automatic destruction are compiler extensions; t
 
 An explicit `Object.DELETE()`, `CALL Object.DELETE()` or `this.DELETE()` is an ordinary method call. It calls only the method, without automatically destroying fields or releasing memory. It does not end the object's automatic lifetime.
 
-The statement `DELETE Object` requires an addressable class object. It first checks that the address is the start of an active tracked heap allocation, including allocations created by keyword NEW. Stack objects, internal array storage, interior addresses and previously released allocations fail with a source-line runtime diagnostic and an anonymous exception before any destructor runs. Address reuse can make a stale alias indistinguishable from a current allocation.
+The statement `DELETE Object` requires an addressable class object and the memory.cps standard-library unit. It first checks that the address is the start of an active tracked heap allocation, including allocations created by keyword NEW. Stack objects, internal array storage, interior addresses and previously released allocations fail with a source-line runtime diagnostic and an anonymous exception before any destructor runs. Address reuse can make a stale alias indistinguishable from a current allocation.
 
-After validation, DELETE calls the object's DELETE method if present, then recursively destroys its class-valued fields in reverse declaration order, including through record fields, and releases the allocation through FREE. The variable and all aliases remain dangling. If destruction throws, memory release is not reached. Heap objects are never automatically destroyed.
+Keyword DELETE uses memory.cps, imported by default; with **-no-std**, import and supply it explicitly. Ordinary DELETE method calls and automatic destruction do not require the memory library.
+
+After validation, DELETE calls the object's DELETE method if present, then recursively destroys its class-valued fields in reverse declaration order, including through record fields, and releases the allocation through the same memory-library runtime as FREE. The variable and all aliases remain dangling. If destruction throws, memory release is not reached. Heap objects are never automatically destroyed.
 
 Automatic destruction (RAII) applies to original storage created by DECLARE, including main-level declarations, arrays and records containing class values, and to BYVAL copies containing class values. Destruction occurs in reverse declaration order on RETURN, at the end of a function or procedure, and at normal program end. Array elements are destroyed in reverse flat element order. Block exit alone does not destroy these function-scoped lifetimes. A declaration executed again first destroys its previous live incarnation, then zeroes and constructs the original storage again.