diff --git a/.fusa-hara.json b/.fusa-hara.json
index 4f0ebaf..be5cc5d 100644
--- a/.fusa-hara.json
+++ b/.fusa-hara.json
@@ -61,7 +61,7 @@
       "hazards": ["H-001"],
       "asil": "ASIL-B",
       "safeState": "Application is signalled (via E2E CRC/counter mismatch) and discards the frame.",
-      "requirements": ["REQ-SAFETY-001", "REQ-SEC-001"]
+      "fssrRefs": ["REQ-SAFETY-001", "REQ-SEC-001"]
     },
     {
       "id": "SG-002",
@@ -69,7 +69,7 @@
       "hazards": ["H-002"],
       "asil": "ASIL-B",
       "safeState": "Drop counters increment and are exposed via MetricsProvider for the application to detect.",
-      "requirements": ["REQ-VIRT-004", "REQ-SEC-003"]
+      "fssrRefs": ["REQ-VIRT-004", "REQ-SEC-003"]
     },
     {
       "id": "SG-003",
@@ -77,7 +77,7 @@
       "hazards": ["H-003"],
       "asil": "ASIL-B",
       "safeState": "Out-of-range physical values are clamped deterministically; round-trip is verified.",
-      "requirements": ["REQ-DBC-005", "REQ-SEC-004"]
+      "fssrRefs": ["REQ-DBC-005", "REQ-SEC-004"]
     },
     {
       "id": "SG-004",
@@ -85,7 +85,7 @@
       "hazards": ["H-004"],
       "asil": "ASIL-A",
       "safeState": "Reassembly aborts with an error; no partial message is delivered.",
-      "requirements": ["REQ-ISOTP-012", "REQ-SEC-002", "REQ-SEC-003"]
+      "fssrRefs": ["REQ-ISOTP-012", "REQ-SEC-002", "REQ-SEC-003"]
     },
     {
       "id": "SG-005",
@@ -93,7 +93,7 @@
       "hazards": ["H-005"],
       "asil": "ASIL-B",
       "safeState": "Invalid frames are rejected at Send with ErrInvalidFrame; nothing is transmitted.",
-      "requirements": ["REQ-CAN-009", "REQ-CAN-010", "REQ-SEC-001"]
+      "fssrRefs": ["REQ-CAN-009", "REQ-CAN-010", "REQ-SEC-001"]
     }
   ]
 }
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 785ba74..dd82916 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -170,12 +170,12 @@ jobs:
           ./socketcan/...
 
   # ── go-FuSa continuous-conformance lifecycle (RELAY spec §20.1.2) ──────────
-  # Pinned to v0.30.0. Runs the FULL lifecycle, not a subset: static check,
+  # Pinned to v0.36.0. Runs the FULL lifecycle, not a subset: static check,
   # 100% requirement traceability (traced AND tested + function-annotation
   # density), cybersecurity analysis, dependency vulnerability scan, and the
   # tool-qualification suite. Conformance must be continuously proven.
   gofusa:
-    name: go-FuSa lifecycle (§20, v0.30.0)
+    name: go-FuSa lifecycle (§20, v0.36.0)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -184,7 +184,7 @@ jobs:
           go-version: "1.25"
 
       - name: Install go-FuSa
-        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.30.0
+        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.36.0
 
       - name: gofusa check (gate on ERROR)
         run: gofusa check ./...
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5342edb..1b1af33 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
           go-version: "1.25"
 
       - name: Install go-FuSa
-        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.30.0
+        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.36.0
 
       - name: Regenerate dFMEA table
         run: gofusa fmea -cyber