diff --git a/.dev.vars.example b/.dev.vars.example
index 4a174acf..04dd62d5 100644
--- a/.dev.vars.example
+++ b/.dev.vars.example
@@ -3,7 +3,7 @@ AUTH_CLIENT_SECRET="replace-with-oauth-client-secret-from-auth.fossbilling.net"
 SESSION_SECRET="replace-with-openssl-rand-base64-32"
 # Must match the api repo's ASSERTION_SIGNING_SECRET exactly (same shared secret).
 ASSERTION_SIGNING_SECRET="replace-with-openssl-rand-base64-32"
-# Shared secret for POST /api/revalidate (purges CDN-cached catalogue pages).
+# Shared secret for POST /api/revalidate (purges CDN-cached extension pages).
 # The api worker (or other writers) sends it as: Authorization: Bearer <secret>.
 EXTENSIONS_REVALIDATE_SECRET="replace-with-openssl-rand-base64-32"
 # Local development uses ordinary HTTP unless you run both Workers with a
diff --git a/astro.config.ts b/astro.config.ts
index 7ae5f4e5..dce9e76d 100644
--- a/astro.config.ts
+++ b/astro.config.ts
@@ -29,7 +29,6 @@ export default defineConfig({
     // served by URL without cookies, so the first visitor's variant would
     // leak to everyone.
     '/': { maxAge: 120, swr: 60, tags: [EXTENSIONS_CACHE_TAG] },
-    '/extension/[id]': { maxAge: 300, swr: 120, tags: [EXTENSIONS_CACHE_TAG] },
     '/404': { maxAge: 60 },
   },
   // Prefetch is disabled entirely: Cloudflare's edge refuses
diff --git a/openapi/extensions-v2.json b/openapi/extensions-v2.json
index 0586ae6c..530a62f6 100644
--- a/openapi/extensions-v2.json
+++ b/openapi/extensions-v2.json
@@ -429,6 +429,10 @@
                 "minLength": 1,
                 "maxLength": 4000
               },
+              "homepage_url": {
+                "type": "string",
+                "minLength": 1
+              },
               "license": {
                 "type": "string",
                 "minLength": 1
@@ -441,6 +445,10 @@
                 "minLength": 1,
                 "maxLength": 100
               },
+              "download_url": {
+                "type": "string",
+                "minLength": 1
+              },
               "id": {
                 "type": "string"
               },
@@ -458,23 +466,27 @@
           "fossbilling": {
             "type": "string",
             "minLength": 1,
-            "maxLength": 1000
+            "maxLength": 1000,
+            "pattern": "\\S"
           },
           "php": {
             "type": "string",
             "minLength": 1,
-            "maxLength": 1000
+            "maxLength": 1000,
+            "pattern": "\\S",
+            "description": "Additional PHP constraint; when omitted, FOSSBilling runtime requirements apply"
           },
           "modules": {
             "type": "object",
             "additionalProperties": {
               "type": "string",
               "minLength": 1,
-              "maxLength": 1000
+              "maxLength": 1000,
+              "pattern": "\\S"
             }
           }
         },
-        "required": ["fossbilling", "php"],
+        "required": ["fossbilling"],
         "additionalProperties": false
       },
       "Release": {
@@ -657,7 +669,9 @@
                                   "description": "At most 100 Unicode code points in historical content"
                                 },
                                 "min_fossbilling_version": {
-                                  "type": "string"
+                                  "type": "string",
+                                  "minLength": 1,
+                                  "maxLength": 100
                                 }
                               },
                               "additionalProperties": false
@@ -666,6 +680,10 @@
                         },
                         "maxItems": 100
                       },
+                      "homepage_url": {
+                        "type": "string",
+                        "minLength": 1
+                      },
                       "license": {
                         "type": "string",
                         "minLength": 1
@@ -677,6 +695,10 @@
                         "type": "string",
                         "minLength": 1,
                         "maxLength": 100
+                      },
+                      "download_url": {
+                        "type": "string",
+                        "minLength": 1
                       }
                     }
                   }
@@ -769,7 +791,9 @@
                       "description": "At most 100 Unicode code points in historical content"
                     },
                     "min_fossbilling_version": {
-                      "type": "string"
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 100
                     }
                   },
                   "additionalProperties": false
@@ -1923,7 +1947,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Extensions matching the scope: extension cards for scope=public, owned rows for scope=mine/all",
+            "description": "Extensions matching the scope: extension cards for scope=public, owned rows for scope=mine, moderation rows for scope=all",
             "content": {
               "application/json": {
                 "schema": {
@@ -2436,10 +2460,11 @@
         }
       }
     },
-    "/extensions/{id}/revisions": {
-      "get": {
+    "/extensions/{id}/revisions/{revisionId}": {
+      "put": {
         "tags": ["Extensions"],
-        "summary": "List an extension's revisions, newest first",
+        "summary": "Replace a pending submission for an extension the caller owns",
+        "description": "The active owner can replace publisher-created submissions. The replacement records the owner as submitter.",
         "security": [
           {
             "Bearer": []
@@ -2449,53 +2474,57 @@
           {
             "schema": {
               "type": "string",
-              "example": "b6e2c9c4-3f1a-4e9b-9c3a-2e4b1a2f9d10"
+              "example": "acme-gateway"
             },
             "required": true,
             "name": "id",
             "in": "path"
           },
-          {
-            "schema": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 100,
-              "default": 50
-            },
-            "required": false,
-            "name": "limit",
-            "in": "query"
-          },
           {
             "schema": {
               "type": "string",
-              "minLength": 1,
-              "maxLength": 1000
+              "example": "b6e2c9c4-3f1a-4e9b-9c3a-2e4b1a2f9d10"
             },
-            "required": false,
-            "name": "cursor",
-            "in": "query"
+            "required": true,
+            "name": "revisionId",
+            "in": "path"
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ExtensionUpdate"
+              }
+            }
+          }
+        },
         "responses": {
-          "200": {
-            "description": "Every version proposed for this extension, with its review outcome",
+          "202": {
+            "description": "Replaced with a new pending revision ID. Published content and reviewed history are unchanged.",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "properties": {
                     "result": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/ExtensionRevisionSummary"
-                      }
-                    },
-                    "pagination": {
-                      "$ref": "#/components/schemas/Pagination"
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string"
+                        },
+                        "revision_id": {
+                          "type": "string"
+                        },
+                        "status": {
+                          "type": "string",
+                          "enum": ["pending"]
+                        }
+                      },
+                      "required": ["id", "revision_id", "status"]
                     }
                   },
-                  "required": ["result", "pagination"]
+                  "required": ["result"]
                 }
               }
             }
@@ -2511,7 +2540,7 @@
             }
           },
           "403": {
-            "description": "The account is inactive, or the caller neither owns this extension nor moderates",
+            "description": "The account is inactive, or the caller does not own this extension",
             "content": {
               "application/json": {
                 "schema": {
@@ -2530,8 +2559,38 @@
               }
             }
           },
+          "409": {
+            "description": "The pending revision changed, was reviewed, ownership changed, or the pending-revision limit was reached",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "413": {
+            "description": "Raw request exceeds 512 KiB",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
           "422": {
-            "description": "Pagination query failed validation",
+            "description": "Body failed validation",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Extension write allowance exhausted; see Retry-After",
             "content": {
               "application/json": {
                 "schema": {
@@ -2549,11 +2608,19 @@
                 }
               }
             }
+          },
+          "503": {
+            "description": "Write admission unavailable",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           }
         }
-      }
-    },
-    "/extensions/{id}/revisions/{revisionId}": {
+      },
       "get": {
         "tags": ["Extensions"],
         "summary": "Read one revision; compacted content is null",
@@ -2662,6 +2729,123 @@
         }
       }
     },
