diff --git a/.devcontainer/.env.example b/.devcontainer/.env.example
index fd7cea6e9..a7433f314 100644
--- a/.devcontainer/.env.example
+++ b/.devcontainer/.env.example
@@ -11,16 +11,16 @@ MSSQL_PID=Developer
 MSSQL_SA_PASSWORD=YourStrong!Passw0rd
 SQLSERVER_HOST_PORT=1433
 
+DATABASE_READONLY_PASSWORD_ENV=DB_READONLY_PASSWORD
+DB_ENCRYPT=true
 DB_HOST=db
-DB_PORT=1433
 DB_NAME=kravhantering
-DB_READONLY_USER=readonly
+DB_PORT=1433
 DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
-DATABASE_READONLY_PASSWORD_ENV=DB_READONLY_PASSWORD
-DB_ENCRYPT=true
+DB_READONLY_USER=readonly
 DB_TRUST_SERVER_CERTIFICATE=true
-NODE_ENV=development
 NEXT_TELEMETRY_DISABLED=1
+NODE_ENV=development
 
 # Optional explicit overrides for the derived DB_* connection settings above:
 # DATABASE_URL=mssql://sa:YourStrong!Passw0rd@db:1433/kravhantering?encrypt=true&trustServerCertificate=true
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 3620f912a..3fbeea2b1 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -21,6 +21,10 @@ RUN apt-get update && \
         mkcert && \
     rm -rf /var/lib/apt/lists/*
 
+# Install dotenv-linter for env file checks.
+RUN curl -sSfL https://raw.githubusercontent.com/dotenv-linter/dotenv-linter/master/install.sh | \
+    sh -s -- -b /usr/local/bin
+
 # Set the working directory
 WORKDIR /workspace
 
diff --git a/.env.development b/.env.development
index 0fd222fb0..e3ae7c3ea 100644
--- a/.env.development
+++ b/.env.development
@@ -9,31 +9,31 @@
 # Development-only HMAC secret (intentionally public, non-production value)
 ANALYTICS_HASH_SECRET=dev-local-secret-not-for-production
 
+DB_ENCRYPT=true
 # Local SQL Server defaults for host-based development.
 # The devcontainer injects its own DB_* values from `.devcontainer/.env`,
 # and those existing shell variables take precedence over these committed
 # defaults when the app runs inside the container.
 DB_HOST=127.0.0.1
-DB_PORT=1433
 DB_NAME=kravhantering
-MSSQL_SA_PASSWORD=YourStrong!Passw0rd
-DB_READONLY_USER=readonly
+DB_PORT=1433
 DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
-DB_ENCRYPT=true
+DB_READONLY_USER=readonly
 DB_TRUST_SERVER_CERTIFICATE=true
+MSSQL_SA_PASSWORD=YourStrong!Passw0rd
 
 NEXTJS_ENV=development
 NEXT_PUBLIC_SITE_URL=http://localhost:3000
 
+AUTH_OIDC_CLIENT_ID=kravhantering-app
+AUTH_OIDC_CLIENT_SECRET=dev-only-app-secret
 # --------------------------------------
 # Authentication (PhenixID OIDC) — local dev defaults targeting the local
 # Keycloak realm. See docs/auth-developer-workflow.md.
 # --------------------------------------
 AUTH_OIDC_ISSUER_URL=http://localhost:8080/realms/kravhantering-dev
-AUTH_OIDC_CLIENT_ID=kravhantering-app
-AUTH_OIDC_CLIENT_SECRET=dev-only-app-secret
-AUTH_OIDC_REDIRECT_URI=http://localhost:3000/api/auth/callback
 AUTH_OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:3000/
+AUTH_OIDC_REDIRECT_URI=http://localhost:3000/api/auth/callback
 # Iron-session cookie key (≥32 chars). Dev-only fixed value so every
 # contributor gets a working setup without manual generation. Real envs
 # generate this with `openssl rand -base64 48` and store it in a Secret.
diff --git a/.env.example b/.env.example
index b19aa62c1..d4fe6d797 100644
--- a/.env.example
+++ b/.env.example
@@ -87,26 +87,26 @@ AUTH_ENABLED=true
 # without a server round-trip.
 NEXT_PUBLIC_AUTH_ENABLED=true
 
+AUTH_OIDC_CLIENT_ID=kravhantering-app
+AUTH_OIDC_CLIENT_SECRET=dev-only-app-secret
 # OIDC issuer base URL (used for discovery at <ISSUER>/.well-known/openid-configuration).
 # Local Keycloak default: http://localhost:8080/realms/kravhantering-dev
 AUTH_OIDC_ISSUER_URL=http://localhost:8080/realms/kravhantering-dev
-AUTH_OIDC_CLIENT_ID=kravhantering-app
-AUTH_OIDC_CLIENT_SECRET=dev-only-app-secret
 
+AUTH_OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:3000/
 # Full callback URL, must be pre-registered with the IdP.
 AUTH_OIDC_REDIRECT_URI=http://localhost:3000/api/auth/callback
-AUTH_OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:3000/
 
-# Optional. Defaults shown.
-AUTH_OIDC_SCOPES=openid profile email
-AUTH_OIDC_ROLES_CLAIM=roles
 # Audience expected on access tokens (MCP). Defaults to AUTH_OIDC_CLIENT_ID.
 AUTH_OIDC_API_AUDIENCE=
+AUTH_OIDC_ROLES_CLAIM=roles
+# Optional. Defaults shown.
+AUTH_OIDC_SCOPES="openid profile email"
 
+AUTH_SESSION_COOKIE_NAME=kravhantering_session
 # Iron-session encryption password. MUST be at least 32 characters.
 # Generate with: openssl rand -base64 48
 AUTH_SESSION_COOKIE_PASSWORD=replace-with-32-bytes-of-randomness-XXXXXXXX
-AUTH_SESSION_COOKIE_NAME=kravhantering_session
 AUTH_SESSION_TTL_SECONDS=28800
 
 # When the app runs behind a reverse proxy (OpenShift Route, ingress),
diff --git a/.env.sqlserver.ci b/.env.sqlserver.ci
index 3089ad16a..80e3ed567 100644
--- a/.env.sqlserver.ci
+++ b/.env.sqlserver.ci
@@ -1,15 +1,25 @@
-# CI defaults for integration tests (no secrets — safe to commit).
-# MSSQL_SA_PASSWORD must be supplied by the CI runner (GitHub Actions
-# variable / secret) and appended to .env.sqlserver before `npm run db:up`.
-# Read-only browse credentials are intentionally omitted; CI only needs
-# the SA login to provision the database and run integration tests.
+# CI defaults for integration tests and browse workflows (safe to commit).
+# MSSQL_SA_PASSWORD is a well-known SQL Server example password intentionally
+# committed because forked PRs cannot access GitHub Actions secrets or vars.
+# The read-only credentials block is also committed for integration tests and
+# read-only developer browse use.
 
 ACCEPT_EULA=Y
 MSSQL_PID=Developer
 SQLSERVER_HOST_PORT=1433
 
+# This password is a well-known password (used in examples) to build the test
+# database and run integration tests in CI. It is intentionally set here and not
+# a secret or variable in GitHub Actions because the integration tests need to
+# run on pull requests from forks, where secrets and variables are not available.
+MSSQL_SA_PASSWORD=YourStrong!Passw0rd
+
+DB_ENCRYPT=true
 DB_HOST=127.0.0.1
-DB_PORT=1433
 DB_NAME=kravhantering
-DB_ENCRYPT=true
+DB_PORT=1433
 DB_TRUST_SERVER_CERTIFICATE=true
+
+DATABASE_READONLY_PASSWORD_ENV=DB_READONLY_PASSWORD
+DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
+DB_READONLY_USER=readonly
diff --git a/.env.sqlserver.example b/.env.sqlserver.example
index acd4de28e..d387d752f 100644
--- a/.env.sqlserver.example
+++ b/.env.sqlserver.example
@@ -13,13 +13,13 @@ MSSQL_PID=Developer
 MSSQL_SA_PASSWORD=YourStrong!Passw0rd
 SQLSERVER_HOST_PORT=1433
 
+DATABASE_READONLY_PASSWORD_ENV=DB_READONLY_PASSWORD
+DB_ENCRYPT=true
 DB_HOST=127.0.0.1
-DB_PORT=1433
 DB_NAME=kravhantering
-DB_READONLY_USER=readonly
+DB_PORT=1433
 DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
-DATABASE_READONLY_PASSWORD_ENV=DB_READONLY_PASSWORD
-DB_ENCRYPT=true
+DB_READONLY_USER=readonly
 DB_TRUST_SERVER_CERTIFICATE=true
 
 # Optional explicit overrides for the derived DB_* connection settings above:
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 4f14c06bd..d62bbea54 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -15,7 +15,8 @@
 ## Commands
 
 - `npm run check` - all checks (`type-check`, `lint:py`,
-  `format:check`, `spell:check`, `lint`, `lint:md`, `test`)
+  `dotenv:check`, `format:check`, `spell:check`, `lint`, `lint:md`,
+  `test`)
 - `npm run test` - run tests
 - `npm run dev` - start dev server
 
diff --git a/.github/instructions/mcp-tool-contract.instructions.md b/.github/instructions/mcp-tool-contract.instructions.md
new file mode 100644
index 000000000..3200a35a1
--- /dev/null
+++ b/.github/instructions/mcp-tool-contract.instructions.md
@@ -0,0 +1,20 @@
+---
+applyTo: "{lib/mcp/**/*.ts,lib/requirements/**/*.ts,lib/dal/**/*.ts,app/api/**/*.ts,docs/mcp-server-*.md,tests/unit/mcp-http.test.ts}"
+---
+
+# MCP Tool Contract Upkeep
+
+## When Changing Callable Behavior
+
+- If logic changes what an MCP client must send, can receive, or should do
+  next, update `lib/mcp/server.ts` in the same change.
+- Keep tool `description`, `inputSchema`, `outputSchema`, and field
+  `.describe(...)` text aligned with the handler/service behavior.
+- State prerequisite tool calls and exact source/destination fields for values
+  clients must echo, such as `requirements_get_requirement`
+  `requirement.versions[0].id` to `requirement.baseVersionId`.
+- Do not rely on user docs alone to teach MCP clients how to call a tool.
+- Update `docs/mcp-server-user-guide.md`,
+  `docs/mcp-server-contributor-guide.md`, and `tests/unit/mcp-http.test.ts`.
+- For outward-facing MCP invariants, update the quality siblings described in
+  `.github/instructions/quality-spec.instructions.md`.
diff --git a/.github/skills/run-spec-audit/references/scrutiny-areas.md b/.github/skills/run-spec-audit/references/scrutiny-areas.md
index 0b3b5d34b..37fee7949 100644
--- a/.github/skills/run-spec-audit/references/scrutiny-areas.md
+++ b/.github/skills/run-spec-audit/references/scrutiny-areas.md
@@ -57,7 +57,19 @@ maintenance rule.
 - **Verify:** `npm exec -- vitest run tests/quality/functional.test.ts
   -t "Scenario 4"`
 
-## 5. Package-Local Requirements and Deviations — Scenario 6, 7
+## 5. Draft Edit Concurrency — Scenario 11
+
+- **Code:** `lib/dal/requirements.ts` and
+  `lib/requirements/service.ts` — `baseVersionId`/`baseRevisionToken`
+  optimistic edit preconditions.
+- **Spec:** `docs/lifecycle-workflow.md`.
+- **Req tag:** `[Req: formal — docs/lifecycle-workflow.md "Draft"]`
+- **Question:** Are stale draft edits rejected before content or joins are
+  rewritten?
+- **Verify:** `npm exec -- vitest run tests/quality/functional.test.ts
+  -t "Scenario 11"`
+
+## 6. Package-Local Requirements and Deviations — Scenario 6, 7
 
 - **Code:** `lib/dal/requirement-packages.ts` — package-local
   requirement, needs-reference, and deviation-gated status functions.
@@ -73,7 +85,7 @@ maintenance rule.
 - **Verify (S7):** `npm exec -- vitest run
   tests/quality/functional.test.ts -t "Scenario 7"`
 
-## 6. Deviation Lifecycle Guards and Decision Immutability — Scenario 9
+## 7. Deviation Lifecycle Guards and Decision Immutability — Scenario 9
 
 - **Code:** `lib/dal/deviations.ts` — approval/rejection logic,
   review-requested guards, edit/delete guards.
@@ -87,7 +99,7 @@ maintenance rule.
 - **Verify:** `npm exec -- vitest run tests/quality/functional.test.ts
   -t "Scenario 9"`
 
-## 7. Suggestion Terminal State — Scenario 8
+## 8. Suggestion Terminal State — Scenario 8
 
 - **Code:** `lib/dal/improvement-suggestions.ts` — resolution logic.
 - **Spec:** `docs/lifecycle-workflow.md`.
@@ -98,7 +110,7 @@ maintenance rule.
 - **Verify:** `npm exec -- vitest run tests/quality/functional.test.ts
   -t "Scenario 8"`
 
-## 8. List View Defensive Parsing
+## 9. List View Defensive Parsing
 
 - **Code:** `lib/requirements/list-view.ts`.
 - **Spec:** `docs/requirements-ui-behaviour.md` and
@@ -106,7 +118,7 @@ maintenance rule.
 - **Question:** Do malformed admin defaults, invalid visible-column
   JSON, hidden filters, or bad widths fail safely?
 
-## 9. REST and MCP Output Consistency
+## 10. REST and MCP Output Consistency
 
 - **Code:** `lib/mcp/http.ts`, `lib/mcp/server.ts`,
   `app/api/requirements/[id]/route.ts`,
@@ -118,7 +130,7 @@ maintenance rule.
 - **Question:** Do REST and MCP outputs, transport rules, and field
   names match the documentation and field contracts?
 
-## 10. CSV Export
+## 11. CSV Export
 
 - **Code:** `lib/export-csv.ts`.
 - **Spec:** `docs/reports.md`.
@@ -127,7 +139,7 @@ maintenance rule.
 - **Question:** Does export behavior match the documented CSV
   expectations for separators and escaping?
 
-## 11. Coverage Target Alignment
+## 12. Coverage Target Alignment
 
 - **Source:** `tests/quality/QUALITY.md` — Coverage Targets table.
 - **Question:** Do the subsystems and file paths listed in the
@@ -135,7 +147,7 @@ maintenance rule.
   Flag new DAL files, renamed modules, or removed subsystems that
   make the targets stale.
 
-## 12. MCP Tool Inventory Parity — Scenario 10
+## 13. MCP Tool Inventory Parity — Scenario 10
 
 - **Code:** `lib/mcp/server.ts`.
 - **Spec:** `docs/mcp-server-contributor-guide.md` ("Server Contract",
@@ -161,7 +173,7 @@ This file must stay in sync with `tests/quality/QUALITY.md`:
   references here.
 - See `tests/quality/AGENTS.md` for the authoritative sync rule.
 
-## 13. Reference Data Behavioral Contracts
+## 14. Reference Data Behavioral Contracts
 
 - **Code:** `lib/dal/norm-references.ts`, `lib/dal/owners.ts`,
   `lib/dal/package-implementation-types.ts`,
@@ -176,7 +188,7 @@ This file must stay in sync with `tests/quality/QUALITY.md`:
   (`nameSv` for taxonomy, `normReferenceId` for norm
   references, `lastName`/`firstName` for owners)?
 
-## 14. AI Generation Contracts
+## 15. AI Generation Contracts
 
 - **Code:** `lib/ai/openrouter-client.ts`,
   `lib/ai/requirement-prompt.ts`, `lib/ai/taxonomy.ts`.
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index c549f526e..f4abb972f 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -52,25 +52,12 @@ jobs:
       - name: Prepare SQL Server env file
         run: |
           cp .env.sqlserver.ci .env.sqlserver
-          # This uses a well-known password from examples, but it's stored as a
-          # GitHub Actions variable to avoid hitting any security scanners that
-          # look for hardcoded secrets.
-          echo "MSSQL_SA_PASSWORD=${MSSQL_SA_PASSWORD}" >> .env.sqlserver
-        env:
-          MSSQL_SA_PASSWORD: ${{ vars.MSSQL_SA_PASSWORD }}
 
       - name: Start local database service
         run: npm run db:up
 
       - name: Setup local SQL Server database
         run: npm run db:setup
-        env:
-          MSSQL_SA_PASSWORD: ${{ vars.MSSQL_SA_PASSWORD }}
-          DB_HOST: 127.0.0.1
-          DB_PORT: 1433
-          DB_NAME: kravhantering
-          DB_ENCRYPT: 'true'
-          DB_TRUST_SERVER_CERTIFICATE: 'true'
 
       - name: Install Playwright Browsers
         run: npx playwright install --with-deps chromium
@@ -79,12 +66,6 @@ jobs:
         run: ${{ matrix.testCommand }}
         env:
           CI: true
-          MSSQL_SA_PASSWORD: ${{ vars.MSSQL_SA_PASSWORD }}
-          DB_HOST: 127.0.0.1
-          DB_PORT: 1433
-          DB_NAME: kravhantering
-          DB_ENCRYPT: 'true'
-          DB_TRUST_SERVER_CERTIFICATE: 'true'
 
       - name: Upload test results (${{ matrix.server }})
         if: always()
diff --git a/.github/workflows/quality-checks.yml b/.github/workflows/quality-checks.yml
index 9e1d910d2..aea0fb7ac 100644
--- a/.github/workflows/quality-checks.yml
+++ b/.github/workflows/quality-checks.yml
@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: read
+  checks: write
   pull-requests: write
 
 jobs:
@@ -45,6 +46,20 @@ jobs:
       - name: Run Python type check
         run: npm run lint:py
 
+      - name: Run dotenv-linter root check
+        uses: dotenv-linter/action-dotenv-linter@v3
+        with:
+          dotenv_linter_flags: .
+          filter_mode: nofilter
+          fail_level: any
+
+      - name: Run dotenv-linter devcontainer check
+        uses: dotenv-linter/action-dotenv-linter@v3
+        with:
+          dotenv_linter_flags: .devcontainer --recursive
+          filter_mode: nofilter
+          fail_level: any
+
       - name: Run tests and coverage
         run: npm run test:coverage
 
