diff --git a/extensions/index.html b/extensions/index.html
index bba25f4..6c859c3 100644
--- a/extensions/index.html
+++ b/extensions/index.html
@@ -97,24 +97,74 @@
 
 <section>
   <h2>Available extensions</h2>
-  <p class="lede">Currently one bundled add-on ships with a signed update channel. More on the way.</p>
+  <p class="lede">What ships inside Theseus today. Versions and hashes on this page are read from each
+    add-on's signed <code>updates.json</code> when the page loads, so they match what the browser
+    would install. First-party components show up under <b>Settings › Plug-ins</b> in Theseus,
+    everything else under <b>Settings › Extensions</b>.</p>
 
-  <div class="ext" id="screenshot">
-    <h3><span class="icon">📸</span> Screenshot <span class="cur" style="margin-left:auto">current 0.2.4</span></h3>
-    <div class="desc">Capture the current tab — visible viewport, entire scrollable page, or a rectangle
-      you draw. Pick a mode from the toolbar dropdown; the capture opens in a full-tab editor
-      (crop, annotate, redact, save).</div>
-    <div class="meta">Ships bundled with Theseus 0.3.21+. Later versions auto-update through
-      this endpoint on the next boot's 30-second poll.</div>
+  <div class="ext" id="aegis" data-ext="aegis">
+    <h3><span class="icon">🛡️</span> Aegis <span class="cur" style="margin-left:auto">current <span data-live="version">0.6.21</span></span></h3>
+    <div class="desc">Multi-chain wallet (BCH, BTC, TRX, ETH, SOL, SC, DGB) derived from your Theseus vault, with
+      a dApp bridge for the pages you visit. Bundled; updates over this signed channel and through the
+      panel's own "Stage → Restart" flow.</div>
+    <div class="meta">Plug-in · Settings › Plug-ins · <span data-live="count"></span></div>
     <div class="verifybox">
       <div class="lbl">Signed update manifest — SHA-256 verified before install</div>
-      <div class="h"><b>updates.json</b><code><a href="https://navigate.st/bns/theseus.x/extensions/screenshot/updates.json">navigate.st/bns/theseus.x/extensions/screenshot/updates.json</a></code></div>
-      <div class="h"><b>Tarball</b><code><a href="https://navigate.st/bns/theseus.x/extensions/screenshot/screenshot-0.2.4.tar.gz">screenshot-0.2.4.tar.gz</a></code></div>
-      <div class="h"><b>sha256</b><code>399a9a3be696aaaa96a1c12c4da0bbae6585efbdc4338a5caabb1769e0f36861</code></div>
+      <div class="h"><b>updates.json</b><code><a href="./aegis/updates.json">theseus.x/extensions/aegis/updates.json</a></code></div>
+      <div class="h"><b>Tarball</b><code><a data-live="url" href="./aegis/aegis-0.6.21.tar.gz">aegis-0.6.21.tar.gz</a></code></div>
+      <div class="h"><b>sha256</b><code data-live="sha256">—</code></div>
     </div>
   </div>
+
+  <div class="ext" id="screenshot" data-ext="screenshot">
+    <h3><span class="icon">📸</span> Screenshot <span class="cur" style="margin-left:auto">current <span data-live="version">0.6.5</span></span></h3>
+    <div class="desc">Capture the current tab — visible viewport, entire scrollable page, or a rectangle
+      you draw. The capture opens in a full-tab editor: crop, annotate, line tool, resizable text,
+      redact, save.</div>
+    <div class="meta">Extension · Settings › Extensions · <span data-live="count"></span></div>
+    <div class="verifybox">
+      <div class="lbl">Signed update manifest — SHA-256 verified before install</div>
+      <div class="h"><b>updates.json</b><code><a href="./screenshot/updates.json">theseus.x/extensions/screenshot/updates.json</a></code></div>
+      <div class="h"><b>Tarball</b><code><a data-live="url" href="./screenshot/screenshot-0.6.5.tar.gz">screenshot-0.6.5.tar.gz</a></code></div>
+      <div class="h"><b>sha256</b><code data-live="sha256">87ae730d329ff9f552bbf513efba19bd14bb016bb90e24f7b62868434dadda60</code></div>
+    </div>
+  </div>
+
+  <div class="ext" id="notepad">
+    <h3><span class="icon">📝</span> Notepad <span class="cur" style="margin-left:auto">bundled 0.1.0</span></h3>
+    <div class="desc">Right-sidebar notes. Text lives on this machine only and autosaves as you type.</div>
+    <div class="meta">Extension · Settings › Extensions · no update channel yet — ships with each Theseus release.</div>
+  </div>
+
+  <div class="note"><b>Installing something else.</b> An extension is a folder with an <code>addon.json</code>.
+    Drop it into the extensions directory (Settings › Extensions › <i>Open extensions folder</i>), press
+    <i>Reload</i>, and it is live. Extensions run with full app access — treat one like an unsigned executable
+    and load only what you trust.</div>
 </section>
 