+    "/extensions/{id}/revisions": {
+      "get": {
+        "tags": ["Extensions"],
+        "summary": "List an extension's revisions, newest first",
+        "security": [
+          {
+            "Bearer": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "example": "b6e2c9c4-3f1a-4e9b-9c3a-2e4b1a2f9d10"
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100,
+              "default": 50
+            },
+            "required": false,
+            "name": "limit",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 1000
+            },
+            "required": false,
+            "name": "cursor",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Every version proposed for this extension, with its review outcome",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "result": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/ExtensionRevisionSummary"
+                      }
+                    },
+                    "pagination": {
+                      "$ref": "#/components/schemas/Pagination"
+                    }
+                  },
+                  "required": ["result", "pagination"]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid bearer token",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The account is inactive, or the caller neither owns this extension nor moderates",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No extension with that id",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Pagination query failed validation",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Database error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/users/me/identity": {
       "put": {
         "tags": ["Users"],
diff --git a/src/components/DetailsCard.astro b/src/components/DetailsCard.astro
deleted file mode 100644
index 264e25a7..00000000
--- a/src/components/DetailsCard.astro
+++ /dev/null
@@ -1,143 +0,0 @@
----
-import type { Extension } from '@/types';
-import { repositoryURL } from '@/types';
-import { isSafeHttpUrl } from '@/lib/safe-url';
-import { CircleCheck, Download, GitBranch, Scale, User } from '@lucide/astro';
-
-interface Props {
-  ext: Extension;
-}
-
-const { ext } = Astro.props;
-const sourceUrl = repositoryURL(ext.source);
-
-type DetailsItem = {
-  name: string;
-  icon: typeof User;
-  color: 'amber' | 'green' | 'blue' | 'fuchsia';
-  text: string;
-  link?: string;
-};
-
-const colorClasses: Record<'amber' | 'green' | 'blue' | 'fuchsia', string> = {
-  amber: 'bg-amber-100 text-amber-700',
-  green: 'bg-green-100 text-green-700',
-  blue: 'bg-blue-100 text-blue-700',
-  fuchsia: 'bg-fuchsia-100 text-fuchsia-700',
-};
-
-const details: DetailsItem[] = [
-  {
-    name: 'Developer',
-    icon: User,
-    color: 'amber',
-    text: ext.developer.id,
-    link: `/developer/${ext.developer.id}`,
-  },
-  {
-    name: 'Current Version',
-    icon: CircleCheck,
-    color: 'green',
-    text: `v${ext.version}`,
-  },
-  {
-    name: 'FOSSBilling Version',
-    icon: CircleCheck,
-    color: 'green',
-    text: ext.requires.fossbilling,
-  },
-  {
-    name: 'PHP Version',
-    icon: CircleCheck,
-    color: 'green',
-    text: ext.requires.php,
-  },
-  {
-    name: 'Package Author',
-    icon: User,
-    color: 'amber',
-    text: ext.author.name,
-    link:
-      ext.author.url && isSafeHttpUrl(ext.author.url)
-        ? ext.author.url
-        : undefined,
-  },
-  {
-    name: 'License',
-    icon: Scale,
-    color: 'blue',
-    text: ext.license,
-  },
-  ...Object.entries(ext.requires.modules ?? {}).map(
-    ([id, range]): DetailsItem => ({
-      name: `Module: ${id}`,
-      icon: CircleCheck,
-      color: 'green',
-      text: range,
-    }),
-  ),
-  {
-    name: 'Source Code',
-    icon: GitBranch,
-    color: 'fuchsia',
-    text: ext.source.repo,
-    link: isSafeHttpUrl(sourceUrl) ? sourceUrl : undefined,
-  },
-  {
-    name: 'Download',
-    icon: Download,
-    color: 'blue',
-    text: 'Download extension',
-    link: isSafeHttpUrl(ext.download_url) ? ext.download_url : undefined,
-  },
-];
----
-
-<div class="card">
-  <header>
-    <h2>Extension Details</h2>
-  </header>
-  <section>
-    <ul class="space-y-2">
-      {details.map((detail) => (
-        <li
-          id={`detail-${detail.name.toLowerCase().replace(/\s+/g, '-')}`}
-          class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3"
-        >
-          <div class="flex items-center space-x-3">
-            <span class={`p-2 rounded-lg ${colorClasses[detail.color]}`}>
-              <detail.icon class="w-4 h-4" aria-hidden="true" />
-            </span>
-            <div>
-              <p class="font-medium text-sm">{detail.name}</p>
-            </div>
-          </div>
-          <div class="flex items-center">
-            {detail.link ? (
-              <a
-                href={detail.link}
-                target="_blank"
-                rel="noopener noreferrer"
-                class="btn"
-                data-size="sm"
-                data-variant="outline"
-                data-astro-prefetch={
-                  detail.link.startsWith('/developer/') ? 'false' : undefined
-                }
-              >
-                {detail.text}
-              </a>
-            ) : (
-              <span
-                class={`badge text-xs ${colorClasses[detail.color]}`}
-                data-variant="outline"
-              >
-                {detail.text}
-              </span>
-            )}
-          </div>
-        </li>
-      ))}
-    </ul>
-  </section>
-</div>
diff --git a/src/components/ExtensionForm.astro b/src/components/ExtensionForm.astro
index b4f80685..ca6a6f33 100644
--- a/src/components/ExtensionForm.astro
+++ b/src/components/ExtensionForm.astro
@@ -1,10 +1,11 @@
 ---
-import { EXTENSION_TYPES, SOURCE_TYPES, SPDX_LICENSE_IDS } from '@/types';
+import { EXTENSION_TYPES, SPDX_LICENSE_IDS, repositoryURL } from '@/types';
 import type { Developer, Extension } from '@/types';
 import { CircleAlert, SquarePen, ChevronDown } from '@lucide/astro';
 import { stripUrlScheme } from '@/lib/url-prefix';
 import {
   OTHER_LICENSE,
+  formatModuleRequirements,
   type ExtensionFormEcho,
   type ReleaseDraft,
 } from '@/lib/extension-form';
@@ -287,15 +288,16 @@ const otherSpdxIds = SPDX_LICENSE_IDS.filter((id) => !popularSpdxIds.has(id));
             />
           </div>
           <div class="field">
-            <label for="requires_php">PHP *</label>
+            <label for="requires_php">
+              Additional PHP Requirement (Optional)
+            </label>
             <input
               class="input"
               id="requires_php"
               name="requires_php"
-              required
               maxlength="1000"
               value={shown?.requires.php}
-              placeholder=">=8.3"
+              placeholder="Inherit FOSSBilling Requirements"
             />
           </div>
           <div class="field">
@@ -305,7 +307,7 @@ const otherSpdxIds = SPDX_LICENSE_IDS.filter((id) => !popularSpdxIds.has(id));
               id="requires_modules"
               name="requires_modules"
               placeholder="branding: ^1.2"
-            >{echo?.moduleRequirementsInput ?? Object.entries(shown?.requires.modules ?? {}).map(([id, range]) => `${id}: ${range}`).join('\n')}</textarea>
+            >{echo?.moduleRequirementsInput ?? formatModuleRequirements(shown?.requires.modules)}</textarea>
             <p class="text-muted-foreground">
               One module-id: constraint per line.
             </p>
@@ -414,27 +416,18 @@ const otherSpdxIds = SPDX_LICENSE_IDS.filter((id) => !popularSpdxIds.has(id));
         <fieldset class="fieldset space-y-4">
           <legend>Source</legend>
           <div class="field">
-            <label for="source_type">Repository Host</label>
-            <select class="select w-full" id="source_type" name="source_type">
-              {SOURCE_TYPES.map((t) => (
-                <option value={t} selected={shown?.source.type === t}>
-                  {t}
-                </option>
-              ))}
-            </select>
-          </div>
-          <div class="field">
-            <label for="source_repo">
-              Repository <span class="text-destructive">*</span>
+            <label for="source_url">
+              Source URL <span class="text-destructive">*</span>
             </label>
             <input
               class="input"
-              type="text"
-              id="source_repo"
-              name="source_repo"
+              type="url"
+              id="source_url"
+              name="source_url"
               required
-              value={shown?.source.repo}
-              placeholder="owner/repo, or a full URL for 'custom'"
+              maxlength="2048"
+              value={shown ? repositoryURL(shown.source) : ''}
+              placeholder="https://github.com/owner/project"
             />
           </div>
         </fieldset>
@@ -555,7 +548,7 @@ const otherSpdxIds = SPDX_LICENSE_IDS.filter((id) => !popularSpdxIds.has(id));
                 id="correction_note"
                 name="correction_note"
                 required
-                maxlength="2000"
+                maxlength="2048"
                 rows="2"
                 placeholder="What was wrong with the live listing"
               >{correctionNote}</textarea>
@@ -616,7 +609,7 @@ const otherSpdxIds = SPDX_LICENSE_IDS.filter((id) => !popularSpdxIds.has(id));
 <script>
   import { renderMarkdown } from '@/lib/markdown';
 
-  // Same pipeline as Overview.astro, so authors see what visitors will.
+  // Same pipeline as ExtensionWorkspace.astro, so authors see what visitors will.