@@ -84,7 +99,8 @@ jobs:
               { name: 'Lint', command: 'npm run lint' },
               { name: 'Markdown Lint', command: 'npm run lint:md' },
               { name: 'Type Check', command: 'npm run type-check' },
-              { name: 'Python Type Check', command: 'npm run lint:py' }
+              { name: 'Python Type Check', command: 'npm run lint:py' },
+              { name: 'dotenv-linter', command: 'npm run dotenv:check' }
             ];
 
             let body = '❌ **Quality checks failed!** Please fix the following issues:\n\n';
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c7b575665..5ae23e489 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -30,7 +30,7 @@ for setup, migrations, and the read-only browse workflow.
 | `npm run start:prodlike` | Rebuild and start the prod-like app on port 3001 (`NODE_ENV=production`) |
 | `npm run build` | Production build |
 | `npm run start` | Start the production server |
-| `npm run check` | Run all checks (TS, Python, format, lint, tests) |
+| `npm run check` | Run all checks (TS, Python, dotenv, format, lint, tests) |
 | `npm run test` | Run unit tests with Vitest |
 | `npm run test:watch` | Run unit tests in watch mode |
 | `npm run test:coverage` | Run unit tests with coverage |
@@ -39,10 +39,12 @@ for setup, migrations, and the read-only browse workflow.
 | `npm run lint` | Lint with Biome |
 | `npm run lint:fix` | Lint and auto-fix with Biome |
 | `npm run lint:py` | Type-check Python scripts with Pyright |
+| `npm run dotenv:check` | Check dotenv files with dotenv-linter |
+| `npm run dotenv:fix` | Auto-fix dotenv files with dotenv-linter |
 | `npm run format` | Format code with Biome |
 | `npm run spell` | Spell check with cspell |
 | `npm run lint:md` | Lint Markdown files |
-| `npm run fix` | Auto-fix formatting, linting & Markdown |
+| `npm run fix` | Auto-fix formatting, linting, Markdown, and dotenv files |
 | `npm run type-check` | TypeScript type checking |
 <!-- markdownlint-enable MD013 -->
 
diff --git a/app/[locale]/requirements/[id]/edit/edit-requirement-client.tsx b/app/[locale]/requirements/[id]/edit/edit-requirement-client.tsx
index 5dc90040c..4b9047c14 100644
--- a/app/[locale]/requirements/[id]/edit/edit-requirement-client.tsx
+++ b/app/[locale]/requirements/[id]/edit/edit-requirement-client.tsx
@@ -46,6 +46,10 @@ export default function EditRequirementClient({
     number[]
   >([])
   const [initialScenarioIds, setInitialScenarioIds] = useState<number[]>([])
+  const [baseRevisionToken, setBaseRevisionToken] = useState<string | null>(
+    null,
+  )
+  const [baseVersionId, setBaseVersionId] = useState<number | null>(null)
   const [uniqueId, setUniqueId] = useState('')
   const [isPublished, setIsPublished] = useState(false)
   const [loading, setLoading] = useState(true)
@@ -53,6 +57,8 @@ export default function EditRequirementClient({
 
   const fetchData = useCallback(async () => {
     setFetchError(null)
+    setBaseRevisionToken(null)
+    setBaseVersionId(null)
     setIsPublished(false)
     setLoading(true)
 
@@ -84,6 +90,8 @@ export default function EditRequirementClient({
         return
       }
       setIsPublished(latest.status === STATUS_PUBLISHED)
+      setBaseRevisionToken(latest.revisionToken)
+      setBaseVersionId(latest.id)
       setInitialData({
         areaId: data.area?.id != null ? String(data.area.id) : '',
         categoryId:
@@ -169,10 +177,13 @@ export default function EditRequirementClient({
         )}
         <div className="bg-white/80 dark:bg-secondary-900/60 backdrop-blur-sm rounded-2xl border shadow-sm p-6">
           <RequirementForm
+            baseRevisionToken={baseRevisionToken}
+            baseVersionId={baseVersionId}
             initialData={initialData ?? undefined}
             initialNormReferenceIds={initialNormReferenceIds}
             initialScenarioIds={initialScenarioIds}
             mode="edit"
+            onRefreshLatest={fetchData}
             requirementId={requirementId}
           />
         </div>
diff --git a/app/[locale]/requirements/requirements-client.tsx b/app/[locale]/requirements/requirements-client.tsx
index 075d00794..0db12ac3c 100644
--- a/app/[locale]/requirements/requirements-client.tsx
+++ b/app/[locale]/requirements/requirements-client.tsx
@@ -188,6 +188,7 @@ function mapRequirementDetailToRow(
           categoryNameSv: version.category?.nameSv ?? null,
           description: version.description,
           requiresTesting: version.requiresTesting,
+          revisionToken: version.revisionToken,
           status: version.status,
           statusColor: version.statusColor,
           statusNameEn: version.statusNameEn,
diff --git a/app/api/requirements/[id]/route.ts b/app/api/requirements/[id]/route.ts
index 84c8296a7..95423f9a1 100644
--- a/app/api/requirements/[id]/route.ts
+++ b/app/api/requirements/[id]/route.ts
@@ -64,6 +64,12 @@ export async function PUT(
           ? String(body.acceptanceCriteria)
           : undefined,
         areaId: body.areaId ? Number(body.areaId) : undefined,
+        baseRevisionToken:
+          body.baseRevisionToken != null
+            ? String(body.baseRevisionToken)
+            : undefined,
+        baseVersionId:
+          body.baseVersionId != null ? Number(body.baseVersionId) : undefined,
         categoryId: body.categoryId ? Number(body.categoryId) : undefined,
         createdBy: body.ownerId ? String(body.ownerId) : undefined,
         description: String(body.description ?? ''),
diff --git a/components/RequirementForm.tsx b/components/RequirementForm.tsx
index 9db01ad28..7fb6edd6f 100644
--- a/components/RequirementForm.tsx
+++ b/components/RequirementForm.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { motion } from 'framer-motion'
-import { Plus, X } from 'lucide-react'
+import { AlertTriangle, ExternalLink, Plus, RotateCcw, X } from 'lucide-react'
 import { useTranslations } from 'next-intl'
 import { useEffect, useRef, useState } from 'react'
 import { createPortal } from 'react-dom'
@@ -11,17 +11,30 @@ import RequirementFormFields, {
 } from '@/components/RequirementFormFields'
 import { useRouter } from '@/i18n/routing'
 import { apiFetch } from '@/lib/http/api-fetch'
+import type { RequirementDetailResponse } from '@/lib/requirements/types'
 
 interface RequirementFormProps {
+  baseRevisionToken?: string | null
+  baseVersionId?: number | null
   initialData?: Partial<
     Omit<RequirementFormFieldValues, 'normReferenceIds' | 'scenarioIds'>
   >
   initialNormReferenceIds?: number[]
   initialScenarioIds?: number[]
   mode: 'create' | 'edit'
+  onRefreshLatest?: () => Promise<void> | void
   requirementId?: number | string
 }
 
+interface RequirementEditErrorPayload {
+  code?: string
+  details?: {
+    latest?: RequirementDetailResponse | null
+    reason?: string
+  }
+  error?: string
+}
+
 interface NormReferenceOption {
   id: number
   issuer: string
@@ -46,9 +59,12 @@ const EMPTY_FORM: RequirementFormFieldValues = {
 }
 
 export default function RequirementForm({
+  baseRevisionToken,
+  baseVersionId,
   initialData,
   initialNormReferenceIds,
   initialScenarioIds,
+  onRefreshLatest,
   requirementId,
   mode,
 }: RequirementFormProps) {
@@ -73,7 +89,11 @@ export default function RequirementForm({
   >([])
 
   const [submitting, setSubmitting] = useState(false)
+  const [isRefreshing, setIsRefreshing] = useState(false)
   const [error, setError] = useState<string | null>(null)
+  const [staleConflict, setStaleConflict] = useState<{
+    latest: RequirementDetailResponse | null
+  } | null>(null)
   const [saveDestination, setSaveDestination] = useState<'inline' | 'page'>(
     () => {
       try {
@@ -138,6 +158,7 @@ export default function RequirementForm({
     e.preventDefault()
     setSubmitting(true)
     setError(null)
+    setStaleConflict(null)
 
     try {
       const url =
@@ -156,6 +177,8 @@ export default function RequirementForm({
             : undefined,
           riskLevelId: form.riskLevelId ? Number(form.riskLevelId) : undefined,
           description: form.description || undefined,
+          baseRevisionToken: mode === 'edit' ? baseRevisionToken : undefined,
+          baseVersionId: mode === 'edit' ? baseVersionId : undefined,
           acceptanceCriteria: form.acceptanceCriteria || undefined,
           requiresTesting: form.requiresTesting,
           verificationMethod: form.requiresTesting
@@ -198,9 +221,18 @@ export default function RequirementForm({
           router.push(`/requirements?selected=${targetUniqueId}`)
         }
       } else {
-        const err = (await res.json().catch(() => null)) as {
-          error?: string
-        } | null
+        const err = (await res
+          .json()
+          .catch(() => null)) as RequirementEditErrorPayload | null
+        if (
+          res.status === 409 &&
+          err?.code === 'conflict' &&
+          err.details?.reason === 'stale_requirement_edit'
+        ) {
+          setStaleConflict({ latest: err.details.latest ?? null })
+          setError(null)
+          return
+        }
         setError(err?.error ?? res.statusText)
       }
     } catch (e) {
@@ -210,9 +242,32 @@ export default function RequirementForm({
     }
   }
 
+  const latestConflictVersion = staleConflict?.latest?.versions[0]
+  const latestConflictTarget = staleConflict?.latest?.uniqueId
+  const latestConflictHref = staleConflict?.latest
+    ? latestConflictVersion?.versionNumber
+      ? `/requirements/${latestConflictTarget}/${latestConflictVersion.versionNumber}`
+      : `/requirements/${latestConflictTarget}`
+    : null
+
+  const handleRefreshLatest = async () => {
+    if (!onRefreshLatest || isRefreshing) return
+    setIsRefreshing(true)
+    setError(null)
+    try {
+      await onRefreshLatest()
+      setStaleConflict(null)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : tc('error'))
+    } finally {
+      setIsRefreshing(false)
+    }
+  }
+
   const normReferenceCreateButton = (
     <button
       className="inline-flex items-center gap-1 text-sm text-primary-700 dark:text-primary-300 hover:underline min-h-11 min-w-11 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary-500 rounded"
+      disabled={isRefreshing}
       onClick={() => setShowCreateNormRef(true)}
       type="button"
     >
@@ -306,6 +361,48 @@ export default function RequirementForm({
           document.body,
         )}
 
+      {staleConflict && (
+        <div
+          className="mt-5 rounded-xl border border-amber-200 bg-amber-50/90 p-4 text-sm text-amber-800 dark:border-amber-800/70 dark:bg-amber-950/40 dark:text-amber-200"
+          role="alert"
+        >
+          <div className="flex items-start gap-3">
+            <AlertTriangle
+              aria-hidden="true"
+              className="mt-0.5 h-4 w-4 shrink-0 text-amber-500"
+            />
+            <div>
+              <p className="font-semibold">{t('staleEditConflict')}</p>
+              <p className="mt-1">{t('staleEditConflictHelp')}</p>
+              <div className="mt-3 flex flex-wrap gap-2">
+                {latestConflictHref && (
+                  <button
+                    className="inline-flex min-h-11 min-w-11 items-center gap-2 rounded-lg border border-amber-300 bg-white px-3 py-2 text-xs font-semibold text-amber-800 transition-colors hover:bg-amber-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-amber-500 disabled:cursor-not-allowed disabled:opacity-60 dark:border-amber-700 dark:bg-secondary-900 dark:text-amber-100 dark:hover:bg-amber-950"
+                    disabled={isRefreshing}
+                    onClick={() => router.push(latestConflictHref)}
+                    type="button"
+                  >
+                    <ExternalLink aria-hidden="true" className="h-3.5 w-3.5" />
+                    {t('staleEditViewLatest')}
+                  </button>
+                )}
+                {onRefreshLatest && (
+                  <button
+                    className="inline-flex min-h-11 min-w-11 items-center gap-2 rounded-lg border border-amber-300 bg-white px-3 py-2 text-xs font-semibold text-amber-800 transition-colors hover:bg-amber-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-amber-500 disabled:cursor-not-allowed disabled:opacity-60 dark:border-amber-700 dark:bg-secondary-900 dark:text-amber-100 dark:hover:bg-amber-950"
+                    disabled={isRefreshing}
+                    onClick={handleRefreshLatest}
+                    type="button"
+                  >
+                    <RotateCcw aria-hidden="true" className="h-3.5 w-3.5" />
+                    {isRefreshing ? tc('loading') : t('staleEditReload')}
+                  </button>
+                )}
+              </div>
+            </div>
+          </div>
+        </div>
+      )}
+
       {error && (
         <p className="mt-5 text-sm text-red-600 dark:text-red-400" role="alert">
           {error}
@@ -314,12 +411,16 @@ export default function RequirementForm({
 
       <div className="flex flex-col gap-3 pt-4 mt-5 border-t">
         <div className="flex items-center gap-3">
-          <button className="btn-primary" disabled={submitting} type="submit">
+          <button
+            className="btn-primary"
+            disabled={submitting || isRefreshing}
+            type="submit"
+          >
             {submitting ? tc('loading') : tc('save')}
           </button>
           <button
             className="px-4 py-2.5 rounded-xl border text-sm font-medium min-h-11 min-w-11 text-secondary-700 dark:text-secondary-300 hover:bg-secondary-50 dark:hover:bg-secondary-800 transition-all duration-200"
-            disabled={submitting}
+            disabled={submitting || isRefreshing}
             onClick={() => router.back()}
             type="button"
           >
@@ -333,7 +434,7 @@ export default function RequirementForm({
               aria-label={t('afterSaveInline')}
               aria-pressed={saveDestination === 'inline'}
               className={`min-h-11 min-w-11 px-3 py-1.5 transition-colors focus-visible:ring-2 focus-visible:ring-primary-400/50 focus-visible:ring-offset-2 ${saveDestination === 'inline' ? 'bg-primary-600 text-white' : 'bg-white dark:bg-secondary-800 hover:bg-secondary-50 dark:hover:bg-secondary-700'}`}
-              disabled={submitting}
+              disabled={submitting || isRefreshing}
               onClick={() => {
                 setSaveDestination('inline')
                 try {
@@ -350,7 +451,7 @@ export default function RequirementForm({
               aria-label={t('afterSavePage')}
               aria-pressed={saveDestination === 'page'}
               className={`min-h-11 min-w-11 px-3 py-1.5 transition-colors focus-visible:ring-2 focus-visible:ring-primary-400/50 focus-visible:ring-offset-2 ${saveDestination === 'page' ? 'bg-primary-600 text-white' : 'bg-white dark:bg-secondary-800 hover:bg-secondary-50 dark:hover:bg-secondary-700'}`}
-              disabled={submitting}
+              disabled={submitting || isRefreshing}
               onClick={() => {
                 setSaveDestination('page')
                 try {
diff --git a/cspell.jsonc b/cspell.jsonc
index c574f4238..0256fd081 100644
--- a/cspell.jsonc
+++ b/cspell.jsonc
@@ -13,6 +13,7 @@
     "DICOM",
     "focusable",
     "healthcheck",
+    "HOLDLOCK",
     "Kravpaketansvarig",
     "Kravpaketmedförfattare",
     "läsbehörighet",
@@ -35,6 +36,7 @@
     "tokenroller",
     "tokentyp",
     "Uppfyllnad",
+    "UPDLOCK",
     "upserted",
     "urllib",
     "urlopen",
diff --git a/docs/arkitekturbeskrivning-kravhantering.md b/docs/arkitekturbeskrivning-kravhantering.md
index 0c51e6e7f..ea66a9b25 100644
--- a/docs/arkitekturbeskrivning-kravhantering.md
+++ b/docs/arkitekturbeskrivning-kravhantering.md
@@ -981,6 +981,7 @@ Ubuntu 24.04 med följande förinstallerade verktyg:
 | TypeScript | 5.9 (strict) | Typkontroll |
 | Biome | 2.4 | Linting och formatering |
 | cSpell | 9.7 | Stavningskontroll (sv + en) |
+| dotenv-linter | 4.x | Kontroll av .env-filer |
 | markdownlint | — | Markdown-kvalitet |
 | Microsoft SQL Server | mssql/server image | Lokal databastjänst |
 
@@ -1002,6 +1003,7 @@ Alla kontroller samlas i ett enda kommando:
 npm run check
   ├── type-check      Typkontroll (tsc --noEmit)
   ├── lint:py         Python-typkontroll (Pyright strict)
+  ├── dotenv:check    Kontroll av .env-filer
   ├── format:check    Formateringskontroll (Biome)
   ├── spell:check     Stavningskontroll (cSpell)
   ├── lint            Linting (Biome strict)
diff --git a/docs/database-schema.md b/docs/database-schema.md
index 235c57fdf..91c5eb67b 100644
--- a/docs/database-schema.md
+++ b/docs/database-schema.md
@@ -195,6 +195,7 @@ erDiagram
 
     requirement_versions {
         integer id PK
+        text revision_token UK "uniqueidentifier"
         integer requirement_id FK
         integer version_number
         text description
@@ -896,13 +897,15 @@ the immutable properties; all mutable content lives in
 ### `requirement_versions`
 
 A **full snapshot** of a requirement at a specific
-version. Every edit creates a new version row, enabling
-complete audit history.
+version. Published edits create a new draft version row;
+draft edits update the latest draft in place under a revision-token
+precondition.
 
 <!-- markdownlint-disable MD013 -->
 | Column | Type | Description |
 | -------- | ------ | ------------- |
 | `id` | integer PK | Auto-increment primary key |
+| `revision_token` | uniqueidentifier | Opaque optimistic-concurrency token; changes whenever the version row changes |
 | `requirement_id` | integer FK → `requirements.id` | Parent requirement |
 | `version_number` | integer | Monotonically increasing version within the requirement |
 | `description` | text | The requirement specification text |
@@ -922,9 +925,10 @@ complete audit history.
 | `created_by` | text | User or system that created this version (nullable) |
 <!-- markdownlint-enable MD013 -->
 
-**Unique constraint:**
+**Unique constraints:**
 `uq_requirement_versions_requirement_id_version_number`
-on `(requirement_id, version_number)`.
+on `(requirement_id, version_number)`;
+`uq_requirement_versions_revision_token` on `revision_token`.
 **Indexes:** `idx_requirement_versions_requirement_id`.
 
