Federated learning (FL) trains a shared model without collecting clients’ raw data, but a server must still decide what to do with unreliable updates. Honest clients with different data can look unusual too. We study TrustFL-Chain, a lightweight prototype that scores updates, maintains recoverable client reputation,  and writes aggregation decisions to a 256-bit Secure Hash Algorithm (SHA-256)-linked audit log. It does not require a trusted server dataset. Across 440 validated jobs, we test five Fashion-MNIST seeds,  independent and identically distributed (IID) and non-IID partitions, six attacks, parameter sensitivity,  unequal client sizes, and an exploratory Canadian Institute for Advanced Research (CIFAR)-10 supplement.  With Dirichlet α = 0.5 and 20% malicious clients, final-five-round accuracy exceeds Trimmed Mean by 6.18  percentage points under Gaussian noise. Under inner-product manipulation (IPM), TrustFL-Chain reaches 0.6457 accuracy against 0.3314 for the strongest observed baseline. Its 1.21-point mean lead over  Cosine under sign flipping has a paired interval that crosses zero. Uniform averaging remains more accurate under the evaluated A Little Is Enough (ALIE)-style attack. In these experiments, reputation weighting helps most when manipulated updates leave a detectable signal.