   const readmeInput = document.querySelector<HTMLTextAreaElement>('#readme');
   const readmePreview = document.querySelector<HTMLElement>('#readme-preview');
 
diff --git a/src/components/ExtensionHeader.astro b/src/components/ExtensionHeader.astro
index 13111083..f3b33c89 100644
--- a/src/components/ExtensionHeader.astro
+++ b/src/components/ExtensionHeader.astro
@@ -1,48 +1,110 @@
 ---
-import type { Extension } from '@/types';
-import { ArrowLeft } from '@lucide/astro';
-import { extensionIconUrl } from '@/lib/extension-icon';
+import type { StoredExtensionFields } from '@/lib/extensions-data';
+import type { Developer } from '@/types';
+import { latestRelease } from '@/lib/releases';
+import { ArrowLeft, Download, Package, User } from '@lucide/astro';
 import { getSignedImageUrl } from '@/lib/signed-image-url';
-
+import { extensionIconUrl } from '@/lib/extension-icon';
+import { isSafeHttpUrl } from '@/lib/safe-url';
 interface Props {
-  ext: Extension;
+  id: string;
+  content: StoredExtensionFields;
+  developer: Pick<Developer, 'id' | 'name'>;
+  versionLabel?: string;
+  backHref?: string;
+  backLabel?: string;
 }
-
-const { ext } = Astro.props;
+const {
+  id,
+  content,
+  developer,
+  versionLabel = 'Latest Version',
+  backHref = '/',
+  backLabel = 'Extensions',
+} = Astro.props;
+const latest = latestRelease(content.releases ?? []);
+const version = latest?.tag ?? content.version;
 const iconUrl = await getSignedImageUrl(
-  extensionIconUrl(ext),
+  extensionIconUrl({
+    ...content,
+    id,
+    source: content.source ?? { type: 'custom', repo: '' },
+  }),
   'icon',
   Astro.locals.env.sessionSecret,
 );
+const downloadUrl = latest?.download_url ?? content.download_url;
 ---
 
-<div class="flex items-start space-x-4">
+<a
+  href={backHref}
+  class="inline-flex items-center gap-2 text-sm text-muted-foreground hover:text-foreground"
+>
+  <ArrowLeft class="size-4" aria-hidden="true" />
+  {backLabel}
+</a>
+<header class="flex flex-col gap-6 sm:flex-row sm:items-start sm:justify-between">
+  <div class="flex min-w-0 items-start gap-4">
+    <div class="flex size-16 shrink-0 items-center justify-center rounded-xl border bg-muted/50">
+      {iconUrl ? (
+        <img
+          src={iconUrl}
+          width="48"
+          height="48"
+          alt=""
+          class="size-12 object-contain"
+          decoding="async"
+        />
+      ) : (
+        <Package class="size-7 text-muted-foreground" aria-hidden="true" />
+      )}
+    </div>
+    <div class="min-w-0 space-y-2">
+      <p class="text-xs font-medium uppercase tracking-widest text-muted-foreground">
+        Extension Overview
+      </p>
+      <div class="flex flex-wrap items-center gap-3">
+        <h1
+          data-extension-name
+          class="break-words text-2xl font-semibold tracking-tight sm:text-3xl"
+        >
+          {content.name ?? id}
+        </h1>
+        <span
+          class="text-lg text-muted-foreground"
+          data-extension-version
+          hidden={!version}
+        >
+          <span class="sr-only">{versionLabel} </span>
+          <span data-extension-version-value>
+            {version && /^\d/.test(version) ? `v${version}` : version}
+          </span>
+        </span>
+        <slot name="status" />
+      </div>
+      <p class="flex flex-wrap items-center gap-2 text-sm text-muted-foreground">
+        <a
+          href={`/developer/${developer.id}`}
+          class="inline-flex items-center gap-1.5 underline-offset-4 hover:underline"
+          data-astro-prefetch="false"
+        >
+          <User class="size-3.5" aria-hidden="true" />
+          {developer.name}
+        </a>
+        <span aria-hidden="true">/</span>
+        <span class="break-all">{id}</span>
+      </p>
+    </div>
+  </div>
   <a
-    href="/"
-    class="btn"
-    data-size="sm"
-    data-variant="ghost"
-    aria-label="Back to Extensions"
+    data-extension-download
+    hidden={!isSafeHttpUrl(downloadUrl)}
+    href={isSafeHttpUrl(downloadUrl) ? downloadUrl : undefined}
+    class="btn shrink-0 self-start"
+    target="_blank"
+    rel="noopener noreferrer"
   >
-    <ArrowLeft class="w-4 h-4" />
+    <Download class="size-4" aria-hidden="true" />
+    Download
   </a>
-  {iconUrl ? (
-    <img
-      src={iconUrl}
-      width="48"
-      height="48"
-      class="w-12 h-12 rounded-lg object-contain"
-      alt={`${ext.name} icon`}
-      decoding="async"
-    />
-  ) : (
-    <span class="w-12 h-12 rounded-lg bg-primary/10" aria-hidden="true" />
-  )}
-  <div class="flex-1">
-    <div class="flex items-baseline flex-wrap gap-2">
-      <h1 class="text-2xl font-semibold">{ext.name}</h1>
-      <span class="text-muted-foreground">v{ext.version || 'unknown'}</span>
-    </div>
-    <p class="text-muted-foreground mt-1">{ext.description}</p>
-  </div>
-</div>
+</header>
diff --git a/src/components/ExtensionNavigation.astro b/src/components/ExtensionNavigation.astro
new file mode 100644
index 00000000..47a3a51b
--- /dev/null
+++ b/src/components/ExtensionNavigation.astro
@@ -0,0 +1,39 @@
+---
+interface Props {
+  overviewUrl: string;
+  releasesUrl: string;
+  activeReleases: boolean;
+  releaseCount: number;
+}
+const { overviewUrl, releasesUrl, activeReleases, releaseCount } = Astro.props;
+---
+
+<nav class="flex gap-6 border-b text-sm" aria-label="Extension Sections">
+  <a
+    href={overviewUrl}
+    class:list={[
+      'border-b-2 pb-3',
+      !activeReleases
+        ? 'border-foreground font-semibold'
+        : 'border-transparent text-muted-foreground',
+    ]}
+    aria-current={!activeReleases ? 'page' : undefined}
+  >
+    Overview
+  </a>
+  <a
+    href={releasesUrl}
+    class:list={[
+      'border-b-2 pb-3',
+      activeReleases
+        ? 'border-foreground font-semibold'
+        : 'border-transparent text-muted-foreground',
+    ]}
+    aria-current={activeReleases ? 'page' : undefined}
+  >
+    Releases{' '}
+    <span data-release-count class="ml-1 text-muted-foreground">
+      {releaseCount}
+    </span>
+  </a>
+</nav>
diff --git a/src/components/ExtensionOverviewDetails.astro b/src/components/ExtensionOverviewDetails.astro
new file mode 100644
index 00000000..03a7b1bd
--- /dev/null
+++ b/src/components/ExtensionOverviewDetails.astro
@@ -0,0 +1,196 @@
+---
+import { latestRelease } from '@/lib/releases';
+import { compatibilityLabel } from '@/lib/requirements';
+import type { StoredExtensionFields } from '@/lib/extensions-data';
+import { EXTENSION_TYPE_LABELS, repositoryURL, isExtensionType } from '@/types';
+import { licenseUrl } from '@/lib/license';
+import { isSafeHttpUrl } from '@/lib/safe-url';
+import GitHubMark from './icons/GitHubMark.astro';
+import {
+  Package,
+  Globe,
+  Image,
+  Scale,
+  Link,
+  CircleCheck,
+  Code,
+  TextAlignStart,
+  User,
+} from '@lucide/astro';
+interface Props {
+  content: StoredExtensionFields;
+  showIconUrl?: boolean;
+  developerName?: string;
+}
+const { content, showIconUrl = false, developerName } = Astro.props;
+const homepageUrl = content.homepage_url ?? content.website;
+const requires =
+  latestRelease(content.releases ?? [])?.requires ?? content.requires;
+const sourceUrl = content.source ? repositoryURL(content.source) : undefined;
+const licenseHref = licenseUrl(content.license);
+---
+
+<dl class="grid gap-4 text-sm sm:grid-cols-2 lg:grid-cols-1">
+  <div class="sm:col-span-2 lg:col-span-1">
+    <dt class="flex items-center gap-2 text-xs text-muted-foreground">
+      <TextAlignStart class="size-3.5" aria-hidden="true" />
+      Description
+    </dt>
+    <dd
+      class="mt-1 whitespace-pre-wrap leading-relaxed text-muted-foreground"
+      data-preview-description
+    >
+      {content.description}
+    </dd>
+  </div>
+  <div>
+    <dt class="flex items-center gap-2 text-xs text-muted-foreground">
+      <Package class="size-3.5" aria-hidden="true" />
+      Type
+    </dt>
+    <dd class="mt-1" data-preview-type>
+      {isExtensionType(content.type ?? null)
+        ? EXTENSION_TYPE_LABELS[
+            content.type as keyof typeof EXTENSION_TYPE_LABELS
+          ]
+        : 'Not Available'}
+    </dd>
+  </div>
+  <div>
+    <dt class="flex items-center gap-2 text-xs text-muted-foreground">
+      <Globe class="size-3.5" aria-hidden="true" />
+      Homepage
+    </dt>
+    <dd class="mt-1 break-all">
+      <a
+        data-preview-website
+        href={isSafeHttpUrl(homepageUrl) ? homepageUrl : undefined}
+        target="_blank"
+        rel="noopener noreferrer"
+        class:list={[
+          'underline-offset-4',
+          { underline: isSafeHttpUrl(homepageUrl) },
+        ]}
+      >
+        {homepageUrl || 'Not Available'}
+      </a>
+    </dd>
+  </div>
+  <div
+    class="sm:col-span-2 lg:col-span-1"
+    data-icon-url-detail
+    hidden={!showIconUrl || !content.icon_url}
+  >
+    <dt class="flex items-center gap-2 text-xs text-muted-foreground">
+      <Image class="size-3.5" aria-hidden="true" />
+      Icon Path
+    </dt>
+    <dd class="mt-1 break-all" data-preview-icon>
+      {content.icon_url}
+    </dd>
+  </div>
+
+  <div>
+    <dt class="flex items-center gap-2 text-xs text-muted-foreground">
+      <Code class="size-3.5" aria-hidden="true" />
+      Source
+    </dt>
+    <dd class="mt-1">
+      <a
+        data-preview-source-link
+        href={isSafeHttpUrl(sourceUrl) ? sourceUrl : undefined}
+        target="_blank"
+        rel="noopener noreferrer"