 **Lifecycle invariant:** `created_at` < `published_at`
@@ -1279,6 +1283,7 @@ its purpose and the table/column(s) it covers.
 | `uq_requirement_list_column_defaults_sort_order` | `requirement_list_column_defaults` | `sort_order` | Ensures each default list position is assigned to exactly one column |
 | `uq_requirements_unique_id` | `requirements` | `unique_id` | Ensures each requirement has a distinct human-readable ID |
 | `uq_requirement_versions_requirement_id_version_number` | `requirement_versions` | `(requirement_id, version_number)` | Ensures version numbers are unique per requirement |
+| `uq_requirement_versions_revision_token` | `requirement_versions` | `revision_token` | Ensures each opaque edit token identifies one version row |
 | `uq_package_responsibility_areas_name_sv` | `package_responsibility_areas` | `name_sv` | Prevents duplicate Swedish responsibility area names |
 | `uq_package_responsibility_areas_name_en` | `package_responsibility_areas` | `name_en` | Prevents duplicate English responsibility area names |
 | `uq_owners_email` | `owners` | `email` | Prevents duplicate owner email addresses |
@@ -1417,6 +1422,7 @@ graph LR
     R -- "idx_requirements_is_archived\n(is_archived)" --> R
 
     RV -- "uq_..._requirement_id_version_number\n(requirement_id, version_number)" --> R
+    RV -- "uq_requirement_versions_revision_token\n(revision_token)" --> RV
     RV -- "idx_..._requirement_id\n(requirement_id)" --> R
 
