2 files changed, 69 insertions, 0 deletions
diff --git a/doc/language/function/cpsc-function-free.7.md b/doc/language/function/cpsc-function-free.7.md
new file mode 100644
index 0000000..298199d
--- /dev/null
+++ b/doc/language/function/cpsc-function-free.7.md
@@ -0,0 +1,32 @@
+% CPSC-FUNCTION-FREE(7)
+
+# NAME
+
+cpsc-function-free - release an explicit memory allocation
+
+# SYNOPSIS
+
+```text
+FREE(pointer)
+```
+
+# DESCRIPTION
+
+FREE is a compiler extension. Its argument and return type are C void*. Explicitly cast other pointer types to a void* alias before passing them. A null pointer is accepted and returned. A non-null pointer must be the start of an active explicit MALLOC allocation; internal STRING/ARRAY storage, stack addresses, interior addresses and already released allocations are rejected with a source-line diagnostic on stdout and an anonymous exception.
+
+FREE returns its input address after releasing the allocation. It does not clear the caller's variable. The returned address and all aliases are invalid for memory access. Calling FREE again on that address throws unless a subsequent allocation has reused the address. Tracking cannot distinguish stale aliases once an address is reused.
+
+The result can be discarded with a standalone call. No user destructor is called.
+
+# EXAMPLE
+
+```text
+TYPE Raw = C_TYPE("void*")
+DECLARE Memory : Raw
+Memory <- MALLOC(8)
+FREE(Memory)
+```
+
+# SEE ALSO
+
+[cpsc-function-malloc(7)](cpsc-function-malloc.7.md), [cpsc-keyword-function(7)](../keyword/cpsc-keyword-function.7.md), [cpsc-keyword-try(7)](../keyword/cpsc-keyword-try.7.md).
diff --git a/doc/language/function/cpsc-function-malloc.7.md b/doc/language/function/cpsc-function-malloc.7.md
new file mode 100644
index 0000000..742367c
--- /dev/null
+++ b/doc/language/function/cpsc-function-malloc.7.md
@@ -0,0 +1,37 @@
+% CPSC-FUNCTION-MALLOC(7)
+
+# NAME
+
+cpsc-function-malloc - allocate uninitialized raw memory
+
+# SYNOPSIS
+
+```text
+MALLOC(bytes)
+```
+
+# DESCRIPTION
+
+MALLOC is a compiler extension returning a C void* to the beginning of an uninitialized allocation. The size is in bytes and accepts INTEGER or a C integer, converted to the host size_t using C integer conversion rules. Negative values are not separately rejected. MALLOC(0) returns null without allocating. A nonzero allocation failure prints the source line and reason to stdout, then throws an anonymous exception catchable with TRY/CATCH. Allocation tracking failures behave the same way.
+
+Declare a void* alias with C_TYPE and explicitly cast the result to a C or pseudocode pointer before dereferencing. MALLOC does not initialize fields or call constructors; it is unrelated to the CIE class NEW construct. The caller must supply enough bytes and initialize values before reading them. User memory is not automatically released.
+
+Only allocations from explicit memory builtins are tracked. Internal STRING and ARRAY buffers remain outside this ownership system. Tracking validates FREE addresses, not memory accesses, bounds or stale aliases after address reuse.
+
+# EXAMPLE
+
+```text
+TYPE Raw = C_TYPE("void*")
+TYPE IntPointer = ^INTEGER
+DECLARE Memory : Raw
+DECLARE Pointer : IntPointer
+Memory <- MALLOC(8)
+Pointer <- (IntPointer)Memory
+Pointer^ <- 42
+OUTPUT Pointer^
+FREE(Memory)
+```
+
+# SEE ALSO
+
+[cpsc-function-free(7)](cpsc-function-free.7.md), [cpsc-keyword-c_type(7)](../keyword/cpsc-keyword-c_type.7.md), [cpsc-keyword-try(7)](../keyword/cpsc-keyword-try.7.md).