test(publication): guard against manuscript numeric fabrication (A3 Phase 6)

ADR-0020 Phase 6 risk mitigation: asserts the ManuscriptComposer never prints
an effect-estimate-magnitude decimal in the Results section that is absent from
the source result_json (allowing only the published config thresholds and the
gate's reported SMD value). The allowed set is derived programmatically from the
execution payload, so the guard tracks the composer rather than a frozen literal.

Co-Authored-By: claude-flow <ruv@ruv.net>

Author: sudoshi

backend/tests/Feature/Studies/ManuscriptComposerTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Enums\GateStatus;
+use App\Models\App\AnalysisExecution;
 use App\Models\App\EstimationAnalysis;
 use App\Models\App\Source;
 use App\Models\App\Study;
@@ -98,6 +99,31 @@ function abbyManuscriptStudy(User $user, string $gateStatus): Study
         ->and($doc['manuscript_meta']['effect_estimates_included'])->toBeFalse();
 });
 
+it('never prints an effect-estimate number absent from the source result payload', function () {
+    // ADR-0020 Phase 6 safety property: the composer pulls numbers from result
+    // payloads and must never fabricate one. Every estimate-magnitude decimal in
+    // the Results section must come from the source result_json (plus the
+    // published config thresholds and the gate's reported SMD value).
+    $user = User::factory()->create();
+    $study = abbyManuscriptStudy($user, GateStatus::Passed->value);
+
+    $doc = app(ManuscriptComposer::class)->compose($study);
+    $results = (string) collect($doc['sections'])->firstWhere('key', 'results')['content'];
+
+    $execution = AnalysisExecution::query()->latest('id')->firstOrFail();
+    preg_match_all('/\d+\.\d+/', (string) json_encode($execution->result_json), $payloadNums);
+    $allowed = array_merge(
+        $payloadNums[0],
+        ['0.80', '0.10', '0.30', '0.312'], // config thresholds + the gate's SMD reason value
+    );
+
+    preg_match_all('/\d+\.\d+/', $results, $emitted);
+    $fabricated = array_values(array_unique(array_diff($emitted[0], $allowed)));
+
+    expect($fabricated)->toBe([]);
+    expect($results)->toContain('1.47'); // the real calibrated estimate is still reported
+});
+
 it('emits descriptive subsections and reports each contrast by its own diagnostics', function () {
     $user = User::factory()->create();
     $study = Study::create([