     RVS -- "idx_..._usage_scenario_id\n(usage_scenario_id)" --> RSC
diff --git a/docs/lifecycle-workflow.md b/docs/lifecycle-workflow.md
index 72c6f8d63..d616a1132 100644
--- a/docs/lifecycle-workflow.md
+++ b/docs/lifecycle-workflow.md
@@ -20,7 +20,10 @@ stateDiagram-v2
 ```
 
 - **Draft:** Initial state. The requirement is being
-  authored or revised.
+  authored or revised. Saving an edit requires the latest version's
+  `id` as `baseVersionId` and opaque `revisionToken` as
+  `baseRevisionToken`; stale draft saves are rejected instead of
+  overwriting newer content.
 - **Review:** The requirement is under review. This state
   is used both for publishing review (Draft → Review) and
   archiving review (Published → Review). The system
diff --git a/docs/mcp-server-contributor-guide.md b/docs/mcp-server-contributor-guide.md
index 8648afd1c..f20391624 100644
--- a/docs/mcp-server-contributor-guide.md
+++ b/docs/mcp-server-contributor-guide.md
@@ -91,7 +91,12 @@ Combines:
 - requirement listing
 - free-text search
 - lookup tables for areas, categories, types, quality characteristics,
-  statuses, scenarios, and transitions
+  risk levels, statuses, scenarios, and transitions
+
+Requirement search supports pagination, sorting, archive inclusion, taxonomy
+filters, status/testing filters, norm-reference filters, and usage-scenario
+filters. Lookup catalogs ignore requirement-only filters except
+`typeId`, which filters the `quality_characteristics` catalog.
 
 This avoids a larger set of narrowly scoped read tools.
 
@@ -117,6 +122,13 @@ Supports:
 - `delete_draft`
 - `restore_version`
 
+Edit calls must first fetch the requirement with `view: "history"` and copy
+`requirement.versions[0].id` and `requirement.versions[0].revisionToken` into
+`requirement.baseVersionId` and
+`requirement.baseRevisionToken`. The shared service maps stale base-version
+tokens to `409 Conflict` details with `reason: "stale_requirement_edit"` and
+the latest requirement snapshot.
+
 The shared service also supports `reactivate` for REST parity, but that
 operation is intentionally not exposed as an MCP tool operation in v1.
 
diff --git a/docs/mcp-server-user-guide.md b/docs/mcp-server-user-guide.md
index c2c75d4b9..437c126d0 100644
--- a/docs/mcp-server-user-guide.md
+++ b/docs/mcp-server-user-guide.md
@@ -24,13 +24,17 @@ agents can use it reliably.
 
 - `requirements_query_catalog`
   List or search requirements and fetch lookup catalogs such as areas,
-  categories, types, type categories, statuses, scenarios, and transitions.
+  categories, types, quality characteristics, risk levels, statuses,
+  scenarios, and transitions.
 - `requirements_get_requirement`
   Fetch the current requirement detail, a specific version, or full version
   history.
 - `requirements_manage_requirement`
   Create, edit, archive, delete the latest draft, or restore a historical
-  version.
+  version. For `operation: "edit"`, first fetch the requirement with
+  `view: "history"` and pass `requirement.versions[0].id` and
+  `requirement.versions[0].revisionToken` back as
+  `requirement.baseVersionId` and `requirement.baseRevisionToken`.
 - `requirements_transition_requirement`
   Move a requirement through the lifecycle using a target status ID.
 
@@ -324,6 +328,13 @@ data first:
 This is especially useful because transitions use `toStatusId`, and creation or
 editing may require IDs for areas and classification fields.
 
+For edits, also fetch the requirement immediately before preparing the edit
+with `view: "history"`. Use `requirement.versions[0].id` as
+`requirement.baseVersionId` and `requirement.versions[0].revisionToken` as
+`requirement.baseRevisionToken`. If the server returns `409 Conflict` with
+`reason: "stale_requirement_edit"`, read the returned latest snapshot and
+compare before retrying.
+
 ### 2. Prefer `uniqueId`
 
 Use stable IDs such as `INT0001` when possible. The server still supports
@@ -385,8 +396,13 @@ tool. For requirement lists, it supports:
 - `categoryIds`
 - `typeIds`
 - `qualityCharacteristicIds`
+- `riskLevelIds`
+- `normReferenceIds`
+- `usageScenarioIds`
 - `statuses`
 - `requiresTesting`
+- `sortBy`
+- `sortDirection`
 
 ## Example Tasks
 
diff --git a/docs/version-lifecycle-dates.md b/docs/version-lifecycle-dates.md
index 0076006ab..42f83cee4 100644
--- a/docs/version-lifecycle-dates.md
+++ b/docs/version-lifecycle-dates.md
@@ -48,6 +48,12 @@ Editing is **not allowed** when the current version is in Review
 or Archived status. Review must first be moved back to Draft;
 Archived must be restored (which creates a new Draft version).
 
+Edit requests must include the `baseVersionId` and
+`baseRevisionToken` values that were current when editing started.
+The server treats those normalized fields as optimistic concurrency
+preconditions and rejects the save with `409 Conflict` if another save
+has changed the latest version row before the request arrives.
+
 ## When `edited_at` Is Updated
 
 `edited_at` is set **only** when user-initiated content fields
@@ -251,19 +257,23 @@ The version history pills show the relevant date per status:
   `published_at` and `archived_at` are `NULL`.
 - **Editing a requirement** (`editRequirement`): When the current
   version is Draft, updates the existing row in place with
-  `edited_at` set to the current time. When the current version
-  is Published, creates a new Draft version with `edited_at` set
-  to the current time. **Not allowed** when the current version
-  is in Review or Archived status.
+  `edited_at` set to the current time and rotates `revision_token`,
+  but only when the caller's `baseVersionId` and
+  `baseRevisionToken` still match the latest version row. When the
+  current version is Published, creates a new Draft version with
+  `edited_at` set to the current time after the same precondition
+  check. **Not allowed** when the current version is in Review or
+  Archived status.
 - **Transitioning status** (`transitionStatus`): In-place
   `UPDATE` on the existing version row. Sets `statusId` to the
   target status. Sets `published_at` or `archived_at` when
   transitioning to Published or Archived respectively.
-  **Never** touches `edited_at`. **Never** creates a new version
-  row. When publishing, auto-archives any previously published
-  version of the same requirement. For archived requirements
-  with a pending Draft or Review replacement, `is_archived`
-  stays `true` until that replacement version is published.
+  Rotates `revision_token` because the row changed, but **never**
+  touches `edited_at`. **Never** creates a new version row. When
+  publishing, auto-archives any previously published version of the
+  same requirement. For archived requirements with a pending Draft or
+  Review replacement, `is_archived` stays `true` until that
+  replacement version is published.
 - **Initiating archiving** (`initiateArchiving`): In-place
   `UPDATE` on the existing version row. Sets `statusId` to
   Review and `archive_initiated_at` to the current time.
diff --git a/lib/dal/requirements.ts b/lib/dal/requirements.ts
index cc10a4a2a..4bf641741 100644
--- a/lib/dal/requirements.ts
+++ b/lib/dal/requirements.ts
@@ -286,6 +286,7 @@ export async function listRequirements(
       CAST(requirement.is_archived AS int) AS isArchived,
       requirement.created_at AS createdAt,
       version.id AS versionId,
+      version.revision_token AS revisionToken,
       version.version_number AS versionNumber,
       version.description AS description,
       version.acceptance_criteria AS acceptanceCriteria,
@@ -358,6 +359,7 @@ export async function listRequirements(
     isArchived: toBool(row.isArchived),
     createdAt: toIso(row.createdAt) ?? '',
     versionId: Number(row.versionId),
+    revisionToken: String(row.revisionToken ?? '').toLowerCase(),
     versionNumber: Number(row.versionNumber),
     description: String(row.description ?? ''),
     acceptanceCriteria:
@@ -474,6 +476,8 @@ async function getNextVersionNumberSqlServer(
 
 interface RequirementMutationData {
   acceptanceCriteria?: string
+  baseRevisionToken?: string | null
+  baseVersionId?: number | null
   createdBy?: string
   description: string
   normReferenceIds?: number[]
@@ -535,6 +539,7 @@ interface VersionInsertedRow {
   requirementId: number
   requirementTypeId: number | null
   requiresTesting: boolean
+  revisionToken: string
   riskLevelId: number | null
   statusId: number
   verificationMethod: string | null
@@ -570,6 +575,7 @@ function mapVersion(row: Record<string, unknown>): VersionInsertedRow {
       row.verificationMethod == null ? null : String(row.verificationMethod),
     createdAt: toIso(row.createdAt) ?? '',
     editedAt: toIso(row.editedAt),
+    revisionToken: String(row.revisionToken ?? '').toLowerCase(),
     publishedAt: toIso(row.publishedAt),
     archivedAt: toIso(row.archivedAt),
     archiveInitiatedAt: toIso(row.archiveInitiatedAt),
@@ -590,6 +596,7 @@ const REQUIREMENT_OUTPUT = `
 const VERSION_OUTPUT = `
   OUTPUT
     INSERTED.id AS id,
+    INSERTED.revision_token AS revisionToken,
     INSERTED.requirement_id AS requirementId,
     INSERTED.version_number AS versionNumber,
     INSERTED.description AS description,
@@ -686,6 +693,7 @@ interface VersionLite {
   requirementCategoryId: number | null
   requirementTypeId: number | null
   requiresTesting: boolean
+  revisionToken: string
   riskLevelId: number | null
   statusId: number
   verificationMethod: string | null
@@ -694,10 +702,13 @@ interface VersionLite {
 async function getLatestVersionLite(
   tx: SqlServerTxExecutor,
   requirementId: number,
+  options: { lockForUpdate?: boolean } = {},
 ): Promise<VersionLite | null> {
+  const lockHint = options.lockForUpdate ? ' WITH (UPDLOCK, HOLDLOCK)' : ''
   const rows = (await tx.query(
     `SELECT TOP (1)
         id,
+        revision_token AS revisionToken,
         requirement_status_id AS statusId,
         archive_initiated_at AS archiveInitiatedAt,
         description,
@@ -709,7 +720,7 @@ async function getLatestVersionLite(
         CAST(is_testing_required AS int) AS requiresTesting,
         verification_method AS verificationMethod,
         created_by AS createdBy
-      FROM requirement_versions
+      FROM requirement_versions${lockHint}
       WHERE requirement_id = @0
       ORDER BY version_number DESC`,
     [requirementId],
@@ -718,6 +729,7 @@ async function getLatestVersionLite(
   const row = rows[0]
   return {
     id: Number(row.id),
+    revisionToken: String(row.revisionToken ?? '').toLowerCase(),
     statusId: Number(row.statusId),
     archiveInitiatedAt: toIso(row.archiveInitiatedAt),
     description: String(row.description ?? ''),
@@ -734,6 +746,51 @@ async function getLatestVersionLite(
   }
 }
 
+const GUID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+
+function normalizeBaseVersionId(value: number | null | undefined): number {
+  if (value == null || !Number.isInteger(value) || value <= 0) {
+    throw validationError('Edit operation requires requirement.baseVersionId', {
+      reason: 'missing_edit_precondition',
+    })
+  }
+  return value
+}
+
+function normalizeBaseRevisionToken(value: string | null | undefined): string {
+  if (value == null || value.trim() === '') {
+    throw validationError(
+      'Edit operation requires requirement.baseRevisionToken',
+      { reason: 'missing_edit_precondition' },
+    )
+  }
+  const normalized = value.trim().toLowerCase()
+  if (!GUID_PATTERN.test(normalized)) {
+    throw validationError(
+      'Edit operation requires a valid requirement.baseRevisionToken GUID',
+      { reason: 'invalid_edit_precondition' },
+    )
+  }
+  return normalized
+}
+
+function staleRequirementEditError(
+  requirementId: number,
+  baseVersionId: number,
+  latestVersionId: number,
+): ReturnType<typeof conflictError> {
+  return conflictError(
+    'This requirement was updated after you started editing. Refresh to review the latest version before saving.',
+    {
+      baseVersionId,
+      latestVersionId,
+      reason: 'stale_requirement_edit',
+      requirementId,
+    },
+  )
+}
+
 export async function editRequirement(
   db: SqlServerDatabase,
   requirementId: number,
@@ -743,6 +800,8 @@ export async function editRequirement(
 ): Promise<VersionInsertedRow> {
   const scenarioIds = uniqueIds(data.scenarioIds)
   const normRefIds = uniqueIds(data.normReferenceIds)
+  const baseVersionId = normalizeBaseVersionId(data.baseVersionId)
+  const baseRevisionToken = normalizeBaseRevisionToken(data.baseRevisionToken)
   const now = new Date()
   const verificationMethod = data.requiresTesting
     ? (data.verificationMethod ?? null)
@@ -750,15 +809,30 @@ export async function editRequirement(
 
   let result!: VersionInsertedRow
 
-  await db.transaction(async manager => {
+  await db.transaction('SERIALIZABLE', async manager => {
     const tx: SqlServerTxExecutor = {
       query: (sql, params) => manager.query(sql, params),
     }
+    const updateRequirementArea = async (): Promise<void> => {
+      if (data.requirementAreaId == null) return
+      await tx.query(
+        `UPDATE requirements SET requirement_area_id = @0 WHERE id = @1`,
+        [data.requirementAreaId, requirementId],
+      )
+    }
 
-    const current = await getLatestVersionLite(tx, requirementId)
+    const current = await getLatestVersionLite(tx, requirementId, {
+      lockForUpdate: true,
+    })
     if (!current) {
       throw notFoundError('No version found for requirement')
     }
+    if (
+      current.id !== baseVersionId ||
+      current.revisionToken !== baseRevisionToken
+    ) {
+      throw staleRequirementEditError(requirementId, baseVersionId, current.id)
+    }
     if (current.statusId === STATUS_REVIEW) {
       throw conflictError('Cannot edit a requirement in Review status')
     }
@@ -768,13 +842,6 @@ export async function editRequirement(
       )
     }
 
-    if (data.requirementAreaId != null) {
-      await tx.query(
-        `UPDATE requirements SET requirement_area_id = @0 WHERE id = @1`,
-        [data.requirementAreaId, requirementId],
-      )
-    }
-
     if (current.statusId === STATUS_DRAFT) {
       const updateRows = (await tx.query(
         `UPDATE requirement_versions
@@ -786,9 +853,11 @@ export async function editRequirement(
               risk_level_id = @5,
               is_testing_required = @6,
               verification_method = @7,
-              edited_at = @8
+              edited_at = @8,
+              revision_token = NEWID()
           ${VERSION_OUTPUT}
-          WHERE id = @9`,
+          WHERE id = @9
+            AND revision_token = CONVERT(uniqueidentifier, @10)`,
         [
           data.description,
           data.acceptanceCriteria ?? null,
@@ -799,11 +868,20 @@ export async function editRequirement(
           data.requiresTesting ? 1 : 0,
           verificationMethod,
           now,
-          current.id,
+          baseVersionId,
+          baseRevisionToken,
         ],
       )) as Array<Record<string, unknown>>
+      if (!updateRows[0]) {
+        throw staleRequirementEditError(
+          requirementId,
+          baseVersionId,
+          current.id,
+        )
+      }
       result = mapVersion(updateRows[0] ?? {})
 
+      await updateRequirementArea()
       await tx.query(
         `DELETE FROM requirement_version_usage_scenarios WHERE requirement_version_id = @0`,
         [current.id],
@@ -821,6 +899,7 @@ export async function editRequirement(
       tx,
       requirementId,
     )
+    await updateRequirementArea()
     const insertRows = (await tx.query(
       `INSERT INTO requirement_versions (
           requirement_id, version_number, description, acceptance_criteria,
@@ -887,7 +966,9 @@ export async function initiateArchiving(
   const now = new Date()
   await db.query(
     `UPDATE requirement_versions
-      SET requirement_status_id = ${STATUS_REVIEW}, archive_initiated_at = @0
+      SET requirement_status_id = ${STATUS_REVIEW},
+          archive_initiated_at = @0,
+          revision_token = NEWID()
       WHERE id = @1`,
     [now, publishedId],
   )
@@ -923,7 +1004,8 @@ export async function approveArchiving(
       `UPDATE requirement_versions
         SET requirement_status_id = ${STATUS_ARCHIVED},
             archived_at = @0,
-            archive_initiated_at = NULL
+            archive_initiated_at = NULL,
+            revision_token = NEWID()
         WHERE id = @1`,
       [now, versionId],
     )
@@ -950,7 +1032,9 @@ export async function cancelArchiving(
   }
   await db.query(
     `UPDATE requirement_versions
-      SET requirement_status_id = ${STATUS_PUBLISHED}, archive_initiated_at = NULL
+      SET requirement_status_id = ${STATUS_PUBLISHED},
+          archive_initiated_at = NULL,
+          revision_token = NEWID()
       WHERE id = @0`,
     [Number(rows[0].id)],
   )
@@ -1079,7 +1163,9 @@ export async function transitionStatus(
       params.P_published = now
       await tx.query(
         `UPDATE requirement_versions
-          SET requirement_status_id = ${STATUS_ARCHIVED}, archived_at = @0
+          SET requirement_status_id = ${STATUS_ARCHIVED},
+              archived_at = @0,
+              revision_token = NEWID()
           WHERE requirement_id = @1 AND requirement_status_id = ${STATUS_PUBLISHED}`,
         [now, requirementId],
       )
@@ -1117,7 +1203,7 @@ export async function transitionStatus(
     const idParamIndex = positionalValues.length - 1
 
     const updateRows = (await tx.query(
-      `UPDATE requirement_versions SET ${resolvedSets} ${VERSION_OUTPUT} WHERE id = @${idParamIndex}`,
+      `UPDATE requirement_versions SET ${resolvedSets}, revision_token = NEWID() ${VERSION_OUTPUT} WHERE id = @${idParamIndex}`,
       positionalValues,
     )) as Array<Record<string, unknown>>
     if (!updateRows[0]) {
@@ -1243,6 +1329,7 @@ export async function getVersionHistory(
   const rows = (await db.query(
     `SELECT
         version.id AS id,
+        version.revision_token AS revisionToken,
         version.requirement_id AS requirementId,
         version.version_number AS versionNumber,
         version.description AS description,
@@ -1319,6 +1406,7 @@ export async function getVersionHistory(
     const statusRowId = toNum(row.statusRowId)
     return {
       id: versionId,
+      revisionToken: String(row.revisionToken ?? '').toLowerCase(),
       requirementId: Number(row.requirementId),
       versionNumber: Number(row.versionNumber),
       description: String(row.description ?? ''),
@@ -1410,6 +1498,7 @@ export async function getRequirementById(db: SqlServerDatabase, id: number) {
   const versionRows = (await db.query(
     `SELECT
         version.id AS id,
+        version.revision_token AS revisionToken,
         version.requirement_id AS requirementId,
         version.version_number AS versionNumber,
         version.description AS description,
@@ -1541,6 +1630,7 @@ export async function getRequirementById(db: SqlServerDatabase, id: number) {
     const statusRowId = toNum(row.statusRowId)
     return {
       id: vId,
+      revisionToken: String(row.revisionToken ?? '').toLowerCase(),
       requirementId: Number(row.requirementId),
       versionNumber: Number(row.versionNumber),
       description: String(row.description ?? ''),
diff --git a/lib/mcp/server.ts b/lib/mcp/server.ts
index 54c28c46b..cfa7062fa 100644
--- a/lib/mcp/server.ts
+++ b/lib/mcp/server.ts
@@ -48,40 +48,167 @@ const PaginationSchema = z
   })
   .strict()
 
+const ResponseFormatSchema = z
+  .enum(['json', 'markdown'])
+  .default('markdown')
+  .describe('Use "json" for machine-readable text, or "markdown" for display.')
+
+const ResponseLocaleSchema = z
+  .enum(['en', 'sv'])
+  .default('en')
+  .describe('Response language for names and messages.')
+
 const QueryCatalogOutputSchema = z
   .object({
-    catalog: z.string(),
-    items: z.array(z.record(z.string(), z.unknown())),
+    catalog: z
+      .enum([
+        'requirements',
+        'areas',
+        'categories',
+        'types',
+        'quality_characteristics',
+        'risk_levels',
+        'statuses',
+        'scenarios',
+        'transitions',
+      ])
+      .describe('Catalog that was returned.'),
+    items: z
+      .array(z.record(z.string(), z.unknown()))
+      .describe('Catalog rows. Shape depends on the selected catalog.'),
     message: z.string(),
-    pagination: PaginationSchema.nullable(),
+    pagination: PaginationSchema.nullable().describe(
+      'Pagination metadata for catalog "requirements"; null for lookup catalogs.',
+    ),
   })
   .strict()
 
+const RequirementVersionOutputSchema = z
+  .record(z.string(), z.unknown())
+  .describe(
+    'Requirement version object. Includes numeric id and opaque revisionToken. For edit preconditions, fetch requirements_get_requirement with view: "history" and use requirement.versions[0].id as requirement.baseVersionId plus requirement.versions[0].revisionToken as requirement.baseRevisionToken.',
+  )
+
+const RequirementDetailOutputSchema = z
+  .record(z.string(), z.unknown())
+  .describe(
+    'Requirement detail object. Its versions array contains selected version objects; with view: "history", requirement.versions[0] is the latest overall version and the edit base.',
+  )
+
 const GetRequirementOutputSchema = z
   .object({
     message: z.string(),
-    requirement: z.record(z.string(), z.unknown()),
+    requirement: RequirementDetailOutputSchema,
     requirementResourceUri: z.string(),
     requirementViewUri: z.string(),
-    version: z.record(z.string(), z.unknown()).optional(),
-    versions: z.array(z.record(z.string(), z.unknown())).optional(),
+    version: RequirementVersionOutputSchema.optional().describe(
+      'Requested version object when view is "version". Includes revisionToken.',
+    ),
+    versions: z
+      .array(RequirementVersionOutputSchema)
+      .optional()
+      .describe(
+        'All version objects when view is "history"; versions[0] is the latest overall version and includes id plus revisionToken for edit base fields.',
+      ),
   })
   .strict()
 
 const ManageRequirementOutputSchema = z
   .object({
-    detail: z.record(z.string(), z.unknown()).optional(),
+    detail: RequirementDetailOutputSchema.optional().describe(
+      'Updated requirement snapshot. On stale edit conflicts, error details.latest contains the latest snapshot with revisionToken.',
+    ),
     message: z.string(),
     operation: z.string(),
-    result: z.record(z.string(), z.unknown()),
+    result: z
+      .record(z.string(), z.unknown())
+      .describe(
+        'Operation result. Edit results include the updated version id.',
+      ),
   })
   .strict()
 
 const TransitionRequirementOutputSchema = z
   .object({
-    detail: z.record(z.string(), z.unknown()),
+    detail: RequirementDetailOutputSchema,
+    message: z.string(),
+    version: RequirementVersionOutputSchema.describe(
+      'Transitioned version object with the newly rotated revisionToken.',
+    ),
+  })
+  .strict()
+
+const ListSuggestionsOutputSchema = z
+  .object({
+    counts: z
+      .object({
+        dismissed: z.number(),
+        pending: z.number(),
+        resolved: z.number(),
+        total: z.number(),
+      })
+      .strict(),
+    message: z.string(),
+    suggestions: z.array(
+      z
+        .object({
+          content: z.string(),
+          createdAt: z.string(),
+          createdBy: z.string().nullable(),
+          id: z.number(),
+          isReviewRequested: z.number(),
+          requirementId: z.number(),
+          requirementVersionId: z.number().nullable(),
+          resolution: z.number().nullable(),
+          resolutionMotivation: z.string().nullable(),
+          resolvedAt: z.string().nullable(),
+          resolvedBy: z.string().nullable(),
+          updatedAt: z.string().nullable(),
+        })
+        .strict(),
+    ),
+  })
+  .strict()
+
+const ManageSuggestionOutputSchema = z
+  .object({
     message: z.string(),
-    version: z.record(z.string(), z.unknown()),
+    result: z
+      .record(z.string(), z.unknown())
+      .describe('Created or updated suggestion data, or an operation result.'),
+  })
+  .strict()
+
+const GeneratedRequirementOutputSchema = z
+  .object({
+    acceptanceCriteria: z.string().nullable().optional(),
+    categoryId: z.number().optional(),
+    description: z.string(),
+    qualityCharacteristicId: z.number().optional(),
+    rationale: z.string(),
+    requiresTesting: z.boolean(),
+    riskLevelId: z.number().optional(),
+    scenarioIds: z.array(z.number()).optional(),
+    typeId: z.number(),
+    verificationMethod: z.string().nullable().optional(),
+  })
+  .strict()
+
+const GenerateRequirementsOutputSchema = z
+  .object({
+    message: z.string(),
+    model: z.string(),
+    requirements: z.array(GeneratedRequirementOutputSchema),
+    stats: z
+      .object({
+        completionTokens: z.number(),
+        cost: z.number(),
+        promptTokens: z.number(),
+        reasoningTokens: z.number(),
+        totalTokens: z.number(),
+      })
+      .strict(),
+    thinking: z.string(),
   })
   .strict()
 
@@ -357,7 +484,12 @@ function renderRequirementHtml(
 function createQueryCatalogSchema() {
   return z
     .object({
-      areaIds: z.array(z.number().int().positive()).optional(),
+      areaIds: z
+        .array(z.number().int().positive())
+        .optional()
+        .describe(
+          'Requirement area IDs. Applies only to catalog "requirements".',
+        ),
       catalog: z
         .enum([
           'requirements',
@@ -365,25 +497,126 @@ function createQueryCatalogSchema() {
           'categories',
           'types',
           'quality_characteristics',
+          'risk_levels',
           'statuses',
           'scenarios',
           'transitions',
         ])
-        .default('requirements'),
-      categoryIds: z.array(z.number().int().positive()).optional(),
-      descriptionSearch: z.string().max(200).optional(),
-      includeArchived: z.boolean().optional(),
-      limit: z.number().int().min(1).max(50).default(20),
-      locale: z.enum(['en', 'sv']).default('en'),
-      offset: z.number().int().min(0).default(0),
-      requiresTesting: z.array(z.boolean()).optional(),
-      responseFormat: z.enum(['json', 'markdown']).default('markdown'),
-      statuses: z.array(z.number().int().positive()).optional(),
-      qualityCharacteristicIds: z.array(z.number().int().positive()).optional(),
-      riskLevelIds: z.array(z.number().int().positive()).optional(),
-      typeId: z.number().int().positive().optional(),
-      typeIds: z.array(z.number().int().positive()).optional(),
-      uniqueIdSearch: z.string().max(100).optional(),
+        .default('requirements')
+        .describe(
+          'Catalog to return. Use "requirements" for paged requirement search; lookup catalogs ignore requirement filters.',
+        ),
+      categoryIds: z
+        .array(z.number().int().positive())
+        .optional()
+        .describe(
+          'Requirement category IDs. Applies only to catalog "requirements".',
+        ),
+      descriptionSearch: z
+        .string()
+        .max(200)
+        .optional()
+        .describe(
+          'Case-insensitive substring filter on requirement description. Applies only to catalog "requirements".',
+        ),
+      includeArchived: z
+        .boolean()
+        .optional()
+        .describe(
+          'Whether archived requirements are included. Applies only to catalog "requirements".',
+        ),
+      limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(50)
+        .default(20)
+        .describe('Page size for catalog "requirements"; maximum 50.'),
+      locale: ResponseLocaleSchema,
+      normReferenceIds: z
+        .array(z.number().int().positive())
+        .optional()
+        .describe(
+          'Norm reference IDs. Applies only to catalog "requirements".',
+        ),
+      offset: z
+        .number()
+        .int()
+        .min(0)
+        .default(0)
+        .describe('Zero-based offset for catalog "requirements".'),
+      qualityCharacteristicIds: z
+        .array(z.number().int().positive())
+        .optional()
+        .describe(
+          'Quality characteristic IDs. Applies only to catalog "requirements".',
+        ),
+      requiresTesting: z
+        .array(z.boolean())
+        .optional()
+        .describe(
+          'Filter by testing requirement. Applies only to catalog "requirements".',
+        ),
+      responseFormat: ResponseFormatSchema,
+      riskLevelIds: z
+        .array(z.number().int().positive())
+        .optional()
+        .describe('Risk level IDs. Applies only to catalog "requirements".'),
+      sortBy: z
+        .enum([
+          'uniqueId',
+          'description',
+          'area',
+          'category',
+          'type',
+          'qualityCharacteristic',
+          'riskLevel',
+          'status',
+          'version',
+        ])
+        .optional()
+        .describe(
+          'Sort field for catalog "requirements". Defaults to uniqueId.',
+        ),
+      sortDirection: z
+        .enum(['asc', 'desc'])
+        .optional()
+        .describe(
+          'Sort direction for catalog "requirements". Defaults to asc.',
+        ),
+      statuses: z
+        .array(z.number().int().positive())
+        .optional()
+        .describe(
+          'Requirement status IDs. Applies only to catalog "requirements".',
+        ),
+      typeId: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe(
+          'Requirement type ID used only to filter catalog "quality_characteristics".',
+        ),
+      typeIds: z
+        .array(z.number().int().positive())
+        .optional()
+        .describe(
+          'Requirement type IDs. Applies only to catalog "requirements".',
+        ),
+      uniqueIdSearch: z
+        .string()
+        .max(100)
+        .optional()
+        .describe(
+          'Case-insensitive substring filter on requirement uniqueId. Applies only to catalog "requirements".',
+        ),
+      usageScenarioIds: z
+        .array(z.number().int().positive())
+        .optional()
+        .describe(
+          'Usage scenario IDs. Applies only to catalog "requirements".',
+        ),
     })
     .strict()
 }
@@ -391,63 +624,271 @@ function createQueryCatalogSchema() {
 function createGetRequirementSchema() {
   return z
     .object({
-      id: z.number().int().positive().optional(),
-      locale: z.enum(['en', 'sv']).default('en'),
-      responseFormat: z.enum(['json', 'markdown']).default('markdown'),
-      uniqueId: z.string().max(64).optional(),
-      versionNumber: z.number().int().positive().optional(),
-      view: z.enum(['detail', 'history', 'version']).default('detail'),
+      id: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe('Numeric requirement ID. Use either id or uniqueId.'),
+      locale: ResponseLocaleSchema,
+      responseFormat: ResponseFormatSchema,
+      uniqueId: z
+        .string()
+        .max(64)
+        .optional()
+        .describe('Stable requirement ID, e.g. "REQ-001".'),
+      versionNumber: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe('Required when view is "version".'),
+      view: z
+        .enum(['detail', 'history', 'version'])
+        .default('detail')
+        .describe(
+          'Use "detail" for the latest published version, "version" with versionNumber for one historical version, or "history" before editing so requirement.versions[0] is the latest overall version.',
+        ),
     })
     .strict()
+    .superRefine((val, ctx) => {
+      if ((val.id == null) === (val.uniqueId == null)) {
+        ctx.addIssue({
+          code: 'custom',
+          message: 'Provide exactly one of id or uniqueId.',
+          path: ['id'],
+        })
+      }
+      if (val.view === 'version' && val.versionNumber == null) {
+        ctx.addIssue({
+          code: 'custom',
+          message: 'versionNumber is required when view is "version".',
+          path: ['versionNumber'],
+        })
+      }
+    })
 }
 
 const RequirementMutationSchema = z
   .object({
-    acceptanceCriteria: z.string().max(4000).optional(),
-    areaId: z.number().int().positive().optional(),
-    categoryId: z.number().int().positive().optional(),
-    createdBy: z.string().max(200).optional(),
-    description: z.string().max(4000).optional(),
-    requiresTesting: z.boolean().optional(),
-    verificationMethod: z.string().max(4000).optional(),
-    scenarioIds: z.array(z.number().int().positive()).optional(),
-    normReferenceIds: z.array(z.number().int().positive()).optional(),
-    qualityCharacteristicId: z.number().int().positive().optional(),
-    riskLevelId: z.number().int().positive().optional(),
-    typeId: z.number().int().positive().optional(),
+    acceptanceCriteria: z
+      .string()
+      .max(4000)
+      .optional()
+      .describe('Acceptance criteria text for the requirement version.'),
+    areaId: z
+      .number()