+        class="inline-flex max-w-full items-start gap-2 underline underline-offset-4"
+      >
+        <span
+          data-source-github-icon
+          hidden={content.source?.type !== 'github'}
+          class="mt-0.5 shrink-0"
+          aria-hidden="true"
+        >
+          <GitHubMark class="size-4" />
+        </span>
+        <span
+          data-source-link-icon
+          hidden={!content.source || content.source.type === 'github'}
+          class="mt-0.5 shrink-0"
+          aria-hidden="true"
+        >
+          <Link class="size-4" />
+        </span>
+        <span data-preview-source class="min-w-0 break-all">
+          {content.source?.type === 'github'
+            ? content.source.repo
+            : sourceUrl || 'Not Available'}
+        </span>
+      </a>
+    </dd>
+  </div>
+  <div>
+    <dt class="flex items-center gap-2 text-xs text-muted-foreground">
+      <Scale class="size-3.5" aria-hidden="true" />
+      License
+    </dt>
+    <dd class="mt-1">
+      <a
+        data-preview-license
+        href={licenseHref}
+        target="_blank"
+        rel="noopener noreferrer"
+        class:list={['underline-offset-4', { underline: Boolean(licenseHref) }]}
+      >
+        {(typeof content.license === 'string'
+          ? content.license
+          : content.license?.name) || 'Not Available'}
+      </a>
+    </dd>
+  </div>
+  <div
+    data-author-detail
+    hidden={
+      !content.author?.name ||
+      content.author.name.trim() === developerName?.trim()
+    }
+  >
+    <dt class="flex items-center gap-2 text-xs text-muted-foreground">
+      <User class="size-3.5" aria-hidden="true" />
+      Author
+    </dt>
+    <dd class="mt-1">
+      <a
+        data-preview-author
+        href={
+          isSafeHttpUrl(content.author?.url) ? content.author?.url : undefined
+        }
+        target="_blank"
+        rel="noopener noreferrer"
+        class:list={[
+          'underline-offset-4',
+          { underline: isSafeHttpUrl(content.author?.url) },
+        ]}
+      >
+        {content.author?.name}
+      </a>
+    </dd>
+  </div>
+  <div data-requirements-detail hidden={!requires}>
+    <dt class="flex items-center gap-2 text-xs text-muted-foreground">
+      <CircleCheck class="size-3.5" aria-hidden="true" />
+      Compatibility
+    </dt>
+    <dd class="mt-1 whitespace-pre-line" data-preview-requirements>
+      {requires
+        ? [
+            `FOSSBilling ${compatibilityLabel(requires.fossbilling)}`,
+            ...(requires.php
+              ? [`PHP ${compatibilityLabel(requires.php)}`]
+              : []),
+            ...Object.entries(requires.modules ?? {}).map(
+              ([id, constraint]) => `${id}: ${constraint}`,
+            ),
+          ].join('\n')
+        : ''}
+    </dd>
+  </div>
+</dl>
diff --git a/src/components/ExtensionReleases.astro b/src/components/ExtensionReleases.astro
new file mode 100644
index 00000000..4cc38428
--- /dev/null
+++ b/src/components/ExtensionReleases.astro
@@ -0,0 +1,100 @@
+---
+import { compatibilityLabel } from '@/lib/requirements';
+import type { Release } from '@/types';
+import { latestRelease, releasesDescending } from '@/lib/releases';
+import { isSafeHttpUrl } from '@/lib/safe-url';
+interface Props {
+  releases: Release[];
+  editable: boolean;
+  disabledReason?: string;
+  showActions?: boolean;
+}
+const { releases, editable, disabledReason, showActions = true } = Astro.props;
+const latest = latestRelease(releases);
+---
+
+<ul data-release-list class="divide-y">
+  {releasesDescending(releases).map((release) => (
+    <li class="flex flex-wrap items-center justify-between gap-4 p-5 sm:px-6">
+      <div class="min-w-0 max-w-full">
+        <p class="text-sm font-semibold">
+          {release.tag}
+          {release.tag === latest?.tag ? ' · Latest Version' : ''}
+        </p>
+        <p class="mt-1 text-xs text-muted-foreground">
+          {release.date} · FOSSBilling{' '}
+          {compatibilityLabel(release.requires.fossbilling)}
+          {release.requires.php
+            ? ` · PHP ${compatibilityLabel(release.requires.php)}`
+            : ''}
+        </p>
+        <p class="mt-2 max-w-xl text-xs text-muted-foreground">
+          <a
+            href={
+              isSafeHttpUrl(release.download_url)
+                ? release.download_url
+                : undefined
+            }
+            target="_blank"
+            rel="noopener noreferrer"
+            class:list={[
+              'break-all underline-offset-4',
+              { underline: isSafeHttpUrl(release.download_url) },
+            ]}
+          >
+            {release.download_url}
+          </a>
+          {release.changelog_url && isSafeHttpUrl(release.changelog_url) && (
+            <span class="whitespace-nowrap">
+              <span aria-hidden="true">{' | '}</span>
+              <a
+                href={release.changelog_url}
+                target="_blank"
+                rel="noopener noreferrer"
+                class="underline underline-offset-4"
+                aria-label={`Changelog for ${release.tag}`}
+              >
+                Changelog
+              </a>
+            </span>
+          )}
+        </p>
+      </div>
+      {showActions && (
+        <div class="flex flex-wrap gap-2">
+          <button
+            type="button"
+            class="btn"
+            data-variant="outline"
+            data-size="sm"
+            disabled={!editable}
+            title={!editable ? disabledReason : undefined}
+            aria-label={`Edit Release ${release.tag}`}
+          >
+            Edit
+          </button>
+          {editable && (
+            <button
+              type="button"
+              class="btn"
+              data-variant="destructive"
+              data-size="sm"
+              disabled={releases.length === 1}
+              title={
+                releases.length === 1 ? 'Keep at least one release.' : undefined
+              }
+              aria-label={`Remove Release ${release.tag}`}
+            >
+              Remove
+            </button>
+          )}
+        </div>
+      )}
+    </li>
+  ))}
+</ul>
+{releases.length === 0 && (
+  <p data-release-empty class="p-6 text-sm text-muted-foreground">
+    No releases are available for this version.
+  </p>
+)}
diff --git a/src/components/ExtensionSectionFields.astro b/src/components/ExtensionSectionFields.astro
new file mode 100644
index 00000000..a75e741b
--- /dev/null
+++ b/src/components/ExtensionSectionFields.astro
@@ -0,0 +1,161 @@
+---
+import type { ExtensionUpdate } from '@/lib/api/client';
+import type { DraftSection } from '@/lib/extension-draft';
+import {
+  EXTENSION_TYPES,
+  SPDX_LICENSE_IDS,
+  EXTENSION_TYPE_LABELS,
+  repositoryURL,
+} from '@/types';
+import { OTHER_LICENSE } from '@/lib/extension-form';
+interface Props {
+  section: DraftSection;
+  content: ExtensionUpdate;
+}
+const { section, content } = Astro.props;
+---
+
+{section === 'listing' && (
+  <>
+    <label class="grid gap-2 text-sm font-medium">
+      Name
+      <input
+        class="input w-full"
+        name="name"
+        required
+        maxlength="120"
+        value={content.name}
+      />
+    </label>
+    <label class="grid gap-2 text-sm font-medium">
+      Short Description
+      <textarea
+        class="textarea w-full"
+        name="description"
+        rows="3"
+        required
+        maxlength="4000"
+      >{content.description}</textarea>
+    </label>
+    <label class="grid gap-2 text-sm font-medium">
+      Extension Type
+      <select class="select w-full" name="type">
+        {EXTENSION_TYPES.map((type) => (
+          <option value={type} selected={content.type === type}>
+            {EXTENSION_TYPE_LABELS[type]}
+          </option>
+        ))}
+      </select>
+    </label>
+    <label class="grid gap-2 text-sm font-medium">
+      Homepage
+      <input
+        class="input w-full"
+        name="homepage_url"
+        type="url"
+        value={content.homepage_url}
+      />
+    </label>
+    <label class="grid gap-2 text-sm font-medium">
+      Icon Path <span class="font-normal text-muted-foreground">Optional</span>
+      <input
+        class="input w-full"
+        name="icon_url"
+        type="text"
+        value={content.icon_url}
+      />
+    </label>
+  </>
+)}
+{section === 'listing' && (
+  <>
+    <label class="grid gap-2 text-sm font-medium">
+      Author Name
+      <input
+        class="input w-full"
+        name="author_name"
+        required
+        maxlength="200"
+        value={content.author.name}
+      />
+    </label>
+    <label class="grid gap-2 text-sm font-medium">
+      Author URL <span class="font-normal text-muted-foreground">Optional</span>
+      <input
+        class="input w-full"
+        type="url"
+        name="author_url"
+        value={content.author.url}
+      />
+    </label>
+    <p class="text-xs text-muted-foreground">
+      Manage compatibility for each version in the Releases tab.
+    </p>
+  </>
+)}
+{section === 'readme' && (
+  <>
+    <label class="grid gap-2 text-sm font-medium">
+      README (Markdown)
+      <textarea
+        class="textarea w-full min-h-72 font-mono text-sm"
+        name="readme"
+        rows="14"
+        required
+        maxlength="100000"
+      >{content.readme}</textarea>
+    </label>
+    <p class="text-xs text-muted-foreground">
+      Save to draft to preview your README below.
