$ money-float: rates carried as exact nano-units end to end, converted once at the config intake; a non-whole-nano rate is refused, never rounded (#81, OWNER rule 21)

[MattJackson]

What

Rates on the money path are carried as exact integer nano-units end to end. Each configured rate is converted once, at the config intake. A rate that is not a whole number of nano-units is REFUSED at config time and never rounded.

• Intake. RateEntryCfg::raw_tier_rates (crates/busbar-kernel/src/config/sections.rs) converts each configured _utok rate once, through the ledger's representable_nano_rate. Nothing after it carries a float.
• Shapes. RawTierRates (contract) and TierRates (ledger) hold Option<u64> nano-units per token. None means a rate the card cannot hold, and it refuses (Per-user provider credentials: using a seat subscription from your own apps #42).
  • Default is every tier at Some(0). That is the free tier 1.5.5's #[serde(default)] gave.
• Card. RateCard::from_config and place_rate take integers. from_micro_rates converts only through representable_nano_rate. RateNanos::from_raw copies integers; it is no longer a second conversion outside the intake table.
• nano_rate. It multiplies by 1000 exactly, on the configured decimal's own digits (the shortest round-trip text of the double, never a binary product). A rate with any digit past the third decimal of micro-units converts to 0 / None. Its ceiling is a checked integer multiply.
• Boot validation. It refuses a None rate and names the model, class and value. The message now says that a non-zero rate is a whole number of nano-units (at most three decimals) and is never rounded.
• Routing scalar. RawTierRates::blended_per_mtok is removed. rate_entry_per_mtok is a routing order (cheapest and the hook cost_per_mtok), not money. It reads the config figures exactly as 1.5.5 did (crates/busbar/src/config/mod.rs:2137 @v1.5.5).
• Docs. docs/configuration.md states the rule for operators.

Why

• Part 2 mcp: SSE on the POST, notifications/message, binary resources, resolving templates and typed prompt content #81 (BUSBAR-1.6.0.md l.2282): no f32/f64 on any money path.
• OWNER rule 21 (2026-10-14): "money is bank auditor grade. its either right or its wrong. make it right." / "money - ledger * ratecard". A rate that cannot be represented exactly is a loud config refusal.
• The row-159 xtask E audit found:
  • float carriers: RawTierRates, TierRates and RawRates, across cost.rs, rate_apply.rs, billing.rs, kernel-ledger cost/mod.rs and root/kernel.rs;
  • a float conversion at cost.rs:117, outside the intake table.

Against 1.5.5

• Same: every rate that is a whole number of nano-units (at most three decimals of micro-units) converts to exactly 1.5.5's integer ((utok*1000.0).round(), crates/busbar/src/cost.rs:99 @v1.5.5). The busbar-oracle money fixtures configure only whole rates (0, 1, 1e5, 2e5, 1e6, 2e6, 1e7, 2e7), so every golden cell is unchanged.
• Changed (rule 21): a rate 1.5.5 rounded (0.0015, 0.5005) is now refused at boot / --validate. It is never rounded.

REDs ($)

• nano_rate_refuses_a_rate_that_is_not_a_whole_number_of_nano_units: 0.0015, 0.0014, 0.0005, 0.5005, 0.5015, 1.0001 and the double 0.1 + 0.2 are refused (0 / None). Whole-nano rates convert exactly.
• rate_nanos_from_cfg_refuses_a_rate_finer_than_one_nano_unit: the intake refuses 0.0015 and 0.0014.
• test_validate_rate_card_refuses_a_rate_the_card_cannot_hold: 0.0005, 0.0015 and 0.5005 refuse boot and name the model, class and value. 0.001 boots.
• a_fractional_cent_rate_prices_exactly_through_the_live_intake: rates of 0.1 and 0.2 price one token of each at exactly 300 nano-units. The drifted double 0.30000000000000004 is refused.
• a_large_count_times_a_rate_has_no_float_drift: 2^53+1 tokens × 300 nano-units, exact.
• the_intake_prices_every_money_fixture_rate_at_its_1_5_5_figure: the oracle fixture rates plus the in-tree card fixtures.
• from_raw_is_byte_identical_to_the_unclamped_projection_for_every_in_range_rate: over 10k generated rates there are two arms only. A whole-nano rate equals 1.5.5's integer; every other rate is None at the intake.
• The cross-crate agreement test pins the exact integer ceiling (the float product was 480 nano-units short at 18_446_744_073_709_548). It also checks that a refused rate lands UNPRICED on the card, never as a priced zero.

Ledger rows touched

None. The no-float-money gate's MONEY_INTAKE rows (from_micro_rates, from_config, place_rate, TierRates, card_from_config) still name existing items. Those items no longer carry a decimal, so the gate is not weakened. The gate file is held by #853, #787 and #503.

Shared files (queue rule 20, disjoint hunks, clean merge with predev f70f567)

• config_validate/{mod.rs,tests/tests.rs}, shared with row 74 F25: a base URL's or token endpoint's userinfo rides as Authorization: Basic where 1.5.5 sent it; no plane receives it #913, row 74 F25: a lane base URL's userinfo is stripped, never dialled, sent or printed, as 1.5.5 did #876 and row 166 PR1: secret resolve takes a config-time proof (ConfigScope) and the config-scope gate #863.
• root/tests/kernel.rs, shared with row 113: admin DR verbs proven to land on the book's configured store (test-only; wiring landed in #556) #817.