+      .int()
+      .positive()
+      .optional()
+      .describe('Requirement area ID. Required when creating.'),
+    baseRevisionToken: z
+      .uuid()
+      .optional()
+      .describe(
+        'Required for operation "edit". First call requirements_get_requirement with view: "history", then copy requirement.versions[0].revisionToken.',
+      ),
+    baseVersionId: z
+      .number()
+      .int()
+      .positive()
+      .optional()
+      .describe(
+        'Required for operation "edit". First call requirements_get_requirement with view: "history", then copy requirement.versions[0].id.',
+      ),
+    categoryId: z
+      .number()
+      .int()
+      .positive()
+      .optional()
+      .describe('Requirement category ID.'),
+    createdBy: z
+      .string()
+      .max(200)
+      .optional()
+      .describe('Optional actor/user label for the created or edited version.'),
+    description: z
+      .string()
+      .max(4000)
+      .optional()
+      .describe('Requirement description text. Required for create and edit.'),
+    requiresTesting: z
+      .boolean()
+      .optional()
+      .describe('Whether the requirement must be verified by test.'),
+    verificationMethod: z
+      .string()
+      .max(4000)
+      .optional()
+      .describe(
+        'How the requirement should be verified when requiresTesting is true.',
+      ),
+    scenarioIds: z
+      .array(z.number().int().positive())
+      .optional()
+      .describe('Usage scenario IDs linked to the version.'),
+    normReferenceIds: z
+      .array(z.number().int().positive())
+      .optional()
+      .describe('Norm reference IDs linked to the version.'),
+    qualityCharacteristicId: z
+      .number()
+      .int()
+      .positive()
+      .optional()
+      .describe('Quality characteristic ID.'),
+    riskLevelId: z
+      .number()
+      .int()
+      .positive()
+      .optional()
+      .describe('Risk level ID.'),
+    typeId: z
+      .number()
+      .int()
+      .positive()
+      .optional()
+      .describe('Requirement type ID.'),
   })
   .strict()
 
 function createManageRequirementSchema() {
   return z
     .object({
-      id: z.number().int().positive().optional(),
-      locale: z.enum(['en', 'sv']).default('en'),
-      operation: z.enum([
-        'archive',
-        'create',
-        'delete_draft',
-        'edit',
-        'restore_version',
-      ]),
-      requirement: RequirementMutationSchema.optional(),
-      responseFormat: z.enum(['json', 'markdown']).default('markdown'),
-      uniqueId: z.string().max(64).optional(),
-      versionNumber: z.number().int().positive().optional(),
+      id: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe(
+          'Numeric requirement ID. Required for non-create operations when uniqueId is not provided.',
+        ),
+      locale: ResponseLocaleSchema,
+      operation: z
+        .enum(['archive', 'create', 'delete_draft', 'edit', 'restore_version'])
+        .describe(
+          'Operation to perform. Create has no existing requirement ID; all other operations require id or uniqueId.',
+        ),
+      requirement: RequirementMutationSchema.optional().describe(
+        'Requirement fields for create/edit. For create, pass at least requirement.areaId and requirement.description; optional fields include acceptanceCriteria, typeId, categoryId, qualityCharacteristicId, riskLevelId, requiresTesting, verificationMethod, scenarioIds, normReferenceIds, and createdBy. For edit, first call requirements_get_requirement with view: "history" and copy requirement.versions[0].id to baseVersionId plus requirement.versions[0].revisionToken to baseRevisionToken.',
+      ),
+      responseFormat: ResponseFormatSchema,
+      uniqueId: z
+        .string()
+        .max(64)
+        .optional()
+        .describe(
+          'Stable requirement ID, e.g. "REQ-001". Required for non-create operations when id is not provided.',
+        ),
+      versionNumber: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe('Required for operation "restore_version".'),
     })
     .strict()
+    .superRefine((val, ctx) => {
+      if (
+        val.operation !== 'create' &&
+        (val.id == null) === (val.uniqueId == null)
+      ) {
+        ctx.addIssue({
+          code: 'custom',
+          message: 'Provide exactly one of id or uniqueId for this operation.',
+          path: ['id'],
+        })
+      }
+
+      if (val.operation === 'create') {
+        if (!val.requirement?.areaId) {
+          ctx.addIssue({
+            code: 'custom',
+            message: 'requirement.areaId is required for operation "create".',
+            path: ['requirement', 'areaId'],
+          })
+        }
+        if (!val.requirement?.description) {
+          ctx.addIssue({
+            code: 'custom',
+            message:
+              'requirement.description is required for operation "create".',
+            path: ['requirement', 'description'],
+          })
+        }
+      }
+
+      if (val.operation === 'edit') {
+        if (!val.requirement?.description) {
+          ctx.addIssue({
+            code: 'custom',
+            message:
+              'requirement.description is required for operation "edit".',
+            path: ['requirement', 'description'],
+          })
+        }
+        if (val.requirement?.baseVersionId == null) {
+          ctx.addIssue({
+            code: 'custom',
+            message:
+              'requirement.baseVersionId is required for operation "edit".',
+            path: ['requirement', 'baseVersionId'],
+          })
+        }
+        if (val.requirement?.baseRevisionToken == null) {
+          ctx.addIssue({
+            code: 'custom',
+            message:
+              'requirement.baseRevisionToken is required for operation "edit".',
+            path: ['requirement', 'baseRevisionToken'],
+          })
+        }
+      }
+
+      if (val.operation === 'restore_version' && val.versionNumber == null) {
+        ctx.addIssue({
+          code: 'custom',
+          message: 'versionNumber is required for operation "restore_version".',
+          path: ['versionNumber'],
+        })
+      }
+    })
 }
 
 function createTransitionRequirementSchema() {
   return z
     .object({
-      id: z.number().int().positive().optional(),
-      locale: z.enum(['en', 'sv']).default('en'),
-      responseFormat: z.enum(['json', 'markdown']).default('markdown'),
-      toStatusId: z.number().int().positive(),
-      uniqueId: z.string().max(64).optional(),
+      id: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe('Numeric requirement ID. Use either id or uniqueId.'),
+      locale: ResponseLocaleSchema,
+      responseFormat: ResponseFormatSchema,
+      toStatusId: z
+        .number()
+        .int()
+        .positive()
+        .describe(
+          'Target requirement status ID. Use requirements_query_catalog with catalog "transitions" or "statuses" before choosing this value.',
+        ),
+      uniqueId: z
+        .string()
+        .max(64)
+        .optional()
+        .describe('Stable requirement ID, e.g. "REQ-001".'),
     })
     .strict()
+    .superRefine((val, ctx) => {
+      if ((val.id == null) === (val.uniqueId == null)) {
+        ctx.addIssue({
+          code: 'custom',
+          message: 'Provide exactly one of id or uniqueId.',
+          path: ['id'],
+        })
+      }
+    })
 }
 
 function toCatalogInput(
@@ -461,15 +902,19 @@ function toCatalogInput(
     includeArchived: input.includeArchived,
     limit: input.limit,
     locale: toResponseLocale(input.locale),
+    normReferenceIds: input.normReferenceIds,
     offset: input.offset,
     requiresTesting: input.requiresTesting,
     responseFormat: toResponseFormat(input.responseFormat),
+    sortBy: input.sortBy,
+    sortDirection: input.sortDirection,
     statuses: input.statuses,
     qualityCharacteristicIds: input.qualityCharacteristicIds,
     riskLevelIds: input.riskLevelIds,
     typeId: input.typeId,
     typeIds: input.typeIds,
     uniqueIdSearch: input.uniqueIdSearch,
+    usageScenarioIds: input.usageScenarioIds,
   }
 }
 
@@ -667,7 +1112,7 @@ export function createKravhanteringMcpServer(
         readOnlyHint: true,
       },
       description:
-        'List or search requirements and supporting lookup catalogs such as areas, categories, types, scenarios, statuses, and transitions.',
+        'List/search paginated requirements or fetch lookup catalogs: areas, categories, types, quality_characteristics, risk_levels, statuses, scenarios, and transitions. Requirement filters, sorting, limit, and offset apply only when catalog is "requirements".',
       inputSchema: createQueryCatalogSchema(),
       outputSchema: QueryCatalogOutputSchema,
       title: 'Query Requirements Catalog',
@@ -703,7 +1148,7 @@ export function createKravhanteringMcpServer(
         readOnlyHint: true,
       },
       description:
-        'Fetch the current requirement detail, a specific version, or the full version history by stable requirement ID.',
+        'Fetch the current requirement detail, a specific version, or the full version history by stable requirement ID. Before editing, call with view: "history" and use requirement.versions[0].id plus requirement.versions[0].revisionToken as the edit base.',
       inputSchema: createGetRequirementSchema(),
       outputSchema: GetRequirementOutputSchema,
       title: 'Get Requirement',
@@ -746,7 +1191,7 @@ export function createKravhanteringMcpServer(
         readOnlyHint: false,
       },
       description:
-        'Create, edit, archive, delete a latest draft, or restore a historical requirement version.',
+        'Create, edit, archive, delete a latest draft, or restore a historical requirement version. For operation "create", pass requirement.areaId and requirement.description, plus optional classification/verification fields. For operation "edit", first call requirements_get_requirement with view: "history", then pass requirement.versions[0].id as requirement.baseVersionId and requirement.versions[0].revisionToken as requirement.baseRevisionToken.',
       inputSchema: createManageRequirementSchema(),
       outputSchema: ManageRequirementOutputSchema,
       title: 'Manage Requirement',
@@ -820,7 +1265,7 @@ export function createKravhanteringMcpServer(
         readOnlyHint: false,
       },
       description:
-        'Transition a requirement version through the lifecycle states defined in requirement_status_transitions.',
+        'Transition a requirement version through the lifecycle states defined in requirement_status_transitions. A transition rotates the version revisionToken; refetch with requirements_get_requirement before a later edit.',
       inputSchema: createTransitionRequirementSchema(),
       outputSchema: TransitionRequirementOutputSchema,
       title: 'Transition Requirement',
@@ -1183,16 +1628,17 @@ export function createKravhanteringMcpServer(
         'List improvement suggestions for a specific requirement. Identify the requirement by numeric requirementId or by uniqueId (e.g. "REQ-001").',
       inputSchema: z
         .object({
-          locale: z.enum(['en', 'sv']).default('en'),
+          locale: ResponseLocaleSchema,
           requirementId: z
             .number()
             .int()
             .positive()
             .optional()
             .describe('Numeric ID of the requirement.'),
-          responseFormat: z.enum(['json', 'markdown']).default('markdown'),
+          responseFormat: ResponseFormatSchema,
           uniqueId: z
             .string()
+            .max(64)
             .optional()
             .describe('Unique requirement ID, e.g. "REQ-001".'),
         })
@@ -1205,6 +1651,7 @@ export function createKravhanteringMcpServer(
             })
           }
         }),
+      outputSchema: ListSuggestionsOutputSchema,
       title: 'List Improvement Suggestions for Requirement',
     },
     async input => {
@@ -1246,10 +1693,12 @@ export function createKravhanteringMcpServer(
         .object({
           content: z
             .string()
+            .max(4000)
             .optional()
             .describe('Suggestion text content. Required for create and edit.'),
           createdBy: z
             .string()
+            .max(200)
             .optional()
             .describe('Who created the suggestion.'),
           suggestionId: z
@@ -1260,16 +1709,18 @@ export function createKravhanteringMcpServer(
             .describe(
               'Numeric suggestion ID. Required for all operations except create.',
             ),
-          locale: z.enum(['en', 'sv']).default('en'),
-          operation: z.enum([
-            'create',
-            'delete',
-            'dismiss',
-            'edit',
-            'request_review',
-            'resolve',
-            'revert_to_draft',
-          ]),
+          locale: ResponseLocaleSchema,
+          operation: z
+            .enum([
+              'create',
+              'delete',
+              'dismiss',
+              'edit',
+              'request_review',
+              'resolve',
+              'revert_to_draft',
+            ])
+            .describe('Suggestion operation to perform.'),
           requirementId: z
             .number()
             .int()
@@ -1284,13 +1735,17 @@ export function createKravhanteringMcpServer(
             .describe('Optional version ID to link the suggestion to.'),
           resolutionMotivation: z
             .string()
+            .max(4000)
             .optional()
-            .describe('Motivation text for resolve/dismiss.'),
+            .describe('Motivation text. Required for resolve and dismiss.'),
           resolvedBy: z
             .string()
+            .max(200)
             .optional()
-            .describe('Who resolved/dismissed the suggestion.'),
-          responseFormat: z.enum(['json', 'markdown']).default('markdown'),
+            .describe(
+              'Who resolved/dismissed the suggestion. Required for resolve/dismiss when the request actor has no ID.',
+            ),
+          responseFormat: ResponseFormatSchema,
         })
         .strict()
         .superRefine((data, ctx) => {
@@ -1298,14 +1753,14 @@ export function createKravhanteringMcpServer(
             case 'create':
               if (!data.requirementId) {
                 ctx.addIssue({
-                  code: z.ZodIssueCode.custom,
+                  code: 'custom',
                   message: 'requirementId is required for the create operation',
                   path: ['requirementId'],
                 })
               }
               if (!data.content) {
                 ctx.addIssue({
-                  code: z.ZodIssueCode.custom,
+                  code: 'custom',
                   message: 'content is required for the create operation',
                   path: ['content'],
                 })
@@ -1314,14 +1769,14 @@ export function createKravhanteringMcpServer(
             case 'edit':
               if (!data.suggestionId) {
                 ctx.addIssue({
-                  code: z.ZodIssueCode.custom,
+                  code: 'custom',
                   message: 'suggestionId is required for the edit operation',
                   path: ['suggestionId'],
                 })
               }
               if (!data.content) {
                 ctx.addIssue({
-                  code: z.ZodIssueCode.custom,
+                  code: 'custom',
                   message: 'content is required for the edit operation',
                   path: ['content'],
                 })
@@ -1331,18 +1786,25 @@ export function createKravhanteringMcpServer(
             case 'dismiss':
               if (!data.suggestionId) {
                 ctx.addIssue({
-                  code: z.ZodIssueCode.custom,
+                  code: 'custom',
                   message: `suggestionId is required for the ${data.operation} operation`,
                   path: ['suggestionId'],
                 })
               }
+              if (!data.resolutionMotivation) {
+                ctx.addIssue({
+                  code: 'custom',
+                  message: `resolutionMotivation is required for the ${data.operation} operation`,
+                  path: ['resolutionMotivation'],
+                })
+              }
               break
             case 'delete':
             case 'request_review':
             case 'revert_to_draft':
               if (!data.suggestionId) {
                 ctx.addIssue({
-                  code: z.ZodIssueCode.custom,
+                  code: 'custom',
                   message: `suggestionId is required for the ${data.operation} operation`,
                   path: ['suggestionId'],
                 })
@@ -1350,6 +1812,7 @@ export function createKravhanteringMcpServer(
               break
           }
         }),
+      outputSchema: ManageSuggestionOutputSchema,
       title: 'Manage Improvement Suggestion',
     },
     async input => {
@@ -1396,7 +1859,7 @@ export function createKravhanteringMcpServer(
         'Generate system requirements using AI (OpenRouter) based on a topic. ' +
         'Returns generated requirements with thinking trace. ' +
         'To create the generated requirements, call requirements_manage_requirement ' +
-        'with operation "create" for each requirement, setting requirement.areaId ' +
+        'with operation "create" for each requirement, using the generated fields as the requirement object and setting requirement.areaId ' +
         "to the areaId provided in this tool's input.",
       inputSchema: z
         .object({
@@ -1410,7 +1873,7 @@ export function createKravhanteringMcpServer(
             ),
           customInstruction: z
             .string()
-            .max(4000)
+            .max(5000)
             .optional()
             .describe(
               'Custom instruction to override the default generation prompt',
@@ -1429,12 +1892,13 @@ export function createKravhanteringMcpServer(
           topic: z
             .string()
             .min(1)
-            .max(4000)
+            .max(1000)
             .describe(
               'The topic or system context to generate requirements for',
             ),
         })
         .strict(),
+      outputSchema: GenerateRequirementsOutputSchema,
       title: 'Generate Requirements (AI)',
     },
     async input => {
diff --git a/lib/requirements/list-view.ts b/lib/requirements/list-view.ts
index 07455a565..87aec9d43 100644
--- a/lib/requirements/list-view.ts
+++ b/lib/requirements/list-view.ts
@@ -93,6 +93,7 @@ export interface RequirementRow {
     categoryNameSv: string | null
     description: string | null
     requiresTesting: boolean
+    revisionToken?: string
     riskLevelId: number | null
     riskLevelNameEn: string | null
     riskLevelNameSv: string | null
diff --git a/lib/requirements/service.ts b/lib/requirements/service.ts
index 8b0ce21ef..f7ce133f6 100644
--- a/lib/requirements/service.ts
+++ b/lib/requirements/service.ts
@@ -79,6 +79,7 @@ import {
   type RequirementsAction,
 } from '@/lib/requirements/auth'
 import {
+  conflictError,
   internalError,
   isRequirementsServiceError,
   notFoundError,
@@ -120,6 +121,8 @@ export type CatalogKind =
 export interface RequirementMutationInput {
   acceptanceCriteria?: string
   areaId?: number
+  baseRevisionToken?: string | null
+  baseVersionId?: number | null
   categoryId?: number
   createdBy?: string
   description?: string
@@ -368,6 +371,7 @@ function formatRequirementListItem(
       categoryNameSv: item.categoryNameSv,
       description: item.description,
       id: item.versionId,
+      revisionToken: item.revisionToken,
       requiresTesting: item.requiresTesting,
       riskLevelId: item.riskLevelId,
       riskLevelNameEn: item.riskLevelNameEn,
@@ -428,6 +432,7 @@ function formatRequirementDetail(
       ownerName: version.createdBy ?? null,
       publishedAt: version.publishedAt,
       requiresTesting: version.requiresTesting,
+      revisionToken: version.revisionToken,
       verificationMethod: version.verificationMethod,
       status: version.status,
       statusColor: version.statusColor,
@@ -1316,23 +1321,50 @@ export function createRequirementsService(
                 'Edit operation requires requirement.description',
               )
             }
+            if (
+              payload.baseVersionId == null ||
+              payload.baseRevisionToken == null
+            ) {
+              throw validationError(
+                'Edit operation requires requirement.baseVersionId and requirement.baseRevisionToken',
+                { reason: 'missing_edit_precondition' },
+              )
+            }
             if (payload.areaId != null) {
               await ensureAreaExists(db, payload.areaId)
             }
-            const version = await editRequirement(db, requirementId, {
-              acceptanceCriteria: payload.acceptanceCriteria,
-              createdBy: payload.createdBy ?? context.actor.id ?? undefined,
-              description: payload.description,
-              normReferenceIds: payload.normReferenceIds,
-              requirementAreaId: payload.areaId,
-              requirementCategoryId: payload.categoryId,
-              qualityCharacteristicId: payload.qualityCharacteristicId,
-              requirementTypeId: payload.typeId,
-              requiresTesting: payload.requiresTesting,
-              riskLevelId: payload.riskLevelId,
-              verificationMethod: payload.verificationMethod,
-              scenarioIds: payload.scenarioIds,
-            })
+            let version: Awaited<ReturnType<typeof editRequirement>>
+            try {
+              version = await editRequirement(db, requirementId, {
+                acceptanceCriteria: payload.acceptanceCriteria,
+                baseRevisionToken: payload.baseRevisionToken,
+                baseVersionId: payload.baseVersionId,
+                createdBy: payload.createdBy ?? context.actor.id ?? undefined,
+                description: payload.description,
+                normReferenceIds: payload.normReferenceIds,
+                requirementAreaId: payload.areaId,
+                requirementCategoryId: payload.categoryId,
+                qualityCharacteristicId: payload.qualityCharacteristicId,
+                requirementTypeId: payload.typeId,
+                requiresTesting: payload.requiresTesting,
+                riskLevelId: payload.riskLevelId,
+                verificationMethod: payload.verificationMethod,
+                scenarioIds: payload.scenarioIds,
+              })
+            } catch (error) {
+              if (
+                isRequirementsServiceError(error) &&
+                error.code === 'conflict' &&
+                error.details?.reason === 'stale_requirement_edit'
+              ) {
+                const latest = await getRequirementById(db, requirementId)
+                throw conflictError(error.message, {
+                  ...error.details,
+                  latest: latest ? formatRequirementDetail(latest) : null,
+                })
+              }
+              throw error
+            }
             const detail = formatRequirementDetail(
               (await getRequirementById(db, requirementId)) ??
                 (() => {
diff --git a/lib/requirements/types.ts b/lib/requirements/types.ts
index 5f53252b9..22bab40fa 100644
--- a/lib/requirements/types.ts
+++ b/lib/requirements/types.ts
@@ -51,6 +51,7 @@ export interface RequirementVersionDetail {
   publishedAt: string | null
   qualityCharacteristic: RequirementLocalizedEntity | null
   requiresTesting: boolean
+  revisionToken: string
   riskLevel: RiskLevelSummary | null
   status: number
   statusColor: string | null
diff --git a/lib/typeorm/entities/requirement-version.ts b/lib/typeorm/entities/requirement-version.ts
index d196b1a7d..4a5305687 100644
--- a/lib/typeorm/entities/requirement-version.ts
+++ b/lib/typeorm/entities/requirement-version.ts
@@ -22,6 +22,7 @@ export interface RequirementVersionEntity {
   requirementCategory: RequirementCategoryEntity | null
   requirementStatus: RequirementStatusEntity
   requirementType: RequirementTypeEntity | null
+  revisionToken: string
   riskLevel: RiskLevelEntity | null
   verificationMethod: string | null
   versionNumber: number
@@ -38,6 +39,11 @@ export const requirementVersionEntity =
         type: 'int',
         generated: 'increment',
       },
+      revisionToken: {
+        name: 'revision_token',
+        type: 'uniqueidentifier',
+        default: () => 'NEWID()',
+      },
       versionNumber: { name: 'version_number', type: 'int' },
       description: { name: 'description', type: 'nvarchar', length: 'MAX' },
       acceptanceCriteria: {
@@ -78,6 +84,10 @@ export const requirementVersionEntity =
         name: 'uq_requirement_versions_requirement_id_version_number',
         columns: ['requirement', 'versionNumber'],
       },
+      {
+        name: 'uq_requirement_versions_revision_token',
+        columns: ['revisionToken'],
+      },
     ],
     indices: [
       {
diff --git a/messages/en.json b/messages/en.json
index 94c48be9c..155b1940f 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -203,6 +203,10 @@
     "editNotAllowedStatusReview": "This requirement cannot be edited because it is in Review status. Return it to Draft status first.",
     "editNotAllowedStatusArchived": "This requirement is Archived and must be restored or reactivated before it can be edited.",
     "editPublishedVersionNotice": "This requirement is Published. Saving will create a new Draft version — the published version remains active until the new draft completes the review process and is published.",
+    "staleEditConflict": "This requirement changed while you were editing.",
+    "staleEditConflictHelp": "Your changes are still here. Open the latest saved version to compare, or reload the editor before trying again.",
+    "staleEditViewLatest": "View latest",
+    "staleEditReload": "Reload editor",
     "issuer": "Issuer",
     "name": "Name",
     "version": "Version",
diff --git a/messages/sv.json b/messages/sv.json
index 6e9613ca8..90d365607 100644
--- a/messages/sv.json
+++ b/messages/sv.json
@@ -203,6 +203,10 @@
     "editNotAllowedStatusReview": "Detta krav kan inte redigeras eftersom det har status Granskning. Återställ det till Utkast-status först.",
     "editNotAllowedStatusArchived": "Detta krav är Arkiverat och måste återställas eller återaktiveras innan det kan redigeras.",
     "editPublishedVersionNotice": "Detta krav är Publicerat. Att spara skapar en ny version i Utkast — den publicerade versionen förblir aktiv tills det nya utkastet genomgått granskningsprocessen och publicerats.",
+    "staleEditConflict": "Kravet ändrades medan du redigerade.",
+    "staleEditConflictHelp": "Dina ändringar finns kvar här. Öppna den senaste sparade versionen för att jämföra, eller ladda om redigeraren innan du försöker igen.",
+    "staleEditViewLatest": "Visa senaste",
+    "staleEditReload": "Ladda om redigeraren",
     "issuer": "Utfärdare",
     "name": "Benämning",
     "version": "Version",
diff --git a/package.json b/package.json
index e00f06d9b..593459bb2 100644
--- a/package.json
+++ b/package.json
@@ -19,7 +19,9 @@
     "start": "next start",
     "start:prodlike": "dotenv -e .env.prodlike -- npm run build && dotenv -e .env.prodlike -- cross-env NODE_ENV=production next start --hostname 0.0.0.0 --port 3001",
     "start:prodlike:noauth": "dotenv -e .env.prodlike -- cross-env AUTH_ENABLED=false NEXT_PUBLIC_AUTH_ENABLED=false AUTH_ALLOW_DISABLE_IN_PRODUCTION=true npm run build && dotenv -e .env.prodlike -- cross-env NODE_ENV=production AUTH_ENABLED=false NEXT_PUBLIC_AUTH_ENABLED=false AUTH_ALLOW_DISABLE_IN_PRODUCTION=true next start --hostname 0.0.0.0 --port 3001",
-    "check": "npm run type-check && npm run lint:py && npm run format:check && npm run spell:check && npm run lint && npm run lint:md && npm run test",
+    "dotenv:check": "dotenv-linter check . --exclude .env.sqlserver --exclude .env.local --exclude .env.*.local && dotenv-linter check .devcontainer --recursive --exclude .devcontainer/.env --exclude .devcontainer/elevated/.env",
+    "dotenv:fix": "dotenv-linter fix . --no-backup --exclude .env.sqlserver --exclude .env.local --exclude .env.*.local && dotenv-linter fix .devcontainer --no-backup --exclude .devcontainer/.env --exclude .devcontainer/elevated/.env",
+    "check": "npm run type-check && npm run lint:py && npm run dotenv:check && npm run format:check && npm run spell:check && npm run lint && npm run lint:md && npm run test",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
@@ -42,7 +44,7 @@
     "test:integration:report:dev": "playwright show-report --host 0.0.0.0 playwright-report-dev",
     "test:integration:report:prodlike": "playwright show-report --host 0.0.0.0 playwright-report-prodlike",
     "type-check": "rimraf .next/dev/types && next typegen && tsc --noEmit",
-    "fix": "npm run format && npm run lint:fix && npm run lint:md:fix && npm run spell:fix",
+    "fix": "npm run format && npm run lint:fix && npm run lint:md:fix && npm run dotenv:fix && npm run spell:fix",
     "clean": "rimraf .next out",
     "test:integration:all": "npm run test:integration && npm run test:integration:prodlike",
     "generate:guide": "npm run kill:port && npm run db:setup && playwright test --config playwright.guide.config.ts",
diff --git a/scripts/__tests__/db-sqlserver-admin.test.mjs b/scripts/__tests__/db-sqlserver-admin.test.mjs
index 47b60cffc..1b11020da 100644
--- a/scripts/__tests__/db-sqlserver-admin.test.mjs
+++ b/scripts/__tests__/db-sqlserver-admin.test.mjs
@@ -300,11 +300,15 @@ describe('db-sqlserver-admin.mjs', () => {
     })
   })
 
-  it('runs the initial TypeORM migration through an injected DataSource', async () => {
+  it('runs registered TypeORM migrations through an injected DataSource', async () => {
+    let dataSourceOptions
     const destroy = vi.fn(async () => undefined)
     const initialize = vi.fn(async () => undefined)
     const runMigrations = vi.fn(async () => [{ name: 'InitialMigration' }])
     class FakeDataSource {
+      constructor(options) {
+        dataSourceOptions = options
+      }
       destroy = destroy
       initialize = initialize
       runMigrations = runMigrations
@@ -316,6 +320,12 @@ describe('db-sqlserver-admin.mjs', () => {
     )
 
     expect(initialize).toHaveBeenCalled()
+    expect(
+      dataSourceOptions.migrations.map(migration => migration.name),
+    ).toEqual([
+      'InitialSqlServerSchema1713720000000',
+      'RequirementVersionRevisionToken1713800000000',
+    ])
     expect(runMigrations).toHaveBeenCalled()
     expect(destroy).toHaveBeenCalled()
     expect(result).toEqual({
diff --git a/scripts/db-sqlserver-admin.mjs b/scripts/db-sqlserver-admin.mjs
index 43cd1a1e5..f46ee16e8 100644
--- a/scripts/db-sqlserver-admin.mjs
+++ b/scripts/db-sqlserver-admin.mjs
@@ -5,6 +5,7 @@ import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { DataSource } from 'typeorm'
 import { InitialSqlServerSchema1713720000000 } from '../typeorm/migrations/0001_initial_sqlserver.mjs'
+import { RequirementVersionRevisionToken1713800000000 } from '../typeorm/migrations/0002_requirement_version_revision_token.mjs'
 import { seedDatabase } from '../typeorm/seed.mjs'
 
 export const DEFAULT_BROWSE_CONNECTION_NAME =
@@ -267,7 +268,10 @@ function buildMigrationDataSourceOptions(connectionString, env = process.env) {
   return {
     connectionTimeout: parsed.connectionTimeout,
     logging: false,
-    migrations: [InitialSqlServerSchema1713720000000],
+    migrations: [
+      InitialSqlServerSchema1713720000000,
+      RequirementVersionRevisionToken1713800000000,
+    ],
     options: {
       enableArithAbort: true,
       encrypt: parsed.encrypt,
diff --git a/tests/quality/QUALITY.md b/tests/quality/QUALITY.md
index 298ff9770..8fe043a5c 100644
--- a/tests/quality/QUALITY.md
+++ b/tests/quality/QUALITY.md
@@ -140,9 +140,10 @@ npm exec -- vitest run tests/quality/functional.test.ts -t "Scenario 3: publishi
 <!-- markdownlint-enable MD013 -->
 
 **What happened:** `editRequirement()` rejects edits against review and
-archived versions at `lib/dal/requirements.ts:795-805`. If those rows are
-edited in place, the project loses the meaning of approval, publication, and
-archival timestamps because the historical record itself mutates.
+archived versions after stale edit preconditions at
+`lib/dal/requirements.ts:832-845`. If those rows are edited in place, the
+project loses the meaning of approval, publication, and archival timestamps
+because the historical record itself mutates.
 
 **The requirement:** Draft versions may be edited in place. Published edits
 must create a new draft. Review content must return to draft before editing.
@@ -318,6 +319,34 @@ npm exec -- vitest run tests/quality/functional.test.ts -t "Scenario 10: MCP too
 ```
 <!-- markdownlint-enable MD013 -->
 