+    </p>
+  </>
+)}
+{section === 'listing' && (
+  <>
+    <label class="grid gap-2 text-sm font-medium">
+      Source URL
+      <input
+        class="input w-full"
+        type="url"
+        name="source_url"
+        required
+        maxlength="2048"
+        value={content.source.repo ? repositoryURL(content.source) : ''}
+        placeholder="https://github.com/owner/project"
+      />
+    </label>
+    <label class="grid gap-2 text-sm font-medium">
+      License
+      <select class="select w-full" name="license_spdx_id">
+        {SPDX_LICENSE_IDS.map((id) => (
+          <option value={id} selected={content.license === id}>
+            {id}
+          </option>
+        ))}
+        <option
+          value={OTHER_LICENSE}
+          selected={!SPDX_LICENSE_IDS.includes(content.license)}
+        >
+          Other / Proprietary
+        </option>
+      </select>
+    </label>
+    <label
+      class="grid gap-2 text-sm font-medium"
+      data-custom-license
+      hidden={SPDX_LICENSE_IDS.includes(content.license)}
+    >
+      Custom License Name
+      <input
+        class="input w-full"
+        name="license_name_custom"
+        value={
+          SPDX_LICENSE_IDS.includes(content.license)
+            ? undefined
+            : content.license
+        }
+        maxlength="1000"
+      />
+    </label>
+  </>
+)}
diff --git a/src/components/ExtensionWorkspace.astro b/src/components/ExtensionWorkspace.astro
new file mode 100644
index 00000000..47c59419
--- /dev/null
+++ b/src/components/ExtensionWorkspace.astro
@@ -0,0 +1,345 @@
+---
+import type { StoredExtensionFields } from '@/lib/extensions-data';
+import { editableContent, serializeDraftConfig } from '@/lib/extension-draft';
+import ExtensionReleases from './ExtensionReleases.astro';
+import ExtensionOverviewDetails from './ExtensionOverviewDetails.astro';
+import ExtensionNavigation from './ExtensionNavigation.astro';
+import { renderMarkdown } from '@/lib/markdown';
+import { sha256Hex } from '@/lib/hash';
+import ExtensionSectionFields from './ExtensionSectionFields.astro';
+import RequirementsFields from './RequirementsFields.astro';
+import type { DraftSection } from '@/lib/extension-draft';
+import { Pencil, Plus } from '@lucide/astro';
+interface Props {
+  content: StoredExtensionFields;
+  id: string;
+  releases: boolean;
+  developerName?: string;
+  selectedVersion?: 'pending' | 'published';
+  editor?: {
+    userId: string;
+    canEdit: boolean;
+    pendingRevisionId?: string;
+    disabledReason?: string;
+    pendingEditUrl?: string;
+  };
+}
+const { content, id, releases, selectedVersion, editor, developerName } =
+  Astro.props;
+const { pendingRevisionId, disabledReason, pendingEditUrl } = editor ?? {};
+const editorContent = editor?.canEdit ? editableContent(content) : null;
+const releaseItems = content.releases ?? [];
+const baseUrl = `/extension/${id}`;
+const overviewUrl = `${baseUrl}${selectedVersion ? `?version=${selectedVersion}` : ''}`;
+const releasesUrl = `${baseUrl}?view=releases${selectedVersion ? `&version=${selectedVersion}` : ''}`;
+const submitLabel = pendingRevisionId
+  ? 'Update Pending Submission'
+  : 'Submit for Review';
+const config =
+  editorContent && editor
+    ? serializeDraftConfig({
+        base: editorContent,
+        developerName,
+        pendingRevisionId,
+        submitLabel,
+        baselineHash: await sha256Hex(JSON.stringify(editorContent)),
+        key: `extension-draft:${await sha256Hex(editor.userId)}:${id}`,
+        submitUrl: `${baseUrl}/draft`,
+      })
+    : '';
+const labels: Record<DraftSection, string> = {
+  listing: 'Overview',
+  readme: 'README',
+};
+---
+
+<div data-extension-workspace class="space-y-6">
+  {editorContent && (
+    <>
+      <script type="application/json" data-draft-config set:html={config} />
+      <noscript>
+        <div class="alert">
+          Enable JavaScript to edit sections and save a draft in this browser.
+        </div>
+      </noscript>
+      <div
+        data-draft-bar
+        hidden
+        class="sticky top-20 z-30 flex flex-col gap-4 rounded-xl border bg-card p-5 shadow-sm sm:flex-row sm:items-center sm:justify-between"
+      >
+        <div>
+          <p class="text-sm font-semibold" data-draft-status role="status">
+            No Local Changes
+          </p>
+          <p class="mt-1 text-xs text-muted-foreground">
+            Save changes across sections, then submit them together. Drafts stay
+            in this browser.
+          </p>
+        </div>
+        <div class="flex shrink-0 flex-wrap gap-2">
+          <button
+            type="button"
+            class="btn"
+            data-variant="ghost"
+            data-discard-draft
+            disabled
+          >
+            Discard Draft
+          </button>
+          <button type="button" class="btn" data-submit-draft disabled>
+            {submitLabel}
+          </button>
+        </div>
+      </div>
+      <p
+        data-draft-error
+        role="alert"
+        class="rounded-lg border border-destructive p-4 text-sm text-destructive"
+        hidden
+      ></p>
+    </>
+  )}
+  <ExtensionNavigation
+    overviewUrl={overviewUrl}
+    releasesUrl={releasesUrl}
+    activeReleases={releases}
+    releaseCount={releaseItems.length}
+  />
+  {releases ? (
+    <section
+      class="rounded-xl border bg-card"
+      aria-labelledby="extension-releases-title"
+    >
+      <header class="flex flex-wrap items-center justify-between gap-4 border-b p-5 sm:p-6">
+        <div>
+          <h2 class="font-semibold text-lg" id="extension-releases-title">
+            Releases
+          </h2>
+          {editor && (
+            <p class="mt-1 text-sm text-muted-foreground">
+              Manage versions, downloads, and compatibility independently of
+              your listing.
+            </p>
+          )}
+        </div>
+        {editor &&
+          (pendingEditUrl ? (
+            <a class="btn" href={pendingEditUrl}>
+              Edit Pending Releases
+            </a>
+          ) : (
+            <button
+              class="btn"
+              type="button"
+              data-add-release
+              disabled={!editorContent}
+              title={!editorContent ? disabledReason : undefined}
+            >
+              <Plus class="size-4" aria-hidden="true" />
+              Add Release
+            </button>
+          ))}
+      </header>
+      {editorContent && (
+        <div data-release-editor hidden class="border-b bg-muted/30 p-5 sm:p-6">
+          <form data-release-form class="max-w-2xl space-y-4">
+            <h3 class="font-semibold" data-release-form-title>
+              Add Release
+            </h3>
+            <input type="hidden" name="original_tag" />
+            <div class="grid gap-4 sm:grid-cols-2">
+              <label class="grid gap-2 text-sm font-medium">
+                Version Tag
+                <input
+                  class="input w-full"
+                  name="version_tag"
+                  required
+                  maxlength="100"
+                  placeholder="1.3.0"
+                />
+              </label>
+              <label class="grid gap-2 text-sm font-medium">
+                Release Date
+                <input
+                  class="input w-full"
+                  type="date"
+                  name="release_date"
+                  required
+                />
+              </label>
+            </div>
+            <label class="grid gap-2 text-sm font-medium">
+              Download URL
+              <input
+                class="input w-full"
+                type="url"
+                name="download_url"
+                required
+                placeholder="https://…"
+              />
+            </label>
+            <label class="grid gap-2 text-sm font-medium">
+              Changelog URL{' '}
+              <span class="font-normal text-muted-foreground">Optional</span>
+              <input
+                class="input w-full"
+                type="url"
+                name="changelog_url"
+                placeholder="https://…"
+              />
+            </label>
+            <RequirementsFields />
+            <p class="text-xs text-muted-foreground">
+              The latest version is selected automatically and supplies the
+              listing’s primary download. Release changes join your draft and
+              need moderator approval.
+            </p>
+            <p
+              data-release-error
+              role="alert"
+              class="text-sm text-destructive"
+              hidden
+            ></p>
+            <div class="flex gap-2">
+              <button type="submit" class="btn">
+                Save Release to Draft
+              </button>
+              <button
+                type="button"
+                class="btn"
+                data-variant="ghost"
+                data-cancel-release
+              >
+                Cancel
+              </button>
+            </div>
+          </form>
+        </div>
+      )}
+      <ExtensionReleases
+        releases={releaseItems}
+        editable={Boolean(editorContent)}
+        showActions={Boolean(editor)}
+        disabledReason={disabledReason}
+      />
+      {editorContent && (
+        <footer class="border-t p-5 text-xs text-muted-foreground">
+          Keep at least one release. Removing the latest release automatically
+          selects the next version.
