chore: retain reviewed reward receipt article as an unpublished draft

[github-actions]

This draft examines five reproduced failures in the reward worker: a caller-chosen evidence tier, a replaced subject, a reward for an unchanged store, a decreasing expiry counter, and calibration against records the contract never matched. The article explains the corrected behavior and the trust decisions those checks still leave to the environment and bundle admission.

The release facts refer to Flow 1.35.1. Its public wheel contains the reward extra, reward modules, and serve-reward command. The article uses the retained before/after reproductions from Flow #463 and links the implementation at release commit 44e99a48ebf048c18892aa17cef6ae594db0d0c2. Synthetic certification stays distinct from production use; the calibration bound describes false accepts under the sampled synthetic faults, not scalar-reward accuracy. The 95% registry entry records the method's declared confidence parameter with its source.

The article stays unpublished with draft: true. Publication needs a separate approved change to that flag. Merging this source lets the scheduled scan prepare later drafts from the original watermark and backlog. This merge doesn't approve article publication. Scheduled drafts always receive draft: true, and no PR-closed workflow publishes retained posts.

Post: content/posts/2026-09-07-five-ways-to-fake-a-reward-receipt-and-why-the-fix-is-never/index.md

Sources

• Merged Flow #463 and retained reproductions
• Published Flow 1.35.1
• Reward implementation at the released commit
• Trust-boundary regression tests at the released commit

Public wheel inspection verified SHA-256 cfbc89acc6a2e3bcb5502a4d1fb29e985a03149a7f14c32c259254676bb3f11d, the declared reward extra, all eight reward module files, and the command parser. No private corpus or deployment recipe supplies the article's examples.

Validation

• Voice lint across all posts passes. The revised article has zero warnings.
• The strict substance check passes for this draft; the all-post advisory check also passes.
• The benchmark claim guard and its four tests pass.
• Hugo 0.157.0 builds with and without --buildDrafts; both rendered newsletter checks pass.
• The normal build excludes the article route, feeds, and search data. The draft build includes it.
• git diff --check passes. The automation state, draft workflow, and backlog match the original PR head byte for byte.