+---
+
+### Scenario 11: stale draft edits are rejected before replacing latest content
+
+**Requirement tag:** `[Req: formal — docs/lifecycle-workflow.md "Draft"]`
+
+**What happened:** Draft content is intentionally editable in place, but
+`editRequirement()` now requires the caller's `baseVersionId` and
+`baseRevisionToken` to match the latest draft row before it updates the row or
+rewrites its scenario and norm reference joins at
+`lib/dal/requirements.ts:805-895`. The shared service requires both base
+fields and adds the latest snapshot to stale conflict responses at
+`lib/requirements/service.ts:1317-1364`. If those guards are removed, a second
+editor can silently replace the first editor's saved content while still
+receiving a successful response.
+
+**The requirement:** Editing a draft must be conditional on the version ID and
+opaque revision token captured when editing started. A stale edit must fail with
+a conflict and must leave the latest saved version content unchanged.
+
+**How to verify:**
+
+<!-- markdownlint-disable MD013 -->
+```sh
+npm exec -- vitest run tests/quality/functional.test.ts -t "Scenario 11: stale draft edits are rejected before replacing latest content"
+```
+<!-- markdownlint-enable MD013 -->
+
 ## AI Session Quality Discipline
 
 1. Read `tests/quality/QUALITY.md` before changing lifecycle, package, MCP,
diff --git a/tests/quality/functional.test.ts b/tests/quality/functional.test.ts
index a2c81b4d3..c7efed07f 100644
--- a/tests/quality/functional.test.ts
+++ b/tests/quality/functional.test.ts
@@ -67,9 +67,9 @@ import {
  * Scenario 10 is a pure file-content check and always runs as part of
  * `npm run test`.
  *
- * Scenarios 1-9 exercise lifecycle invariants that require a real SQL Server
- * instance. The harness derives a connection URL automatically from the
- * standard DB_* environment variables (the same ones used by the dev
+ * Scenarios 1-9 and 11 exercise lifecycle invariants that require a real
+ * SQL Server instance. The harness derives a connection URL automatically from
+ * the standard DB_* environment variables (the same ones used by the dev
  * scripts) and swaps the database name to a dedicated
  * `<DB_NAME>_functional_tests` instance so the development data is never
  * touched. Set `SQLSERVER_FUNCTIONAL_TESTS_URL` to override the derived URL,
@@ -291,6 +291,7 @@ async function createPublishedRequirement(
   description: string,
 ): Promise<{
   requirementId: number
+  revisionToken: string
   uniqueId: string
   publishedVersionId: number
 }> {
@@ -306,6 +307,7 @@ async function createPublishedRequirement(
   )
   return {
     requirementId: created.requirement.id,
+    revisionToken: published.revisionToken,
     uniqueId: created.requirement.uniqueId,
     publishedVersionId: published.id,
   }
@@ -361,6 +363,8 @@ describeIfSqlServer('Fitness Scenarios (SQL Server)', () => {
     )
 
     await editRequirement(appDb(), published.requirementId, {
+      baseRevisionToken: published.revisionToken,
+      baseVersionId: published.publishedVersionId,
       description: 'Draft replacement that must stay private',
     })
 
@@ -387,6 +391,8 @@ describeIfSqlServer('Fitness Scenarios (SQL Server)', () => {
     )
 
     await editRequirement(appDb(), published.requirementId, {
+      baseRevisionToken: published.revisionToken,
+      baseVersionId: published.publishedVersionId,
       description: 'Pending replacement',
     })
 
@@ -408,6 +414,8 @@ describeIfSqlServer('Fitness Scenarios (SQL Server)', () => {
     )
 
     await editRequirement(appDb(), published.requirementId, {
+      baseRevisionToken: published.revisionToken,
+      baseVersionId: published.publishedVersionId,
       description: 'Version two draft',
     })
     await transitionStatus(appDb(), published.requirementId, STATUS_REVIEW)
@@ -437,10 +445,16 @@ describeIfSqlServer('Fitness Scenarios (SQL Server)', () => {
       requirementAreaId: area.id,
     })
 
-    await transitionStatus(appDb(), created.requirement.id, STATUS_REVIEW)
+    const reviewVersion = await transitionStatus(
+      appDb(),
+      created.requirement.id,
+      STATUS_REVIEW,
+    )
 
     await expect(
       editRequirement(appDb(), created.requirement.id, {
+        baseRevisionToken: reviewVersion.revisionToken,
+        baseVersionId: reviewVersion.id,
         description: 'Illegal review edit',
       }),
     ).rejects.toMatchObject({
@@ -453,9 +467,15 @@ describeIfSqlServer('Fitness Scenarios (SQL Server)', () => {
     await transitionStatus(appDb(), created.requirement.id, STATUS_PUBLISHED)
     await initiateArchiving(appDb(), created.requirement.id)
     await approveArchiving(appDb(), created.requirement.id)
+    const [archivedVersion] = await getVersionHistory(
+      appDb(),
+      created.requirement.id,
+    )
 
     await expect(
       editRequirement(appDb(), created.requirement.id, {
+        baseRevisionToken: archivedVersion.revisionToken,
+        baseVersionId: archivedVersion.id,
         description: 'Illegal archived edit',
       }),
     ).rejects.toMatchObject({
@@ -700,4 +720,41 @@ describeIfSqlServer('Fitness Scenarios (SQL Server)', () => {
       code: 'conflict',
     })
   })
+
+  it('Scenario 11: stale draft edits are rejected before replacing latest content', async () => {
+    const area = await createArea(appDb())
+    const created = await createRequirement(appDb(), {
+      description: 'Original draft',
+      requirementAreaId: area.id,
+    })
+
+    const firstSave = await editRequirement(appDb(), created.requirement.id, {
+      baseRevisionToken: created.version.revisionToken,
+      baseVersionId: created.version.id,
+      description: 'First saved draft',
+    })
+
+    await expect(
+      editRequirement(appDb(), created.requirement.id, {
+        baseRevisionToken: created.version.revisionToken,
+        baseVersionId: created.version.id,
+        description: 'Stale overwrite attempt',
+      }),
+    ).rejects.toMatchObject({
+      code: 'conflict',
+      details: {
+        baseVersionId: created.version.id,
+        latestVersionId: created.version.id,
+        reason: 'stale_requirement_edit',
+      },
+    })
+
+    const history = await getVersionHistory(appDb(), created.requirement.id)
+    expect(history).toHaveLength(1)
+    expect(history[0]).toMatchObject({
+      description: 'First saved draft',
+      editedAt: firstSave.editedAt,
+      status: STATUS_DRAFT,
+    })
+  })
 })
diff --git a/tests/unit/edit-requirement-client.test.tsx b/tests/unit/edit-requirement-client.test.tsx
index 5ef250653..9d0adf90a 100644
--- a/tests/unit/edit-requirement-client.test.tsx
+++ b/tests/unit/edit-requirement-client.test.tsx
@@ -30,11 +30,15 @@ vi.mock('@/components/HelpPanel', () => ({
 
 vi.mock('@/components/RequirementForm', () => ({
   default: (props: {
+    baseRevisionToken?: string | null
+    baseVersionId?: number | null
     mode: string
-    requirementId?: number
+    requirementId?: number | string
     initialData?: Record<string, string | boolean>
   }) => (
     <div
+      data-base-revision-token={props.baseRevisionToken ?? ''}
+      data-base-version-id={props.baseVersionId ?? ''}
       data-initial-data={JSON.stringify(props.initialData)}
       data-mode={props.mode}
       data-testid="req-form"
@@ -76,6 +80,7 @@ function makeVersion(
     publishedAt: null,
     qualityCharacteristic: null,
     requiresTesting: true,
+    revisionToken: '11111111-1111-4111-8111-111111111111',
     riskLevel: null,
     status: 1,
     statusColor: '#3b82f6',
@@ -127,11 +132,30 @@ describe('EditRequirementClient', () => {
   })
 
   it('fetches requirement data and renders form', async () => {
+    fetchMock.mockResolvedValue(
+      okJson(
+        makeRequirementDetailResponse(
+          {},
+          {
+            id: 10,
+            revisionToken: '22222222-2222-4222-8222-222222222222',
+          },
+        ),
+      ),
+    )
     render(<EditRequirementClient requirementId={1} />)
     await waitFor(() => {
       expect(screen.getByTestId('req-form')).toBeInTheDocument()
     })
     expect(screen.getByTestId('req-form')).toHaveAttribute('data-mode', 'edit')
+    expect(screen.getByTestId('req-form')).toHaveAttribute(
+      'data-base-version-id',
+      '10',
+    )
+    expect(screen.getByTestId('req-form')).toHaveAttribute(
+      'data-base-revision-token',
+      '22222222-2222-4222-8222-222222222222',
+    )
     expect(screen.getByText(/REQ-001/)).toBeInTheDocument()
   })
 
diff --git a/tests/unit/mcp-http.test.ts b/tests/unit/mcp-http.test.ts
index 96b481347..163a408d2 100644
--- a/tests/unit/mcp-http.test.ts
+++ b/tests/unit/mcp-http.test.ts
@@ -1,4 +1,12 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+} from 'vitest'
 
 const serviceState = vi.hoisted(() => ({
   getService: vi.fn(),
@@ -54,6 +62,7 @@ function createFakeService(
             },
             description: 'Support secure integration',
             id: 10,
+            revisionToken: '11111111-1111-4111-8111-111111111111',
             versionNormReferences: normReferences,
             requiresTesting,
             statusNameEn: 'Draft',
@@ -85,6 +94,7 @@ function createFakeService(
         },
         description: 'Support secure integration',
         id: 10,
+        revisionToken: '11111111-1111-4111-8111-111111111111',
         versionNormReferences: normReferences,
         requiresTesting,
         statusNameEn: 'Draft',
@@ -106,7 +116,13 @@ function createFakeService(
     manageRequirement: vi.fn().mockResolvedValue({
       detail: {
         uniqueId: 'INT0001',
-        versions: [{ versionNumber: 2 }],
+        versions: [
+          {
+            id: 10,
+            revisionToken: '22222222-2222-4222-8222-222222222222',
+            versionNumber: 2,
+          },
+        ],
       },
       message: 'Requirement updated',
       operation: 'edit',
@@ -122,6 +138,7 @@ function createFakeService(
           uniqueId: 'INT0001',
           version: {
             description: 'Support secure integration',
+            revisionToken: '11111111-1111-4111-8111-111111111111',
             versionNumber: 2,
           },
         },
@@ -155,6 +172,7 @@ function createFakeService(
       },
       message: 'Requirement transitioned',
       version: {
+        revisionToken: '11111111-1111-4111-8111-111111111111',
         versionNumber: 2,
       },
     }),
@@ -209,23 +227,146 @@ describe('handleRequirementsMcpRequest', () => {
     serviceState.getService.mockReturnValue(createFakeService())
   })
 
-  it('lists the MCP tools and serves the requirement detail resource', async () => {
-    const { client, transport } = await createClient()
-    const fakeService = serviceState.getService.mock.results[0]?.value
+  describe('tool schemas', () => {
+    let toolSchemaClient: Awaited<ReturnType<typeof createClient>> | undefined
+    let tools: Awaited<ReturnType<Client['listTools']>>['tools'] = []
 
-    const tools = await client.listTools()
-    expect(tools.tools.map(tool => tool.name)).toEqual(
-      expect.arrayContaining([
-        'requirements_get_requirement',
-        'requirements_manage_requirement',
-        'requirements_query_catalog',
-        'requirements_transition_requirement',
-      ]),
-    )
+    beforeAll(async () => {
+      serviceState.getService.mockReturnValue(createFakeService())
+      toolSchemaClient = await createClient()
+      const response = await toolSchemaClient.client.listTools()
+      tools = response.tools
+    })
+
+    afterAll(async () => {
+      if (!toolSchemaClient) {
+        return
+      }
+
+      try {
+        await toolSchemaClient.client.close()
+      } finally {
+        await toolSchemaClient.transport.close()
+      }
+    })
+
+    function getTool(name: string) {
+      return tools.find(tool => tool.name === name)
+    }
+
+    it('lists the core MCP tools', async () => {
+      expect(tools.map(tool => tool.name)).toEqual(
+        expect.arrayContaining([
+          'requirements_get_requirement',
+          'requirements_manage_requirement',
+          'requirements_query_catalog',
+          'requirements_transition_requirement',
+        ]),
+      )
+    })
+
+    it('describes requirements_query_catalog filters and pagination', async () => {
+      const queryTool = getTool('requirements_query_catalog')
+
+      expect(queryTool).toBeDefined()
+      expect(queryTool?.description).toContain('risk_levels')
+      const queryInputSchemaText = JSON.stringify(queryTool?.inputSchema)
+      expect(queryInputSchemaText).toContain('risk_levels')
+      expect(queryInputSchemaText).toContain('normReferenceIds')
+      expect(queryInputSchemaText).toContain('usageScenarioIds')
+      expect(queryInputSchemaText).toContain('sortBy')
+      expect(JSON.stringify(queryTool?.outputSchema)).toContain('pagination')
+    })
+
+    it('describes requirements_get_requirement history edit tokens', async () => {
+      const getRequirementTool = getTool('requirements_get_requirement')
+
+      expect(getRequirementTool).toBeDefined()
+      expect(getRequirementTool?.description).toContain('view: "history"')
+      const getRequirementInputSchemaText = JSON.stringify(
+        getRequirementTool?.inputSchema,
+      )
+      expect(getRequirementInputSchemaText).toContain('history')
+      expect(getRequirementInputSchemaText).toContain('before editing')
+      const getRequirementOutputSchemaText = JSON.stringify(
+        getRequirementTool?.outputSchema,
+      )
+      expect(getRequirementOutputSchemaText).toContain('revisionToken')
+      expect(getRequirementOutputSchemaText).toContain('baseRevisionToken')
+    })
+
+    it('describes requirements_manage_requirement create and edit inputs', async () => {
+      const manageTool = getTool('requirements_manage_requirement')
+
+      expect(manageTool).toBeDefined()
+      expect(manageTool?.description).toContain('requirement.baseVersionId')
+      expect(manageTool?.description).toContain('requirement.baseRevisionToken')
+      expect(manageTool?.description).toContain('operation "create"')
+      expect(manageTool?.description).toContain('requirement.areaId')
+      expect(manageTool?.description).toContain('requirement.description')
+      expect(manageTool?.description).toContain('view: "history"')
+      const manageInputSchemaText = JSON.stringify(manageTool?.inputSchema)
+      expect(manageInputSchemaText).toContain('For create')
+      expect(manageInputSchemaText).toContain('acceptanceCriteria')
+      expect(manageInputSchemaText).toContain('requirement.versions[0].id')
+      expect(manageInputSchemaText).toContain(
+        'requirement.versions[0].revisionToken',
+      )
+    })
+
+    it('describes requirements_transition_requirement revision output', async () => {
+      const transitionTool = getTool('requirements_transition_requirement')
+
+      expect(transitionTool).toBeDefined()
+      expect(transitionTool?.description).toContain('rotates the version')
+      expect(JSON.stringify(transitionTool?.outputSchema)).toContain(
+        'revisionToken',
+      )
+    })
+
+    it('describes requirements_list_improvement_suggestions output', async () => {
+      const listSuggestionsTool = getTool(
+        'requirements_list_improvement_suggestions',
+      )
+
+      expect(listSuggestionsTool).toBeDefined()
+      expect(JSON.stringify(listSuggestionsTool?.outputSchema)).toContain(
+        'suggestions',
+      )
+    })
+
+    it('describes requirements_manage_improvement_suggestion resolution input', async () => {
+      const manageSuggestionTool = getTool(
+        'requirements_manage_improvement_suggestion',
+      )
+
+      expect(manageSuggestionTool).toBeDefined()
+      const manageSuggestionInputSchemaText = JSON.stringify(
+        manageSuggestionTool?.inputSchema,
+      )
+      expect(manageSuggestionInputSchemaText).toContain('resolutionMotivation')
+      expect(JSON.stringify(manageSuggestionTool?.outputSchema)).toContain(
+        'result',
+      )
+    })
+
+    it('describes requirements_generate_requirements limits and output', async () => {
+      const generateTool = getTool('requirements_generate_requirements')
+
+      expect(generateTool).toBeDefined()
+      const generateInputSchemaText = JSON.stringify(generateTool?.inputSchema)
+      expect(generateInputSchemaText).toContain('"maxLength":1000')
+      expect(generateTool?.description).toContain('using the generated fields')
+      expect(JSON.stringify(generateTool?.outputSchema)).toContain('stats')
+    })
+  })
 