+        </footer>
+      )}
+    </section>
+  ) : (
+    <div class="grid min-w-0 items-start gap-6 lg:grid-cols-[minmax(0,1fr)_22rem]">
+      {(['listing', 'readme'] as const).map((section) => (
+        <section
+          class:list={[
+            'min-w-0 rounded-xl border bg-card',
+            section === 'listing' ? 'lg:order-2' : 'lg:order-1',
+          ]}
+          id={`extension-${section}`}
+        >
+          <header class="flex items-center justify-between gap-3 border-b p-5 sm:px-6">
+            <h2 class="font-semibold">
+              {labels[section]}{' '}
+              {editor && (
+                <span
+                  data-section-changed={section}
+                  class="badge ml-2"
+                  data-variant="secondary"
+                  hidden
+                >
+                  Draft
+                </span>
+              )}
+            </h2>
+            {editor &&
+              (pendingEditUrl ? (
+                <a
+                  class="btn"
+                  data-size="sm"
+                  data-variant="ghost"
+                  href={`${pendingEditUrl}#extension-${section}`}
+                >
+                  <Pencil class="size-3.5" aria-hidden="true" />
+                  Edit Pending<span class="sr-only"> {labels[section]}</span>
+                </a>
+              ) : (
+                <button
+                  type="button"
+                  class="btn"
+                  data-size="sm"
+                  data-variant="ghost"
+                  data-edit-section={section}
+                  disabled={!editorContent}
+                  title={!editorContent ? disabledReason : undefined}
+                  aria-expanded={editorContent ? 'false' : undefined}
+                  aria-controls={
+                    editorContent ? `editor-${section}` : undefined
+                  }
+                >
+                  <Pencil class="size-3.5" aria-hidden="true" />
+                  <span data-edit-label>Edit</span>
+                  <span class="sr-only"> {labels[section]}</span>
+                </button>
+              ))}
+          </header>
+          {editorContent && (
+            <form
+              id={`editor-${section}`}
+              data-section-form={section}
+              hidden
+              class="space-y-4 rounded-b-xl bg-muted/30 p-5 sm:p-6"
+            >
+              <ExtensionSectionFields
+                section={section}
+                content={editorContent}
+              />
+              <p
+                data-section-error
+                role="alert"
+                class="text-sm text-destructive"
+                hidden
+              ></p>
+              <div class="flex gap-2">
+                <button type="submit" class="btn">
+                  Save to Draft
+                </button>
+                <button
+                  type="button"
+                  class="btn"
+                  data-variant="ghost"
+                  data-cancel-section={section}
+                >
+                  Cancel
+                </button>
+              </div>
+            </form>
+          )}
+          <div class="p-5 sm:p-6" data-section-preview={section}>
+            {section === 'listing' ? (
+              <ExtensionOverviewDetails
+                developerName={developerName}
+                content={content}
+                showIconUrl={Boolean(editor)}
+              />
+            ) : (
+              <div
+                class="markdown-body break-words"
+                data-preview-readme
+                set:html={renderMarkdown(
+                  content.readme || 'No README is available for this version.',
+                )}
+              />
+            )}
+          </div>
+        </section>
+      ))}
+    </div>
+  )}
+</div>
+
+<script>
+  import { initExtensionWorkspace } from '@/scripts/extension-workspace';
+  initExtensionWorkspace();
+</script>
diff --git a/src/components/HeaderAccount.astro b/src/components/HeaderAccount.astro
index fe6b6a6c..58e85af0 100644
--- a/src/components/HeaderAccount.astro
+++ b/src/components/HeaderAccount.astro
@@ -1,10 +1,8 @@
 ---
-// Server Island: the only per-user markup in the public page chrome. Every
-// page that includes this stays free of session-dependent HTML, which is
-// what makes route-level CDN caching (see routeRules in astro.config.mjs)
-// safe. The component reads the session cookie itself, so it takes no props
-// and needs no ASTRO_KEY. Basecoat's MutationObserver-initialized registry
-// wires up the dropdown menu when this fragment is inserted.
+// Server Island: personal account chrome stays separate from cached extension directory
+// HTML. Permission-aware extension pages render their body privately as well.
+// The component reads its own session cookie, so it takes no props and needs
+// no ASTRO_KEY. Basecoat's MutationObserver wires up the inserted dropdown.
 import { CircleUser, LogIn, LogOut, ShieldUser, User } from '@lucide/astro';
 import { getSessionUser } from '@/lib/session';
 
diff --git a/src/components/Overview.astro b/src/components/Overview.astro
deleted file mode 100644
index 4ec2ad73..00000000
--- a/src/components/Overview.astro
+++ /dev/null
@@ -1,13 +0,0 @@
----
-import type { Extension } from '@/types';
-import { renderMarkdown } from '@/lib/markdown';
-
-interface Props {
-  ext: Extension;
-}
-
-const { ext } = Astro.props;
-const readmeHtml = renderMarkdown(ext.readme ?? '');
----
-
-<div class="markdown-body" set:html={readmeHtml} />
diff --git a/src/components/OwnerExtensionView.astro b/src/components/OwnerExtensionView.astro
new file mode 100644
index 00000000..fe0b3b73
--- /dev/null
+++ b/src/components/OwnerExtensionView.astro
@@ -0,0 +1,257 @@
+---
+import ConfirmDeleteDialog from './ConfirmDeleteDialog.astro';
+import DateTime from './admin/DateTime.astro';
+import StatusBadge from './admin/StatusBadge.astro';
+import ExtensionWorkspace from './ExtensionWorkspace.astro';
+import ExtensionHeader from './ExtensionHeader.astro';
+import { editableContent, reconstructionContent } from '@/lib/extension-draft';
+import { createApiClient, type OwnedExtension } from '@/lib/api/client';
+import type { StoredExtensionFields } from '@/lib/extensions-data';
+interface Props {
+  owned: OwnedExtension;
+  userId: string;
+}
+const { owned, userId } = Astro.props;
+const id = owned.id;
+const env = Astro.locals.env;
+const api = createApiClient(env, userId);
+// A review decision and publication are independent: rejecting an update
+// leaves the published listing live. Keep both visible in the overview.
+const pending = owned.pending_revision;
+const review = owned.last_review;
+const published = owned.published;
+const listed = Boolean(published && !owned.delisted);
+const showSubmission = Boolean(
+  pending &&
+  (!published || Astro.url.searchParams.get('version') !== 'published'),
+);
+let content: StoredExtensionFields | null = showSubmission
+  ? (pending?.content ?? null)
+  : (published ?? null);
+let revisionError: string | null = null;
+if (!content && review) {
+  try {
+    const revision = await api.getRevision(id, review.revision_id);
+    content = revision.content;
+  } catch {
+    revisionError =
+      'Your previous submission could not be loaded. You can still review the feedback below or try again.';
+  }
+}
+const rebuilding = !revisionError && !editableContent(content);
+const editable =
+  editableContent(content) ??
+  (rebuilding ? reconstructionContent(content) : null);
+const canEdit = (!pending || showSubmission) && Boolean(editable);
+const managingReleases = Astro.url.searchParams.get('view') === 'releases';
+const name = content?.name ?? published?.name ?? id;
+const previewLabel = showSubmission
+  ? 'Pending Version'
+  : published
+    ? 'Published Version'
+    : 'Previous Submission';
+---
+
+<ExtensionHeader
+  id={id}
+  content={{ ...content, name }}
+  developer={owned.developer}
+  versionLabel={previewLabel}
+  backHref="/account"
+  backLabel="Your Extensions"
+>
+  <Fragment slot="status">
+    <StatusBadge
+      status={
+        owned.delisted ? 'delisted' : listed ? 'published' : 'never-published'
+      }
+      label={owned.delisted ? 'Delisted' : listed ? 'Live' : 'Not Published'}
+    />
+    {pending && <StatusBadge status="pending" label="Pending" />}
+  </Fragment>
+</ExtensionHeader>
+
+{owned.delisted && (
+  <div class="alert" data-variant="destructive">
+    <h2>Your Extension Has Been Delisted</h2>
+    <section>
+      <p>{owned.delisted.reason}</p>
+      <p class="mt-2">
+        Submitting an edit does not automatically restore the listing.
+      </p>
+    </section>
+  </div>
+)}
+
+{review?.status === 'rejected' && (
+  <section
+    class="rounded-xl border border-amber-300/70 bg-amber-50/60 p-5 dark:border-amber-800 dark:bg-amber-950/20"
+    aria-labelledby="feedback-title"
+  >
+    <h2 id="feedback-title" class="font-semibold">
+      Feedback on Your Last Submission
+    </h2>
+    {review.reviewed_at && (
+      <p class="mt-1 text-xs text-muted-foreground">
+        Reviewed <DateTime value={review.reviewed_at} />
+      </p>
+    )}
+    <p class="mt-3 whitespace-pre-wrap text-sm">
+      {review.review_note ||
+        'A moderator requested changes. Review your extension details before submitting again.'}
+    </p>
+    {listed && (
+      <p class="mt-3 text-sm text-muted-foreground">
+        Your published listing is still live.
+      </p>
+    )}
+  </section>
+)}
+
+{!published && (
+  <details class="rounded-xl border p-5">
+    <summary class="cursor-pointer text-sm font-medium">
+      Withdraw Extension
+    </summary>
+    <p class="mt-3 text-sm text-muted-foreground">
+      Permanently remove this unpublished extension and its review history. Its
+      ID will become available again.
+    </p>
+    <button
+      type="button"
+      class="btn mt-4"
+      data-variant="outline"
+      data-size="sm"
+      onclick="document.getElementById('withdraw-editable-extension').showModal()"
+    >
+      Withdraw Extension
+    </button>
+    <ConfirmDeleteDialog
+      id="withdraw-editable-extension"
+      title="Withdraw Extension"
+      description="Permanently deletes this extension and its revision history, and releases its id. This can't be undone."
+      confirmText={id}
+      formAction={`/extension/${id}/withdraw`}
+      submitLabel="Withdraw Extension"
+    />
+  </details>
+)}
+{rebuilding && canEdit && (
+  <div class="alert">
+    <h2>Rebuild Your Submission</h2>
+    <section>
+      Some previous submission content is no longer available. Complete the
+      listing, README, source and license, and at least one release before
+      submitting your draft.
