enforce integer division via explicit builtins

LANGUAGE.md

@@ -39,8 +39,8 @@ roadmap and milestone history.
 
 ### expressions and control flow
 
-- checked integer `+ - * /`, unary `-`, divide-by-zero traps, IEEE float arithmetic, comparisons, `!`, `and`, and `or`
-- assignments and compound assignments `+= -= *= /=` with single evaluation of complex lvalues
+- checked integer `+ - *`, unary `-`, float-only `/`, IEEE float arithmetic, comparisons, `!`, `and`, and `or`
+- assignments and compound assignments `+= -= *= /=` with single evaluation of complex lvalues; `/=` is float-only
 - field access through struct values and pointers, index/slice bounds contextually coerced to `usize`, and unsigned narrower index support
 - boolean `if` / `else if` / `else`, braceless single-statement branches, and optional parenthesized conditions
 - `while` loops with optional post-iteration update clauses
@@ -52,6 +52,50 @@ roadmap and milestone history.
 - fallible `try`, fallback `catch`, and `catch |e| { ... }` handler blocks
 - direct `return match ...` and `yield match ...` value-control-flow operands
 
+#### division
+
+`/` and `/=` accept only floating-point operands. Integer division must state its rounding and
+remainder convention with one of these unqualified builtins:
+
+| Builtin | Result |
+| --- | --- |
+| `div_trunc(a, b)` | quotient rounded toward zero |
+| `div_floor(a, b)` | quotient rounded toward negative infinity |
+| `div_exact(a, b)` | truncated quotient; traps unless it divides exactly |
+| `div_ceil(a, b)` | quotient rounded toward positive infinity |
+| `rem(a, b)` | remainder paired with `div_trunc`; sign follows `a` |
+| `mod(a, b)` | modulus paired with `div_floor`; sign follows `b` |
+
+The operands may be compatible concrete integer or float scalars. Existing literal coercion and
+numeric widening rules apply, the result has the common operand type, and float quotients are
+integral-valued floats. These identities hold when representable:
+
+```bro
+div_trunc(a, b) * b + rem(a, b) == a
+div_floor(a, b) * b + mod(a, b) == a
+```
+
+Negative operands distinguish the operations:
+
+```bro
+div_trunc(-5, 3) == -1
+div_floor(-5, 3) == -2
+div_ceil(-5, 3) == -1
+rem(-5, 3) == -2
+mod(-5, 3) == 1
+mod(5, -3) == -1
+```
+
+All six builtins diagnose a zero denominator at comptime and trap at runtime, including float
+zero. Quotient operations also trap for signed `min_value(T), -1`; `rem` and `mod` return zero for
+that pair. `div_exact` traps when `div_trunc(a, b) * b == a` is false in the operand type, so float
+exactness follows floating-point equality. Other float NaN and infinity behavior follows the
+underlying IEEE operations. Ordinary float `/` remains unchecked and therefore preserves IEEE
+infinity/NaN behavior.
+
+The six spellings are reserved only as direct unqualified calls. A qualified call such as
+`math.div_floor(a, b)` resolves to an ordinary package function.
+
 ### functions, C interop, and linking
 
 - demand-monomorphized Brolang and C-ABI functions