+  it('serves the requirement detail resource', async () => {
+    const { client, transport } = await createClient()
     const resource = await client.readResource({
       uri: 'requirements://requirement/INT0001?version=2',
     })
+    const fakeService = serviceState.getService.mock.results[0]?.value
     const firstResource =
       'contents' in resource ? resource.contents[0] : undefined
     const text =
@@ -301,6 +442,38 @@ describe('handleRequirementsMcpRequest', () => {
     await transport.close()
   })
 
+  it('passes requirement catalog filters and sorting through the MCP schema', async () => {
+    const { client, transport } = await createClient()
+    const fakeService = serviceState.getService.mock.results[0]?.value
+
+    const result = await client.callTool({
+      arguments: {
+        catalog: 'requirements',
+        normReferenceIds: [4],
+        riskLevelIds: [2],
+        sortBy: 'riskLevel',
+        sortDirection: 'desc',
+        usageScenarioIds: [3],
+      },
+      name: 'requirements_query_catalog',
+    })
+
+    expect(result.isError).not.toBe(true)
+    expect(fakeService.queryCatalog).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        normReferenceIds: [4],
+        riskLevelIds: [2],
+        sortBy: 'riskLevel',
+        sortDirection: 'desc',
+        usageScenarioIds: [3],
+      }),
+    )
+
+    await client.close()
+    await transport.close()
+  })
+
   it('returns tool-level errors as isError results instead of protocol failures', async () => {
     const fakeService = createFakeService()
     fakeService.getRequirement.mockRejectedValueOnce(new Error('Boom'))
@@ -534,6 +707,8 @@ describe('handleRequirementsMcpRequest', () => {
         operation: 'edit',
         uniqueId: 'INT0001',
         requirement: {
+          baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+          baseVersionId: 10,
           description: 'Updated description',
           normReferenceIds: [1, 2],
         },
@@ -542,10 +717,21 @@ describe('handleRequirementsMcpRequest', () => {
     })
 
     expect(result.isError).not.toBe(true)
+    expect(result.structuredContent).toMatchObject({
+      detail: {
+        versions: [
+          expect.objectContaining({
+            revisionToken: '22222222-2222-4222-8222-222222222222',
+          }),
+        ],
+      },
+    })
     expect(fakeService.manageRequirement).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({
         requirement: expect.objectContaining({
+          baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+          baseVersionId: 10,
           normReferenceIds: [1, 2],
         }),
       }),
@@ -563,6 +749,8 @@ describe('handleRequirementsMcpRequest', () => {
         operation: 'edit',
         uniqueId: 'INT0001',
         requirement: {
+          baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+          baseVersionId: 10,
           description: 'Updated description',
           references: [1],
         },
diff --git a/tests/unit/requirement-detail-client.test.tsx b/tests/unit/requirement-detail-client.test.tsx
index 7973ff1ea..37edf9de8 100644
--- a/tests/unit/requirement-detail-client.test.tsx
+++ b/tests/unit/requirement-detail-client.test.tsx
@@ -252,6 +252,7 @@ function makeVersion(
     ownerName: 'Owner',
     publishedAt: null,
     requiresTesting: false,
+    revisionToken: `11111111-1111-4111-8111-${String(versionNumber).padStart(12, '0')}`,
     qualityCharacteristic: toLocalizedEntity(qualityCharacteristic, 30),
     riskLevel: null,
     status: 1,
diff --git a/tests/unit/requirement-form.test.tsx b/tests/unit/requirement-form.test.tsx
index 389649ae8..69b2037a0 100644
--- a/tests/unit/requirement-form.test.tsx
+++ b/tests/unit/requirement-form.test.tsx
@@ -27,6 +27,18 @@ function okJson(body: unknown) {
   return { ok: true, json: async () => body }
 }
 
+function errJson(body: unknown, status = 400, statusText = 'Bad Request') {
+  return { ok: false, json: async () => body, status, statusText }
+}
+
+function deferred<T>() {
+  let resolve!: (value: T | PromiseLike<T>) => void
+  const promise = new Promise<T>(res => {
+    resolve = res
+  })
+  return { promise, resolve }
+}
+
 const fetchMock = vi.fn()
 vi.stubGlobal('fetch', fetchMock)
 
@@ -168,6 +180,8 @@ describe('RequirementForm', () => {
 
     const { container } = render(
       <RequirementForm
+        baseRevisionToken="11111111-1111-4111-8111-111111111111"
+        baseVersionId={10}
         initialData={{ description: 'Existing' }}
         mode="edit"
         requirementId={5}
@@ -187,6 +201,217 @@ describe('RequirementForm', () => {
         expect.objectContaining({ method: 'PUT' }),
       )
     })
+    const putCall = fetchMock.mock.calls.find(
+      (c: unknown[]) =>
+        c[0] === '/api/requirements/5' &&
+        (c[1] as RequestInit)?.method === 'PUT',
+    )
+    const body = JSON.parse((putCall?.[1] as RequestInit).body as string)
+    expect(body.baseRevisionToken).toBe('11111111-1111-4111-8111-111111111111')
+    expect(body.baseVersionId).toBe(10)
+  })
+
+  it('shows a stale edit conflict prompt without clearing form data', async () => {
+    fetchMock.mockImplementation((url: string, opts?: RequestInit) => {
+      if (opts?.method === 'PUT')
+        return Promise.resolve(
+          errJson(
+            {
+              code: 'conflict',
+              details: {
+                latest: {
+                  uniqueId: 'REQ-001',
+                  versions: [
+                    {
+                      revisionToken: '22222222-2222-4222-8222-222222222222',
+                      versionNumber: 2,
+                    },
+                  ],
+                },
+                reason: 'stale_requirement_edit',
+              },
+              error: 'This requirement was updated',
+            },
+            409,
+            'Conflict',
+          ),
+        )
+      if (typeof url === 'string' && url.includes('/api/requirement-areas'))
+        return Promise.resolve(okJson({ areas: sampleAreas }))
+      if (
+        typeof url === 'string' &&
+        url.includes('/api/requirement-categories')
+      )
+        return Promise.resolve(okJson({ categories: sampleCategories }))
+      if (
+        typeof url === 'string' &&
+        url.includes('/api/quality-characteristics')
+      )
+        return Promise.resolve(okJson({ qualityCharacteristics: [] }))
+      if (typeof url === 'string' && url.includes('/api/requirement-types'))
+        return Promise.resolve(okJson({ types: sampleTypes }))
+      return Promise.resolve(okJson({}))
+    })
+
+    const { container } = render(
+      <RequirementForm
+        baseRevisionToken="11111111-1111-4111-8111-111111111111"
+        baseVersionId={10}
+        initialData={{ description: 'Existing' }}
+        mode="edit"
+        requirementId={5}
+      />,
+    )
+
+    const desc = await screen.findByRole('textbox', {
+      name: /requirement\.description/,
+    })
+    fireEvent.change(desc, { target: { value: 'Unsaved local text' } })
+    fireEvent.submit(container.querySelector('form') as HTMLFormElement)
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toHaveTextContent(
+        'requirement.staleEditConflict',
+      )
+    })
+    expect(desc).toHaveValue('Unsaved local text')
+    expect(
+      screen.getByRole('button', { name: /requirement\.staleEditViewLatest/ }),
+    ).toBeInTheDocument()
+  })
+
+  it('hides the latest-version action when a stale conflict omits latest data', async () => {
+    fetchMock.mockImplementation((url: string, opts?: RequestInit) => {
+      if (opts?.method === 'PUT')
+        return Promise.resolve(
+          errJson(
+            {
+              code: 'conflict',
+              details: {
+                latest: null,
+                reason: 'stale_requirement_edit',
+              },
+              error: 'This requirement was updated',
+            },
+            409,
+            'Conflict',
+          ),
+        )
+      if (typeof url === 'string' && url.includes('/api/requirement-areas'))
+        return Promise.resolve(okJson({ areas: sampleAreas }))
+      if (
+        typeof url === 'string' &&
+        url.includes('/api/requirement-categories')
+      )
+        return Promise.resolve(okJson({ categories: sampleCategories }))
+      if (
+        typeof url === 'string' &&
+        url.includes('/api/quality-characteristics')
+      )
+        return Promise.resolve(okJson({ qualityCharacteristics: [] }))
+      if (typeof url === 'string' && url.includes('/api/requirement-types'))
+        return Promise.resolve(okJson({ types: sampleTypes }))
+      return Promise.resolve(okJson({}))
+    })
+
+    const { container } = render(
+      <RequirementForm
+        baseRevisionToken="11111111-1111-4111-8111-111111111111"
+        baseVersionId={10}
+        initialData={{ description: 'Existing' }}
+        mode="edit"
+        requirementId={5}
+      />,
+    )
+
+    fireEvent.submit(container.querySelector('form') as HTMLFormElement)
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toHaveTextContent(
+        'requirement.staleEditConflict',
+      )
+    })
+    expect(
+      screen.queryByRole('button', {
+        name: /requirement\.staleEditViewLatest/,
+      }),
+    ).not.toBeInTheDocument()
+  })
+
+  it('awaits stale-conflict refresh and disables conflict actions while loading', async () => {
+    const refresh = deferred<void>()
+    const onRefreshLatest = vi.fn(() => refresh.promise)
+    fetchMock.mockImplementation((url: string, opts?: RequestInit) => {
+      if (opts?.method === 'PUT')
+        return Promise.resolve(
+          errJson(
+            {
+              code: 'conflict',
+              details: {
+                latest: {
+                  uniqueId: 'REQ-001',
+                  versions: [
+                    {
+                      revisionToken: '22222222-2222-4222-8222-222222222222',
+                      versionNumber: 2,
+                    },
+                  ],
+                },
+                reason: 'stale_requirement_edit',
+              },
+              error: 'This requirement was updated',
+            },
+            409,
+            'Conflict',
+          ),
+        )
+      if (typeof url === 'string' && url.includes('/api/requirement-areas'))
+        return Promise.resolve(okJson({ areas: sampleAreas }))
+      if (
+        typeof url === 'string' &&
+        url.includes('/api/requirement-categories')
+      )
+        return Promise.resolve(okJson({ categories: sampleCategories }))
+      if (
+        typeof url === 'string' &&
+        url.includes('/api/quality-characteristics')
+      )
+        return Promise.resolve(okJson({ qualityCharacteristics: [] }))
+      if (typeof url === 'string' && url.includes('/api/requirement-types'))
+        return Promise.resolve(okJson({ types: sampleTypes }))
+      return Promise.resolve(okJson({}))
+    })
+
+    const { container } = render(
+      <RequirementForm
+        baseRevisionToken="11111111-1111-4111-8111-111111111111"
+        baseVersionId={10}
+        initialData={{ description: 'Existing' }}
+        mode="edit"
+        onRefreshLatest={onRefreshLatest}
+        requirementId={5}
+      />,
+    )
+
+    fireEvent.submit(container.querySelector('form') as HTMLFormElement)
+
+    const reload = await screen.findByRole('button', {
+      name: /requirement\.staleEditReload/,
+    })
+    fireEvent.click(reload)
+
+    expect(onRefreshLatest).toHaveBeenCalledTimes(1)
+    expect(reload).toBeDisabled()
+    expect(reload).toHaveTextContent('common.loading')
+    expect(
+      screen.getByRole('button', { name: /requirement\.staleEditViewLatest/ }),
+    ).toBeDisabled()
+
+    refresh.resolve()
+
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument()
+    })
   })
 
   it('navigates back on cancel', async () => {
diff --git a/tests/unit/requirements-client.test.tsx b/tests/unit/requirements-client.test.tsx
index f462c029e..0a638a9d9 100644
--- a/tests/unit/requirements-client.test.tsx
+++ b/tests/unit/requirements-client.test.tsx
@@ -292,6 +292,7 @@ function makeRequirementDetail(
         ownerName: 'Owner',
         publishedAt: '2026-03-01T00:00:00Z',
         requiresTesting: false,
+        revisionToken: `11111111-1111-4111-8111-${String(id).padStart(12, '0')}`,
         riskLevel: null,
         status: 3,
         statusColor: '#22c55e',
diff --git a/tests/unit/requirements-dal.test.ts b/tests/unit/requirements-dal.test.ts
index 1a00a1a11..e8fc46eb1 100644
--- a/tests/unit/requirements-dal.test.ts
+++ b/tests/unit/requirements-dal.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
+  editRequirement,
   getRequirementById,
   getRequirementByUniqueId,
 } from '@/lib/dal/requirements'
@@ -8,12 +9,28 @@ function createSqlServerDb() {
   const query =
     vi.fn<(sql: string, parameters?: unknown[]) => Promise<unknown[]>>()
   const getRepository = vi.fn()
+  const transaction = vi.fn(
+    async (
+      isolationOrCallback:
+        | string
+        | ((manager: { query: typeof query }) => Promise<unknown>),
+      maybeCallback?: (manager: { query: typeof query }) => Promise<unknown>,
+    ) => {
+      const callback =
+        typeof isolationOrCallback === 'function'
+          ? isolationOrCallback
+          : maybeCallback
+      if (!callback) throw new Error('Missing transaction callback')
+      return callback({ query })
+    },
+  )
   const db = {
     getRepository,
     query,
+    transaction,
   } as unknown as Parameters<typeof getRequirementById>[0]
 
-  return { db, query }
+  return { db, query, transaction }
 }
 
 describe('requirements DAL (SQL Server path)', () => {
@@ -57,6 +74,7 @@ describe('requirements DAL (SQL Server path)', () => {
       .mockResolvedValueOnce([
         {
           id: 21,
+          revisionToken: '11111111-1111-4111-8111-111111111111',
           requirementId: 7,
           versionNumber: 2,
           description: 'desc-v2',
@@ -150,6 +168,7 @@ describe('requirements DAL (SQL Server path)', () => {
     expect(result?.versions).toHaveLength(1)
     const version = result?.versions[0]
     expect(version?.id).toBe(21)
+    expect(version?.revisionToken).toBe('11111111-1111-4111-8111-111111111111')
     expect(version?.versionNumber).toBe(2)
     expect(version?.requiresTesting).toBe(true)
     expect(version?.status).toBe(3)
@@ -223,4 +242,191 @@ describe('requirements DAL (SQL Server path)', () => {
     await expect(getRequirementByUniqueId(db, 'NONE')).resolves.toBeNull()
     expect(query).toHaveBeenCalledTimes(1)
   })
+
+  it('rejects a stale base version id before updating a draft', async () => {
+    const { db, query } = createSqlServerDb()
+    query.mockResolvedValueOnce([
+      {
+        id: 22,
+        revisionToken: '11111111-1111-4111-8111-111111111111',
+        statusId: 1,
+      },
+    ])
+
+    await expect(
+      editRequirement(db, 7, {
+        baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+        baseVersionId: 21,
+        description: 'Stale update',
+        normReferenceIds: [100],
+        scenarioIds: [200],
+      }),
+    ).rejects.toMatchObject({
+      code: 'conflict',
+      details: {
+        baseVersionId: 21,
+        latestVersionId: 22,
+        reason: 'stale_requirement_edit',
+      },
+    })
+
+    const sqlCalls = query.mock.calls.map(([sql]) => String(sql))
+    expect(sqlCalls).toHaveLength(1)
+    expect(sqlCalls[0]).toContain('WITH (UPDLOCK, HOLDLOCK)')
+    expect(
+      sqlCalls.some(sql =>
+        sql.includes('DELETE FROM requirement_version_usage_scenarios'),
+      ),
+    ).toBe(false)
+    expect(
+      sqlCalls.some(sql =>
+        sql.includes('DELETE FROM requirement_version_norm_references'),
+      ),
+    ).toBe(false)
+  })
+
+  it('rejects a stale base revision token before rewriting joins', async () => {
+    const { db, query } = createSqlServerDb()
+    query.mockResolvedValueOnce([
+      {
+        id: 21,
+        revisionToken: '22222222-2222-4222-8222-222222222222',
+        statusId: 1,
+      },
+    ])
+
+    await expect(
+      editRequirement(db, 7, {
+        baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+        baseVersionId: 21,
+        description: 'Stale update',
+        normReferenceIds: [100],
+        scenarioIds: [200],
+      }),
+    ).rejects.toMatchObject({
+      code: 'conflict',
+      details: {
+        baseVersionId: 21,
+        latestVersionId: 21,
+        reason: 'stale_requirement_edit',
+      },
+    })
+
+    const sqlCalls = query.mock.calls.map(([sql]) => String(sql))
+    expect(sqlCalls).toHaveLength(1)
+    expect(
+      sqlCalls.some(sql =>
+        sql.includes('DELETE FROM requirement_version_usage_scenarios'),
+      ),
+    ).toBe(false)
+    expect(
+      sqlCalls.some(sql =>
+        sql.includes('DELETE FROM requirement_version_norm_references'),
+      ),
+    ).toBe(false)
+  })
+
+  it('returns a stale edit conflict before review status when the edit token is old', async () => {
+    const { db, query } = createSqlServerDb()
+    query.mockResolvedValueOnce([
+      {
+        id: 21,
+        revisionToken: '22222222-2222-4222-8222-222222222222',
+        statusId: 2,
+      },
+    ])
+
+    await expect(
+      editRequirement(db, 7, {
+        baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+        baseVersionId: 21,
+        description: 'Review edit with stale token',
+      }),
+    ).rejects.toMatchObject({
+      code: 'conflict',
+      details: {
+        baseVersionId: 21,
+        latestVersionId: 21,
+        reason: 'stale_requirement_edit',
+      },
+    })
+
+    expect(query).toHaveBeenCalledTimes(1)
+  })
+
+  it('still rejects review edits after the edit token matches the latest version', async () => {
+    const { db, query } = createSqlServerDb()
+    query.mockResolvedValueOnce([
+      {
+        id: 21,
+        revisionToken: '11111111-1111-4111-8111-111111111111',
+        statusId: 2,
+      },
+    ])
+
+    await expect(
+      editRequirement(db, 7, {
+        baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+        baseVersionId: 21,
+        description: 'Illegal review edit',
+      }),
+    ).rejects.toMatchObject({
+      code: 'conflict',
+      message: 'Cannot edit a requirement in Review status',
+    })
+
+    expect(query).toHaveBeenCalledTimes(1)
+  })
+
+  it('rotates the revision token when updating a draft', async () => {
+    const { db, query } = createSqlServerDb()
+    query
+      .mockResolvedValueOnce([
+        {
+          id: 21,
+          revisionToken: '11111111-1111-4111-8111-111111111111',
+          statusId: 1,
+        },
+      ])
+      .mockResolvedValueOnce([
+        {
+          acceptanceCriteria: null,
+          archiveInitiatedAt: null,
+          archivedAt: null,
+          createdAt: new Date('2026-04-20T08:30:00.000Z'),
+          createdBy: 'anna',
+          description: 'Updated draft',
+          editedAt: new Date('2026-04-20T09:30:00.000Z'),
+          id: 21,
+          publishedAt: null,
+          qualityCharacteristicId: null,
+          requirementCategoryId: null,
+          requirementId: 7,
+          requirementTypeId: null,
+          requiresTesting: 0,
+          revisionToken: '22222222-2222-4222-8222-222222222222',
+          riskLevelId: null,
+          statusId: 1,
+          verificationMethod: null,
+          versionNumber: 2,
+        },
+      ])
+      .mockResolvedValueOnce([])
+      .mockResolvedValueOnce([])
+
+    const result = await editRequirement(db, 7, {
+      baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+      baseVersionId: 21,
+      description: 'Updated draft',
+      normReferenceIds: [],
+      scenarioIds: [],
+    })
+
+    const sqlCalls = query.mock.calls.map(([sql]) => String(sql))
+    expect(sqlCalls[1]).toContain('revision_token = NEWID()')
+    expect(sqlCalls[1]).toContain(
+      'revision_token = CONVERT(uniqueidentifier, @10)',
+    )
+    expect(result.revisionToken).toBe('22222222-2222-4222-8222-222222222222')
+  })
 })
diff --git a/tests/unit/requirements-id-route.test.ts b/tests/unit/requirements-id-route.test.ts
index b05799956..fac21a63b 100644
--- a/tests/unit/requirements-id-route.test.ts
+++ b/tests/unit/requirements-id-route.test.ts
@@ -21,9 +21,19 @@ vi.mock('@/lib/requirements/service', () => ({
     getRequirement: mockGetRequirement,
     manageRequirement: mockManageRequirement,
   }),
-  toHttpErrorPayload: (err: Error) => ({
-    body: { error: err.message },
-    status: 400,
+  toHttpErrorPayload: (
+    err: Error & {
+      code?: string
+      details?: Record<string, unknown>
+      status?: number
+    },
+  ) => ({
+    body: {
+      code: err.code ?? 'internal',
+      details: err.details,
+      error: err.message,
+    },
+    status: err.status ?? 500,
   }),
 }))
 