+    </section>
+  </div>
+)}
+{published && pending && (
+  <nav
+    class="flex w-fit rounded-lg bg-muted p-1 text-sm"
+    aria-label="Preview version"
+  >
+    <a
+      href={
+        managingReleases
+          ? '?view=releases&version=published'
+          : '?version=published'
+      }
+      aria-current={!showSubmission ? 'page' : undefined}
+      class:list={[
+        'rounded-md px-3 py-1.5',
+        !showSubmission
+          ? 'bg-background font-medium shadow-sm'
+          : 'text-muted-foreground',
+      ]}
+    >
+      Published
+    </a>
+    <a
+      href={
+        managingReleases ? '?view=releases&version=pending' : '?version=pending'
+      }
+      aria-current={showSubmission ? 'page' : undefined}
+      class:list={[
+        'rounded-md px-3 py-1.5',
+        showSubmission
+          ? 'bg-background font-medium shadow-sm'
+          : 'text-muted-foreground',
+      ]}
+    >
+      Pending
+    </a>
+  </nav>
+)}
+{revisionError ? (
+  <div class="alert" role="alert">
+    <h2>Unable to Load Submission</h2>
+    <section>{revisionError}</section>
+    <footer>
+      <a
+        href={`${Astro.url.pathname}${Astro.url.search}`}
+        class="btn"
+        data-variant="outline"
+      >
+        Try Again
+      </a>
+    </footer>
+  </div>
+) : (
+  <ExtensionWorkspace
+    developerName={owned.developer.name}
+    content={editable ?? content ?? {}}
+    id={id}
+    releases={managingReleases}
+    selectedVersion={showSubmission ? 'pending' : 'published'}
+    editor={{
+      userId,
+      canEdit,
+      pendingEditUrl:
+        pending && !showSubmission
+          ? `/extension/${id}?${managingReleases ? 'view=releases&' : ''}version=pending`
+          : undefined,
+      pendingRevisionId: showSubmission ? pending?.id : undefined,
+      disabledReason: pending
+        ? 'Switch to Pending to edit the submission awaiting review.'
+        : 'This version is not available for editing.',
+    }}
+  />
+)}
+<section
+  class="rounded-xl border bg-card p-5 sm:p-6"
+  aria-labelledby="activity-title"
+>
+  <h2 id="activity-title" class="font-semibold">
+    Activity
+  </h2>
+  <ol class="mt-5 grid gap-5 text-sm sm:grid-cols-3">
+    {pending && (
+      <li>
+        <p class="font-medium">Submitted for Review</p>
+        <p class="mt-1 text-xs text-muted-foreground">
+          <DateTime value={pending.created_at} />
+        </p>
+      </li>
+    )}
+    {review && (
+      <li>
+        <p class="font-medium">
+          Last Submission{' '}
+          {review.status === 'approved' ? 'Approved' : 'Rejected'}
+        </p>
+        {review.reviewed_at && (
+          <p class="mt-1 text-xs text-muted-foreground">
+            <DateTime value={review.reviewed_at} />
+          </p>
+        )}
+      </li>
+    )}
+    <li>
+      <p class="font-medium">Extension Created</p>
+      <p class="mt-1 text-xs text-muted-foreground">
+        <DateTime value={owned.created_at} />
+      </p>
+    </li>
+  </ol>
+</section>
diff --git a/src/components/ReleasesCard.astro b/src/components/ReleasesCard.astro
deleted file mode 100644
index 21fed609..00000000
--- a/src/components/ReleasesCard.astro
+++ /dev/null
@@ -1,59 +0,0 @@
----
-import type { Extension } from '@/types';
-import { getLatestRelease, sortReleasesDescending } from '@/types';
-import { formatRelativeTime } from '@/lib/format-date';
-import { Download } from '@lucide/astro';
-
-interface Props {
-  ext?: Extension;
-}
-
-const { ext } = Astro.props;
-
-const latest = ext ? getLatestRelease(ext) : undefined;
-const latestThree = ext ? sortReleasesDescending(ext.releases).slice(0, 3) : [];
----
-
-<article class="card">
-  {latest ? (
-    <>
-      <header>
-        <div class="flex items-center justify-between">
-          <h2>Latest Release</h2>
-          <a
-            href={latest.download_url}
-            target="_blank"
-            rel="noopener noreferrer"
-            class="badge gap-1 cursor-pointer"
-          >
-            <Download class="w-4 h-4" />v{latest.tag}
-          </a>
-        </div>
-        <p class="text-sm text-muted-foreground mt-1">
-          <time datetime={latest.date}>{formatRelativeTime(latest.date)}</time>
-        </p>
-      </header>
-      <section>
-        <ul class="space-y-2">
-          {latestThree.map((release) => (
-            <li
-              id={`recent-${release.tag}`}
-              class="flex justify-between text-sm"
-            >
-              <span>v{release.tag}</span>
-              <span class="text-muted-foreground">
-                <time datetime={release.date}>
-                  {formatRelativeTime(release.date)}
-                </time>
-              </span>
-            </li>
-          ))}
-        </ul>
-      </section>
-    </>
-  ) : (
-    <header>
-      <h2>Latest Release</h2>
-    </header>
-  )}
-</article>
diff --git a/src/components/ReleasesTable.astro b/src/components/ReleasesTable.astro
deleted file mode 100644
index 5e7aaafd..00000000
--- a/src/components/ReleasesTable.astro
+++ /dev/null
@@ -1,79 +0,0 @@
----
-import type { Extension } from '@/types';
-import { sortReleasesDescending } from '@/types';
-import { formatDate } from '@/lib/format-date';
-import { Download, List } from '@lucide/astro';
-
-interface Props {
-  ext: Extension;
-}
-
-const { ext } = Astro.props;
-const releases = sortReleasesDescending(ext.releases);
----
-
-<div>
-  <div class="flex items-center justify-between">
-    <h2 class="text-xl font-semibold">Releases</h2>
-    <span class="badge" data-variant="secondary">
-      {releases.length}
-    </span>
-  </div>
-
-  <div class="table-container mt-6">
-    <table class="table">
-      <caption class="sr-only">Releases for{ext.name}</caption>
-      <thead>
-        <tr>
-          <th class="text-left">Tag</th>
-          <th class="text-left">Release date</th>
-          <th class="text-left">FOSSBilling</th>
-          <th class="text-left">PHP</th>
-          <th class="text-left">Modules</th>
-          <th class="text-left">Links</th>
-        </tr>
-      </thead>
-      <tbody>
-        {releases.map((release) => (
-          <tr id={`release-${release.tag}`}>
-            <td class="font-mono">v{release.tag}</td>
-            <td>
-              <time datetime={release.date}>{formatDate(release.date)}</time>
-            </td>
-            <td>{release.requires.fossbilling}</td>
-            <td>{release.requires.php}</td>
-            <td>
-              {Object.entries(release.requires.modules ?? {})
-                .map(([id, range]) => `${id}: ${range}`)
-                .join(', ') || '—'}
-            </td>
-            <td>
-              <div class="flex items-center space-x-2">
-                <a
-                  href={release.download_url}
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  aria-label="Download the release"
-                  class="text-muted-foreground hover:text-foreground transition-colors"
-                >
-                  <Download class="w-4 h-4" />
-                </a>
-                {release.changelog_url ? (
-                  <a
-                    href={release.changelog_url}
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    aria-label="View the changelog for the release"
-                    class="text-muted-foreground hover:text-foreground transition-colors"
-                  >
-                    <List class="w-4 h-4" />
-                  </a>
-                ) : null}
-              </div>
-            </td>
-          </tr>
-        ))}
-      </tbody>
-    </table>
-  </div>
-</div>
diff --git a/src/components/RequirementsFields.astro b/src/components/RequirementsFields.astro
new file mode 100644
index 00000000..f7029715
--- /dev/null
+++ b/src/components/RequirementsFields.astro
@@ -0,0 +1,44 @@
+---
+import { formatModuleRequirements } from '@/lib/extension-form';
+import type { Requirements } from '@/types';
+interface Props {
+  requires?: Requirements;
+}
+const { requires } = Astro.props;
+---
+
+<label class="grid gap-2 text-sm font-medium">
+  FOSSBilling Requirement
+  <input
+    class="input w-full"
+    name="requires_fossbilling"
+    required
+    maxlength="1000"
+    placeholder="^0.8.9 || ^1.0"
+    value={requires?.fossbilling}
+  />
+</label>
+<label class="grid gap-2 text-sm font-medium">
+  Additional PHP Requirement{' '}
+  <span class="font-normal text-muted-foreground">Optional</span>
+  <input
+    class="input w-full"
+    name="requires_php"
+    maxlength="1000"
+    placeholder="Inherit FOSSBilling Requirements"
+    value={requires?.php}
+  />
+  <span class="text-xs font-normal text-muted-foreground">
+    Leave blank to use FOSSBilling’s PHP requirements.
