R-426: instructions gate decoy moved into the felhom.eu suite; its exemption retired

A version literal in a CLAUDE.md's effective text must convict; the same inside an HTML comment
must pass. Seen failing with the version regex disabled.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/test_gate_decoys.py

@@ -53,6 +53,7 @@ COVERS = {
                         "(2026-10-03) an old-shape row under the new header, a near-miss category, an "
                         "old rank tag as Sev, an undefined state word, and a pipe outside backticks"),
     "decoy-coverage":  "a gate registered in a runner with no decoy and no exemption (its red-proof)",
+    "instructions":    "R-426: a version literal in a CLAUDE.md's effective text; the same in an HTML comment must pass",
     "wire-contract":   ("R-555: an emitted tag whose name the receiver carries ONLY in a // and a /* */ comment "
                         "must convict (it passed for months as `language` did); the genuine article — the same "
                         "name in a struct tag beside a `//` inside a string literal — must pass; and R-315: the "
@@ -177,6 +178,15 @@ decoy("reuse-refs/missing-md (R-422)", "reuse_refs_check.py",
                 u"\n- see `documentation/architecture/99-does-not-exist.md`\n"),
       args=(ROOT,))
 
+# --- instructions (R-426): moved in from the 2026-09-01 sweep --------------------------------------
+# A component version literal in EFFECTIVE text of a CLAUDE.md is convicted; the same sentence inside an
+# HTML comment (stripped before injection) is the genuine article and passes.
+decoy("instructions/version-literal", "instructions_gate.py",
+      append_to(os.path.join(ROOT, "CLAUDE.md"), u"\nThe hub runs v0.137.0 today.\n"), args=(ROOT,))
+decoy("instructions/version-in-comment", "instructions_gate.py",
+      append_to(os.path.join(ROOT, "CLAUDE.md"), u"\n<!--\nThe hub ran v0.137.0 on 2026-10-05.\n-->\n"),
+      args=(ROOT,), expect="accept")
+
 # --- golden-currency: R-410's own decoy, re-run here so the sweep owns it too ------------------
 def _mkdir_decoy():
     d = os.path.join(ROOT, "documentation", "tests", "golden-9.9.9-2026-01-01")