feat(s42): byte-deterministic write_run_config outbox writer

tests/test_outbox_loadbearing.py

@@ -18,7 +18,7 @@ from agent_framework import BaseChatClient
 from conftest import SyntheticUsageChatClient
 
 from portfolio_optimiser.ir import AffectedItem, SavingsProposal
-from portfolio_optimiser.outbox import write_outbox
+from portfolio_optimiser.outbox import write_outbox, write_run_config
 from portfolio_optimiser.provenance import Citation, ProvenanceStamp
 from portfolio_optimiser.retrieval import TextSpan
 from portfolio_optimiser.run import run_project
@@ -133,6 +133,39 @@ def test_outbox_is_byte_deterministic(tmp_path) -> None:
     assert oa.read_bytes() == ob.read_bytes()
 
 
+def test_write_run_config_byte_deterministic_and_fields(tmp_path) -> None:
+    """S4.2 T-4.2a: ``write_run_config`` writes ``{run_id}-runconfig.json`` carrying profile +
+    resolved model per BUILT role + params + token cap; two identical writes are byte-identical
+    (sort_keys/indent/LF, no wall-clock), and the payload leaks NO date/timestamp key (§4 pkt 3
+    excludes wall-clock for byte-determinism). Drop a field, break ``_dump`` determinism, or leak a
+    timestamp → RED."""
+    import json
+
+    a = tmp_path / "a"
+    b = tmp_path / "b"
+    kwargs = dict(
+        profile="local",
+        resolved_models={"proposer": "qwen3:4b", "checker": "qwen3:4b"},
+        max_rounds=3,
+        max_tokens=100_000,
+        top_k=3,
+    )
+    pa = write_run_config(str(a), "run-1", **kwargs)
+    pb = write_run_config(str(b), "run-1", **kwargs)
+    assert pa.name == "run-1-runconfig.json"
+    assert pa.read_bytes() == pb.read_bytes()  # byte-deterministic
+    text = pa.read_text(encoding="utf-8")
+    assert text.endswith("\n")
+    payload = json.loads(text)
+    assert payload["run_id"] == "run-1"
+    assert payload["profile"] == "local"
+    assert payload["resolved_models"] == {"proposer": "qwen3:4b", "checker": "qwen3:4b"}
+    assert payload["max_rounds"] == 3
+    assert payload["max_tokens"] == 100_000
+    assert payload["top_k"] == 3
+    assert not any(k in payload for k in ("date", "timestamp", "created", "ts"))
+
+
 def test_outbox_registered_maf_free() -> None:
     """T-2.1d meta: outbox.py is registered in the MAF-free guard list, so test_okf_is_maf_free
     actually scans it — otherwise the MAF-free claim would be green-but-dead (never checked)."""