diff --git a/spec/functional/local/FR-039-auth-client-audience-allowlist.md b/spec/functional/local/FR-039-auth-client-audience-allowlist.md
index 9bc50a3..b77acbc 100644
--- a/spec/functional/local/FR-039-auth-client-audience-allowlist.md
+++ b/spec/functional/local/FR-039-auth-client-audience-allowlist.md
@@ -4,7 +4,7 @@ title: "Auth Client Audience Allowlist Rendering"
 type: FR
 object: configuration
 ---
-# [FR-039] Auth Client Audience Allowlist Rendering
+# FR-039: Auth Client Audience Allowlist Rendering
 
 ## Description
 
diff --git a/spec/functional/local/FR-040-auth-accept-invite.md b/spec/functional/local/FR-040-auth-accept-invite.md
index 6461998..bc31f81 100644
--- a/spec/functional/local/FR-040-auth-accept-invite.md
+++ b/spec/functional/local/FR-040-auth-accept-invite.md
@@ -13,7 +13,7 @@ relationships:
     type: "extends"
     cardinality: "1:1"
 ---
-# [FR-040] `ix local auth accept-invite` — Headless invite acceptance
+# FR-040: `ix local auth accept-invite` — Headless invite acceptance
 
 ## Description
 
diff --git a/spec/functional/local/FR-041-auth-rotate-password.md b/spec/functional/local/FR-041-auth-rotate-password.md
index 47c055a..46a9b60 100644
--- a/spec/functional/local/FR-041-auth-rotate-password.md
+++ b/spec/functional/local/FR-041-auth-rotate-password.md
@@ -13,7 +13,7 @@ relationships:
     type: "extends"
     cardinality: "1:1"
 ---
-# [FR-041] `ix local auth rotate-password` — Headless must_rotate flow
+# FR-041: `ix local auth rotate-password` — Headless must_rotate flow
 
 ## Description
 
diff --git a/spec/functional/local/FR-042-auth-tenant.md b/spec/functional/local/FR-042-auth-tenant.md
index c3306df..cc8a776 100644
--- a/spec/functional/local/FR-042-auth-tenant.md
+++ b/spec/functional/local/FR-042-auth-tenant.md
@@ -16,7 +16,7 @@ relationships:
     type: "extends"
     cardinality: "1:1"
 ---
-# [FR-042] `ix local auth tenant` — Tenant membership CRUD
+# FR-042: `ix local auth tenant` — Tenant membership CRUD
 
 ## Description
 
diff --git a/spec/functional/local/FR-043-auth-create-user.md b/spec/functional/local/FR-043-auth-create-user.md
index cf64662..a672f54 100644
--- a/spec/functional/local/FR-043-auth-create-user.md
+++ b/spec/functional/local/FR-043-auth-create-user.md
@@ -13,7 +13,7 @@ relationships:
     type: "implements"
     cardinality: "1:1"
 ---
-# [FR-043] `ix local auth create-user` — One-shot user creation
+# FR-043: `ix local auth create-user` — One-shot user creation
 
 ## Description
 
diff --git a/spec/functional/local/FR-044-auth-kubeconfig-issue.md b/spec/functional/local/FR-044-auth-kubeconfig-issue.md
index 627b55c..d071007 100644
--- a/spec/functional/local/FR-044-auth-kubeconfig-issue.md
+++ b/spec/functional/local/FR-044-auth-kubeconfig-issue.md
@@ -16,7 +16,7 @@ relationships:
     type: "extends"
     cardinality: "1:1"
 ---
-# [FR-044] `ix local auth kubeconfig issue` — Emit operator-scoped kubeconfig
+# FR-044: `ix local auth kubeconfig issue` — Emit operator-scoped kubeconfig
 
 ## Description
 
diff --git a/spec/functional/local/FR-045-auth-kubeconfig-rotate.md b/spec/functional/local/FR-045-auth-kubeconfig-rotate.md
index f846bf3..b6f96e7 100644
--- a/spec/functional/local/FR-045-auth-kubeconfig-rotate.md
+++ b/spec/functional/local/FR-045-auth-kubeconfig-rotate.md
@@ -13,7 +13,7 @@ relationships:
     type: "implements"
     cardinality: "1:1"
 ---
-# [FR-045] `ix local auth kubeconfig rotate` — Invalidate and reissue SA token
+# FR-045: `ix local auth kubeconfig rotate` — Invalidate and reissue SA token
 
 > **Status:** skeleton. Ships after [FR-044](./FR-044-auth-kubeconfig-issue.md). This FR is registered now so
 > callers (auth/[FR-008](./FR-008-ix-core-tag-convention.md) recovery matrix, operator runbooks) can reference
diff --git a/spec/functional/local/auth.md b/spec/functional/local/auth.md
index f51f23d..7c66cb0 100644
--- a/spec/functional/local/auth.md
+++ b/spec/functional/local/auth.md
@@ -28,7 +28,7 @@ relationships:
     type: "constrained_by"
     cardinality: "1:1"
 ---
-# [FR-046] `ix local auth` — Command Suite & Namespace Contract
+# FR-046: `ix local auth` — Command Suite & Namespace Contract
 
 ## Description