diff --git a/scripts/decoy_coverage_gate.py b/scripts/decoy_coverage_gate.py
index 70c34f41..2c0071ca 100644
--- a/scripts/decoy_coverage_gate.py
+++ b/scripts/decoy_coverage_gate.py
@@ -42,9 +42,6 @@ EXEMPT = {
     ("felhom.eu", "due-checks"):
         "R-426 — no legitimate decoy constructed; the attempt in the sweep was a no-op and its "
         "verdict was withdrawn rather than reported.",
-    ("felhom.eu", "instructions"):
-        "COVERED IN THE SWEEP, not yet in a suite: a version literal in effective text was REJECTED. "
-        "R-426 tracks moving it in.",
     # felhom-controller
     ("felhom-controller", "docker-v"):
         "COVERED IN THE SWEEP, not yet in a suite: an unallowlisted `-v` host path in a new Go file "
diff --git a/scripts/test_gate_decoys.py b/scripts/test_gate_decoys.py
index dac51288..55987486 100644
--- a/scripts/test_gate_decoys.py
+++ b/scripts/test_gate_decoys.py
@@ -53,6 +53,7 @@ COVERS = {
                         "(2026-10-03) an old-shape row under the new header, a near-miss category, an "
                         "old rank tag as Sev, an undefined state word, and a pipe outside backticks"),
     "decoy-coverage":  "a gate registered in a runner with no decoy and no exemption (its red-proof)",
+    "instructions":    "R-426: a version literal in a CLAUDE.md's effective text; the same in an HTML comment must pass",
     "wire-contract":   ("R-555: an emitted tag whose name the receiver carries ONLY in a // and a /* */ comment "
                         "must convict (it passed for months as `language` did); the genuine article — the same "
                         "name in a struct tag beside a `//` inside a string literal — must pass; and R-315: the "
@@ -177,6 +178,15 @@ decoy("reuse-refs/missing-md (R-422)", "reuse_refs_check.py",
                 u"\n- see `documentation/architecture/99-does-not-exist.md`\n"),
       args=(ROOT,))
 
+# --- instructions (R-426): moved in from the 2026-09-01 sweep --------------------------------------
+# A component version literal in EFFECTIVE text of a CLAUDE.md is convicted; the same sentence inside an
+# HTML comment (stripped before injection) is the genuine article and passes.
+decoy("instructions/version-literal", "instructions_gate.py",
+      append_to(os.path.join(ROOT, "CLAUDE.md"), u"\nThe hub runs v0.137.0 today.\n"), args=(ROOT,))
+decoy("instructions/version-in-comment", "instructions_gate.py",
+      append_to(os.path.join(ROOT, "CLAUDE.md"), u"\n<!--\nThe hub ran v0.137.0 on 2026-10-05.\n-->\n"),
+      args=(ROOT,), expect="accept")
+
 # --- golden-currency: R-410's own decoy, re-run here so the sweep owns it too ------------------
 def _mkdir_decoy():
     d = os.path.join(ROOT, "documentation", "tests", "golden-9.9.9-2026-01-01")