+<script>
+// Fill each card from its signed manifest. Relative URLs keep this working on
+// every origin the page is served from (navigate.st relay, bns:// in Theseus).
+(async () => {
+  for (const card of document.querySelectorAll(".ext[data-ext]")) {
+    const id = card.dataset.ext;
+    try {
+      const r = await fetch("./" + id + "/updates.json", { cache: "no-store" });
+      if (!r.ok) continue;
+      const m = await r.json();
+      const list = (m.addons || []).slice().sort((x, y) => cmp(y.version, x.version));
+      const top = list[0]; if (!top) continue;
+      const set = (k, f) => card.querySelectorAll('[data-live="' + k + '"]').forEach(f);
+      set("version", (el) => { el.textContent = top.version; });
+      set("sha256", (el) => { el.textContent = top.sha256 || "—"; });
+      set("url", (el) => { el.href = top.url; el.textContent = String(top.url).split("/").pop(); });
+      set("count", (el) => { el.textContent = list.length + " signed version" + (list.length === 1 ? "" : "s") + " on the channel"; });
+    } catch {}
+  }
+  function cmp(a, b) { const x = String(a).split(".").map(Number), y = String(b).split(".").map(Number); for (let i = 0; i < Math.max(x.length, y.length); i++) { const d = (x[i] || 0) - (y[i] || 0); if (d) return d; } return 0; }
+})();
+</script>
+
 <section>
   <h2>How updates work</h2>
   <p class="lede">Same mechanism a Firefox XPI update uses, cut down to what a name-native browser needs.</p>
@@ -124,7 +174,7 @@
       <li>Each entry carries an Ed25519 signature over <code>silentmode.addon-update-v1|&lt;id&gt;|&lt;version&gt;|&lt;sha256&gt;</code>. Theseus verifies against a small set of operator public keys baked into the build. Unsigned or badly-signed entries are dropped silently.</li>
       <li>If a signed version beats what's installed, Theseus downloads the tarball, re-checks its sha256, and stages the new copy under <code>&lt;userData&gt;/addons-updates-staged/&lt;id&gt;-&lt;version&gt;/</code>.</li>
       <li>On the next Theseus launch, <code>promoteStagedUpdates</code> moves the staged copy into <code>addons/&lt;id&gt;/</code>. Any prior copy is renamed to <code>addons-backups/&lt;id&gt;-&lt;oldver&gt;-&lt;timestamp&gt;/</code> so hand-edits survive.</li>
-      <li>The Settings &gt; Extensions surface (Theseus 0.3.26+) has a <b>Check for updates</b> button and a <b>Pending updates</b> box for on-demand control.</li>
+      <li>Settings › Extensions has a <b>Check for updates</b> button and shows what is staged; first-party plug-ins (Aegis) can also stage and restart from their own panel.</li>
     </ol>
   </div>
 </section>
@@ -144,7 +194,7 @@
   <ul style="color:var(--mut);font-size:14px;line-height:1.7">
     <li>On-BCNR pubkey publication so rotation is auditable end-to-end.</li>
     <li>Multi-sig (N-of-M operator keys) so a single compromised private key can't push code.</li>
-    <li>Extend to other bundled add-ons: <b>Notepad</b>, and the wallet add-ons as they stabilize.</li>
+    <li>Extend the channel to <b>Notepad</b> (bundled, no channel yet).</li>
   </ul>
 </section>