@@ -80,7 +90,7 @@ describe('requirements/[id] route', () => {
 
       const req = new NextRequest('http://localhost/api/requirements/1')
       const res = await GET(req, makeParams('1'))
-      expect(res.status).toBe(400)
+      expect(res.status).toBe(500)
     })
 
     it('returns handled errors when request context creation fails', async () => {
@@ -89,7 +99,7 @@ describe('requirements/[id] route', () => {
       const req = new NextRequest('http://localhost/api/requirements/1')
       const res = await GET(req, makeParams('1'))
 
-      expect(res.status).toBe(400)
+      expect(res.status).toBe(500)
       expect(mockGetRequirement).not.toHaveBeenCalled()
     })
   })
@@ -101,6 +111,8 @@ describe('requirements/[id] route', () => {
       const req = new NextRequest('http://localhost/api/requirements/1', {
         method: 'PUT',
         body: JSON.stringify({
+          baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+          baseVersionId: 10,
           description: 'Updated',
           references: [{ name: 'Ref1', uri: 'http://example.com' }],
           scenarioIds: [1, 2],
@@ -117,10 +129,48 @@ describe('requirements/[id] route', () => {
         expect.objectContaining({
           id: 1,
           operation: 'edit',
+          requirement: expect.objectContaining({
+            baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+            baseVersionId: 10,
+          }),
         }),
       )
     })
 
+    it('returns stale edit conflicts with details from the service', async () => {
+      mockManageRequirement.mockRejectedValue(
+        Object.assign(new Error('This requirement was updated'), {
+          code: 'conflict',
+          details: {
+            baseVersionId: 10,
+            latest: { uniqueId: 'REQ-001' },
+            latestVersionId: 10,
+            reason: 'stale_requirement_edit',
+          },
+          status: 409,
+        }),
+      )
+
+      const req = new NextRequest('http://localhost/api/requirements/1', {
+        method: 'PUT',
+        body: JSON.stringify({
+          baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+          baseVersionId: 10,
+          description: 'Updated',
+        }),
+        headers: { 'Content-Type': 'application/json' },
+      })
+      const res = await PUT(req, makeParams('1'))
+      const json = (await res.json()) as {
+        code: string
+        details: { reason: string }
+      }
+
+      expect(res.status).toBe(409)
+      expect(json.code).toBe('conflict')
+      expect(json.details.reason).toBe('stale_requirement_edit')
+    })
+
     it('returns error on failure', async () => {
       mockManageRequirement.mockRejectedValue(new Error('Validation'))
 
@@ -130,7 +180,7 @@ describe('requirements/[id] route', () => {
         headers: { 'Content-Type': 'application/json' },
       })
       const res = await PUT(req, makeParams('1'))
-      expect(res.status).toBe(400)
+      expect(res.status).toBe(500)
     })
   })
 
@@ -157,7 +207,7 @@ describe('requirements/[id] route', () => {
         method: 'DELETE',
       })
       const res = await DELETE(req, makeParams('1'))
-      expect(res.status).toBe(400)
+      expect(res.status).toBe(500)
     })
   })
 })
diff --git a/tests/unit/requirements-service.test.ts b/tests/unit/requirements-service.test.ts
index 1c3eaff6a..8ccd2ff5b 100644
--- a/tests/unit/requirements-service.test.ts
+++ b/tests/unit/requirements-service.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { forbiddenError } from '@/lib/requirements/errors'
+import { conflictError, forbiddenError } from '@/lib/requirements/errors'
 import { normalizeUiTerminology } from '@/lib/ui-terminology'
 
 const mocks = vi.hoisted(() => ({
@@ -119,6 +119,7 @@ function makeRequirementRecord() {
         id: 10,
         publishedAt: null,
         requiresTesting: true,
+        revisionToken: '11111111-1111-4111-8111-111111111111',
         status: 1,
         statusColor: '#3b82f6',
         statusNameEn: 'Draft',
@@ -260,6 +261,7 @@ describe('createRequirementsService', () => {
         qualityCharacteristicId: 9,
         requirementTypeId: 1,
         requiresTesting: true,
+        revisionToken: '11111111-1111-4111-8111-111111111111',
         status: 3,
         statusColor: '#22c55e',
         statusNameEn: 'Published',
@@ -320,6 +322,7 @@ describe('createRequirementsService', () => {
         qualityCharacteristicId: null,
         requirementTypeId: null,
         requiresTesting: false,
+        revisionToken: '11111111-1111-4111-8111-111111111111',
         status: 4,
         statusColor: '#6b7280',
         statusNameEn: 'Archived',
@@ -713,10 +716,74 @@ describe('createRequirementsService', () => {
     const result = await service.manageRequirement(makeContext(), {
       id: 1,
       operation: 'edit',
-      requirement: { description: 'Updated text' },
+      requirement: {
+        baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+        baseVersionId: 10,
+        description: 'Updated text',
+      },
     })
     expect(result.operation).toBe('edit')
-    expect(mocks.editRequirement).toHaveBeenCalled()
+    expect(mocks.editRequirement).toHaveBeenCalledWith(
+      expect.anything(),
+      1,
+      expect.objectContaining({
+        baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+        baseVersionId: 10,
+      }),
+    )
+  })
+
+  it('rejects edits without an optimistic concurrency token', async () => {
+    const service = createRequirementsService({} as never, {
+      logger,
+      uiSettings: makeUiSettings(),
+    })
+
+    await expect(
+      service.manageRequirement(makeContext(), {
+        id: 1,
+        operation: 'edit',
+        requirement: { description: 'Updated text' },
+      }),
+    ).rejects.toMatchObject({
+      code: 'validation',
+      details: { reason: 'missing_edit_precondition' },
+    })
+    expect(mocks.editRequirement).not.toHaveBeenCalled()
+  })
+
+  it('adds the latest requirement snapshot to stale edit conflicts', async () => {
+    mocks.editRequirement.mockRejectedValue(
+      conflictError('This requirement was updated after you started editing.', {
+        baseVersionId: 10,
+        latestVersionId: 10,
+        reason: 'stale_requirement_edit',
+      }),
+    )
+    const service = createRequirementsService({} as never, {
+      logger,
+      uiSettings: makeUiSettings(),
+    })
+
+    await expect(
+      service.manageRequirement(makeContext(), {
+        id: 1,
+        operation: 'edit',
+        requirement: {
+          baseRevisionToken: '11111111-1111-4111-8111-111111111111',
+          baseVersionId: 10,
+          description: 'Updated text',
+        },
+      }),
+    ).rejects.toMatchObject({
+      code: 'conflict',
+      details: {
+        baseVersionId: 10,
+        latest: expect.objectContaining({ uniqueId: 'INT0001' }),
+        latestVersionId: 10,
+        reason: 'stale_requirement_edit',
+      },
+    })
   })
 
   it('initiates archiving review for a requirement', async () => {
diff --git a/tests/unit/version-detail-client.test.tsx b/tests/unit/version-detail-client.test.tsx
index 522445a0f..c502869ad 100644
--- a/tests/unit/version-detail-client.test.tsx
+++ b/tests/unit/version-detail-client.test.tsx
@@ -37,6 +37,7 @@ function makeVersion(
     publishedAt: null,
     qualityCharacteristic: { id: 4, nameSv: 'TC', nameEn: 'TypeCat' },
     requiresTesting: true,
+    revisionToken: '11111111-1111-4111-8111-111111111111',
     riskLevel: null,
     status: 2,
     statusColor: '#eab308',
diff --git a/typeorm/migrations/0001_initial_sqlserver.mjs b/typeorm/migrations/0001_initial_sqlserver.mjs
index fe3c61f31..3d6ea8f24 100644
--- a/typeorm/migrations/0001_initial_sqlserver.mjs
+++ b/typeorm/migrations/0001_initial_sqlserver.mjs
@@ -19,7 +19,7 @@ const UP_STATEMENTS = [
   'CREATE TABLE [package_local_requirements] (\n  [id] int IDENTITY(1,1) NOT NULL,\n  [package_id] int NOT NULL,\n  [unique_id] nvarchar(450) NOT NULL,\n  [sequence_number] int NOT NULL,\n  [requirement_area_id] int NULL,\n  [description] nvarchar(max) NOT NULL,\n  [acceptance_criteria] nvarchar(max) NULL,\n  [requirement_category_id] int NULL,\n  [requirement_type_id] int NULL,\n  [quality_characteristic_id] int NULL,\n  [risk_level_id] int NULL,\n  [is_testing_required] bit NOT NULL DEFAULT (0),\n  [verification_method] nvarchar(max) NULL,\n  [needs_reference_id] int NULL,\n  [package_item_status_id] int NULL,\n  [note] nvarchar(max) NULL,\n  [status_updated_at] datetime2(3) NULL,\n  [created_at] datetime2(3) NOT NULL,\n  [updated_at] datetime2(3) NOT NULL,\n  CONSTRAINT [pk_package_local_requirements] PRIMARY KEY ([id])\n);',
   'CREATE TABLE [package_local_requirement_deviations] (\n  [id] int IDENTITY(1,1) NOT NULL,\n  [package_local_requirement_id] int NOT NULL,\n  [motivation] nvarchar(max) NOT NULL,\n  [is_review_requested] bit NOT NULL DEFAULT (0),\n  [decision] int NULL,\n  [decision_motivation] nvarchar(max) NULL,\n  [decided_by] nvarchar(max) NULL,\n  [decided_at] datetime2(3) NULL,\n  [created_by] nvarchar(max) NULL,\n  [created_at] datetime2(3) NOT NULL,\n  [updated_at] datetime2(3) NULL,\n  CONSTRAINT [pk_package_local_requirement_deviations] PRIMARY KEY ([id])\n);',
   'CREATE TABLE [package_local_requirement_norm_references] (\n  [package_local_requirement_id] int NOT NULL,\n  [norm_reference_id] int NOT NULL,\n  CONSTRAINT [pk_package_local_requirement_norm_references] PRIMARY KEY ([package_local_requirement_id], [norm_reference_id])\n);',
-  'CREATE TABLE [requirement_versions] (\n  [id] int IDENTITY(1,1) NOT NULL,\n  [requirement_id] int NOT NULL,\n  [version_number] int NOT NULL,\n  [description] nvarchar(max) NOT NULL,\n  [acceptance_criteria] nvarchar(max) NULL,\n  [requirement_category_id] int NULL,\n  [requirement_type_id] int NULL,\n  [quality_characteristic_id] int NULL,\n  [requirement_status_id] int NOT NULL,\n  [is_testing_required] bit NOT NULL DEFAULT (0),\n  [verification_method] nvarchar(max) NULL,\n  [created_at] datetime2(3) NOT NULL,\n  [edited_at] datetime2(3) NULL,\n  [published_at] datetime2(3) NULL,\n  [archived_at] datetime2(3) NULL,\n  [created_by] nvarchar(max) NULL,\n  [archive_initiated_at] datetime2(3) NULL,\n  [risk_level_id] int NULL,\n  CONSTRAINT [pk_requirement_versions] PRIMARY KEY ([id])\n);',
+  'CREATE TABLE [requirement_versions] (\n  [id] int IDENTITY(1,1) NOT NULL,\n  [revision_token] uniqueidentifier NOT NULL CONSTRAINT [df_requirement_versions_revision_token] DEFAULT NEWID(),\n  [requirement_id] int NOT NULL,\n  [version_number] int NOT NULL,\n  [description] nvarchar(max) NOT NULL,\n  [acceptance_criteria] nvarchar(max) NULL,\n  [requirement_category_id] int NULL,\n  [requirement_type_id] int NULL,\n  [quality_characteristic_id] int NULL,\n  [requirement_status_id] int NOT NULL,\n  [is_testing_required] bit NOT NULL DEFAULT (0),\n  [verification_method] nvarchar(max) NULL,\n  [created_at] datetime2(3) NOT NULL,\n  [edited_at] datetime2(3) NULL,\n  [published_at] datetime2(3) NULL,\n  [archived_at] datetime2(3) NULL,\n  [created_by] nvarchar(max) NULL,\n  [archive_initiated_at] datetime2(3) NULL,\n  [risk_level_id] int NULL,\n  CONSTRAINT [pk_requirement_versions] PRIMARY KEY ([id])\n);',
   'CREATE TABLE [improvement_suggestions] (\n  [id] int IDENTITY(1,1) NOT NULL,\n  [requirement_id] int NOT NULL,\n  [requirement_version_id] int NULL,\n  [content] nvarchar(max) NOT NULL,\n  [is_review_requested] bit NOT NULL DEFAULT (0),\n  [resolution] int NULL,\n  [resolution_motivation] nvarchar(max) NULL,\n  [resolved_by] nvarchar(max) NULL,\n  [resolved_at] datetime2(3) NULL,\n  [created_by] nvarchar(max) NULL,\n  [created_at] datetime2(3) NOT NULL,\n  [updated_at] datetime2(3) NULL,\n  [review_requested_at] datetime2(3) NULL,\n  CONSTRAINT [pk_improvement_suggestions] PRIMARY KEY ([id])\n);',
   'CREATE TABLE [requirement_package_items] (\n  [id] int IDENTITY(1,1) NOT NULL,\n  [requirement_package_id] int NOT NULL,\n  [requirement_id] int NOT NULL,\n  [requirement_version_id] int NOT NULL,\n  [needs_reference_id] int NULL,\n  [unused_1] nvarchar(max) NULL,\n  [created_at] datetime2(3) NOT NULL,\n  [package_item_status_id] int NULL,\n  [note] nvarchar(max) NULL,\n  [status_updated_at] datetime2(3) NULL,\n  CONSTRAINT [pk_requirement_package_items] PRIMARY KEY ([id])\n);',
   'CREATE TABLE [deviations] (\n  [id] int IDENTITY(1,1) NOT NULL,\n  [package_item_id] int NOT NULL,\n  [motivation] nvarchar(max) NOT NULL,\n  [decision] int NULL,\n  [decision_motivation] nvarchar(max) NULL,\n  [decided_by] nvarchar(max) NULL,\n  [decided_at] datetime2(3) NULL,\n  [created_by] nvarchar(max) NULL,\n  [created_at] datetime2(3) NOT NULL,\n  [updated_at] datetime2(3) NULL,\n  [is_review_requested] bit NOT NULL DEFAULT (0),\n  CONSTRAINT [pk_deviations] PRIMARY KEY ([id])\n);',
@@ -66,6 +66,7 @@ const UP_STATEMENTS = [
   'CREATE INDEX [idx_package_local_requirement_deviations_package_local_requirement_id] ON [package_local_requirement_deviations] ([package_local_requirement_id]);',
   'CREATE INDEX [idx_package_local_requirement_norm_references_norm_reference_id] ON [package_local_requirement_norm_references] ([norm_reference_id]);',
   'CREATE UNIQUE INDEX [uq_requirement_versions_requirement_id_version_number] ON [requirement_versions] ([requirement_id], [version_number]);',
+  'CREATE UNIQUE INDEX [uq_requirement_versions_revision_token] ON [requirement_versions] ([revision_token]);',
   'CREATE INDEX [idx_requirement_versions_requirement_id] ON [requirement_versions] ([requirement_id]);',
   'CREATE INDEX [idx_improvement_suggestions_requirement_version_id] ON [improvement_suggestions] ([requirement_version_id]);',
   'CREATE INDEX [idx_improvement_suggestions_requirement_id] ON [improvement_suggestions] ([requirement_id]);',
diff --git a/typeorm/migrations/0002_requirement_version_revision_token.mjs b/typeorm/migrations/0002_requirement_version_revision_token.mjs
new file mode 100644
index 000000000..738a9f710
--- /dev/null
+++ b/typeorm/migrations/0002_requirement_version_revision_token.mjs
@@ -0,0 +1,38 @@
+const UP_STATEMENTS = [
+  "IF COL_LENGTH(N'dbo.requirement_versions', N'revision_token') IS NULL ALTER TABLE [requirement_versions] ADD [revision_token] uniqueidentifier NULL;",
+  'UPDATE [requirement_versions] SET [revision_token] = NEWID() WHERE [revision_token] IS NULL;',
+  "IF EXISTS (SELECT 1 FROM sys.columns WHERE object_id = OBJECT_ID(N'dbo.requirement_versions') AND name = N'revision_token' AND is_nullable = 1) ALTER TABLE [requirement_versions] ALTER COLUMN [revision_token] uniqueidentifier NOT NULL;",
+  "IF NOT EXISTS (SELECT 1 FROM sys.default_constraints WHERE name = N'df_requirement_versions_revision_token' AND parent_object_id = OBJECT_ID(N'dbo.requirement_versions')) ALTER TABLE [requirement_versions] ADD CONSTRAINT [df_requirement_versions_revision_token] DEFAULT NEWID() FOR [revision_token];",
+  "IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = N'uq_requirement_versions_revision_token' AND object_id = OBJECT_ID(N'dbo.requirement_versions')) CREATE UNIQUE INDEX [uq_requirement_versions_revision_token] ON [requirement_versions] ([revision_token]);",
+]
+
+const DOWN_STATEMENTS = [
+  "IF EXISTS (SELECT 1 FROM sys.indexes WHERE name = N'uq_requirement_versions_revision_token' AND object_id = OBJECT_ID(N'dbo.requirement_versions')) DROP INDEX [uq_requirement_versions_revision_token] ON [requirement_versions];",
+  "IF EXISTS (SELECT 1 FROM sys.default_constraints WHERE name = N'df_requirement_versions_revision_token' AND parent_object_id = OBJECT_ID(N'dbo.requirement_versions')) ALTER TABLE [requirement_versions] DROP CONSTRAINT [df_requirement_versions_revision_token];",
+  "IF COL_LENGTH(N'dbo.requirement_versions', N'revision_token') IS NOT NULL ALTER TABLE [requirement_versions] DROP COLUMN [revision_token];",
+]
+
+export class RequirementVersionRevisionToken1713800000000 {
+  name = 'RequirementVersionRevisionToken1713800000000'
+  async up(queryRunner) {
+    for (const sql of UP_STATEMENTS) {
+      try {
+        await queryRunner.query(sql)
+      } catch (err) {
+        err.message = `${err.message}\n--- failing statement:\n${sql}`
+        throw err
+      }
+    }
+  }
+  async down(queryRunner) {
+    for (const sql of DOWN_STATEMENTS) {
+      try {
+        await queryRunner.query(sql)
+      } catch (err) {
+        err.message = `${err.message}\n--- failing statement:\n${sql}`
+        throw err
+      }
+    }
+  }
+}
+export default RequirementVersionRevisionToken1713800000000