+  </span>
+</label>
+<label class="grid gap-2 text-sm font-medium">
+  Module Dependencies{' '}
+  <span class="font-normal text-muted-foreground">Optional</span>
+  <textarea
+    class="textarea w-full font-mono text-sm"
+    name="requires_modules"
+    rows="3"
+    placeholder="branding: ^1.2"
+  >{formatModuleRequirements(requires?.modules)}</textarea>
+</label>
diff --git a/src/components/icons/GitHubMark.astro b/src/components/icons/GitHubMark.astro
new file mode 100644
index 00000000..44aa4e99
--- /dev/null
+++ b/src/components/icons/GitHubMark.astro
@@ -0,0 +1,34 @@
+<svg
+  class={Astro.props.class}
+  xmlns="http://www.w3.org/2000/svg"
+  width="16"
+  height="16"
+  viewBox="0 0 16 16"
+  fill="currentColor"
+>
+  <path d="M6.766 11.328c-2.063-.25-3.516-1.734-3.516-3.656 0-.781.281-1.625.75-2.188-.203-.515-.172-1.609.063-2.062.625-.078 1.468.25 1.968.703.594-.187 1.219-.281 1.985-.281.765 0 1.39.094 1.953.265.484-.437 1.344-.765 1.969-.687.218.422.25 1.515.046 2.047.5.593.766 1.39.766 2.203 0 1.922-1.453 3.375-3.547 3.64.531.344.89 1.094.89 1.954v1.625c0 .468.391.734.86.547C13.781 14.359 16 11.53 16 8.03 16 3.61 12.406 0 7.984 0 3.563 0 0 3.61 0 8.031a7.88 7.88 0 0 0 5.172 7.422c.422.156.828-.125.828-.547v-1.25c-.219.094-.5.156-.75.156-1.031 0-1.64-.562-2.078-1.609-.172-.422-.36-.672-.719-.719-.187-.015-.25-.093-.25-.187 0-.188.313-.328.625-.328.453 0 .844.281 1.25.86.313.452.64.655 1.031.655s.641-.14 1-.5c.266-.265.47-.5.657-.656" />
+  <!-- GitHub mark from https://github.com/primer/octicons
+MIT License
+
+Copyright (c) 2026 GitHub Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+-->
+</svg>
diff --git a/src/layouts/Base.astro b/src/layouts/Base.astro
index 4dbd3736..cc21fccb 100644
--- a/src/layouts/Base.astro
+++ b/src/layouts/Base.astro
@@ -128,7 +128,7 @@ const shareImageUrl = image ? new URL(image, Astro.site).href : undefined;
             <LogoLight class="h-8 w-auto dark:hidden" />
             <LogoDark class="h-8 w-auto hidden dark:block" />
           </a>
-          <span class="ml-3 pl-3 border-s dark:border-white/20 text-sm font-semibold uppercase tracking-wider">
+          <span class="hidden sm:inline ml-3 pl-3 border-s dark:border-white/20 text-sm font-semibold uppercase tracking-wider">
             Extensions
           </span>
           <span class="ml-2 badge" data-variant="secondary">
diff --git a/src/lib/api/client.ts b/src/lib/api/client.ts
index 07fa4d19..9ded9687 100644
--- a/src/lib/api/client.ts
+++ b/src/lib/api/client.ts
@@ -30,6 +30,7 @@ import {
   deleteUsersMe,
   putDevelopersMe,
   putExtensionsById,
+  putExtensionsByIdRevisionsByRevisionId,
   type Developer,
   type DeveloperApproval,
   type DeveloperHistoryEntry,
@@ -559,6 +560,19 @@ export function createApiClient(env: ApplicationEnv, subject: string) {
     updateExtension: (id: string, payload: ExtensionUpdate) =>
       callResult(putExtensionsById({ client, path: { id }, body: payload })),
 
+    replacePendingRevision: (
+      id: string,
+      revisionId: string,
+      payload: ExtensionUpdate,
+    ) =>
+      callResult(
+        putExtensionsByIdRevisionsByRevisionId({
+          client,
+          path: { id, revisionId },
+          body: payload,
+        }),
+      ),
+
     withdrawExtension: (id: string) =>
       callResult(deleteExtensionsById({ client, path: { id } })),
 
diff --git a/src/lib/api/generated/extensions-v2/index.ts b/src/lib/api/generated/extensions-v2/index.ts
index d1265da2..d8979005 100644
--- a/src/lib/api/generated/extensions-v2/index.ts
+++ b/src/lib/api/generated/extensions-v2/index.ts
@@ -37,6 +37,7 @@ export {
   postExtensionsByIdRevisionsByRevisionIdReject,
   putDevelopersMe,
   putExtensionsById,
+  putExtensionsByIdRevisionsByRevisionId,
   putM2mClientsByClientId,
   putUsersMeIdentity,
 } from './sdk.gen';
@@ -248,6 +249,11 @@ export type {
   PutExtensionsByIdErrors,
   PutExtensionsByIdResponse,
   PutExtensionsByIdResponses,
+  PutExtensionsByIdRevisionsByRevisionIdData,
+  PutExtensionsByIdRevisionsByRevisionIdError,
+  PutExtensionsByIdRevisionsByRevisionIdErrors,
+  PutExtensionsByIdRevisionsByRevisionIdResponse,
+  PutExtensionsByIdRevisionsByRevisionIdResponses,
   PutM2mClientsByClientIdData,
   PutM2mClientsByClientIdError,
   PutM2mClientsByClientIdErrors,
diff --git a/src/lib/api/generated/extensions-v2/sdk.gen.ts b/src/lib/api/generated/extensions-v2/sdk.gen.ts
index 2dd2862e..17b6e793 100644
--- a/src/lib/api/generated/extensions-v2/sdk.gen.ts
+++ b/src/lib/api/generated/extensions-v2/sdk.gen.ts
@@ -114,6 +114,9 @@ import type {
   PutExtensionsByIdData,
   PutExtensionsByIdErrors,
   PutExtensionsByIdResponses,
+  PutExtensionsByIdRevisionsByRevisionIdData,
+  PutExtensionsByIdRevisionsByRevisionIdErrors,
+  PutExtensionsByIdRevisionsByRevisionIdResponses,
   PutM2mClientsByClientIdData,
   PutM2mClientsByClientIdErrors,
   PutM2mClientsByClientIdResponses,
@@ -241,47 +244,75 @@ export const putExtensionsById = <ThrowOnError extends boolean = false>(
   });
 
 /**
- * List an extension's revisions, newest first
+ * Read one revision; compacted content is null
  */
-export const getExtensionsByIdRevisions = <
+export const getExtensionsByIdRevisionsByRevisionId = <
   ThrowOnError extends boolean = false,
 >(
-  options: Options<GetExtensionsByIdRevisionsData, ThrowOnError>,
+  options: Options<GetExtensionsByIdRevisionsByRevisionIdData, ThrowOnError>,
 ): RequestResult<
-  GetExtensionsByIdRevisionsResponses,
-  GetExtensionsByIdRevisionsErrors,
+  GetExtensionsByIdRevisionsByRevisionIdResponses,
+  GetExtensionsByIdRevisionsByRevisionIdErrors,
   ThrowOnError
 > =>
   (options.client ?? client).get<
-    GetExtensionsByIdRevisionsResponses,
-    GetExtensionsByIdRevisionsErrors,
+    GetExtensionsByIdRevisionsByRevisionIdResponses,
+    GetExtensionsByIdRevisionsByRevisionIdErrors,
     ThrowOnError
   >({
     security: [{ scheme: 'bearer', type: 'http' }],
-    url: '/extensions/{id}/revisions',
+    url: '/extensions/{id}/revisions/{revisionId}',
     ...options,
   });
 
 /**
- * Read one revision; compacted content is null
+ * Replace a pending submission for an extension the caller owns
+ *
+ * The active owner can replace publisher-created submissions. The replacement records the owner as submitter.
  */
-export const getExtensionsByIdRevisionsByRevisionId = <
+export const putExtensionsByIdRevisionsByRevisionId = <
   ThrowOnError extends boolean = false,
 >(
-  options: Options<GetExtensionsByIdRevisionsByRevisionIdData, ThrowOnError>,
+  options: Options<PutExtensionsByIdRevisionsByRevisionIdData, ThrowOnError>,
 ): RequestResult<
-  GetExtensionsByIdRevisionsByRevisionIdResponses,
-  GetExtensionsByIdRevisionsByRevisionIdErrors,
+  PutExtensionsByIdRevisionsByRevisionIdResponses,
+  PutExtensionsByIdRevisionsByRevisionIdErrors,
   ThrowOnError
 > =>
-  (options.client ?? client).get<
-    GetExtensionsByIdRevisionsByRevisionIdResponses,
-    GetExtensionsByIdRevisionsByRevisionIdErrors,
+  (options.client ?? client).put<
+    PutExtensionsByIdRevisionsByRevisionIdResponses,
+    PutExtensionsByIdRevisionsByRevisionIdErrors,
     ThrowOnError
   >({
     security: [{ scheme: 'bearer', type: 'http' }],
     url: '/extensions/{id}/revisions/{revisionId}',
     ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+
+/**
+ * List an extension's revisions, newest first
+ */
+export const getExtensionsByIdRevisions = <
+  ThrowOnError extends boolean = false,
+>(
+  options: Options<GetExtensionsByIdRevisionsData, ThrowOnError>,
+): RequestResult<
+  GetExtensionsByIdRevisionsResponses,
+  GetExtensionsByIdRevisionsErrors,
+  ThrowOnError
+> =>
+  (options.client ?? client).get<
+    GetExtensionsByIdRevisionsResponses,
+    GetExtensionsByIdRevisionsErrors,
+    ThrowOnError
+  >({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/extensions/{id}/revisions',
+    ...options,
   });
 
 /**
diff --git a/src/lib/api/generated/extensions-v2/types.gen.ts b/src/lib/api/generated/extensions-v2/types.gen.ts
index cdabaefb..74f9f817 100644
--- a/src/lib/api/generated/extensions-v2/types.gen.ts
+++ b/src/lib/api/generated/extensions-v2/types.gen.ts
@@ -139,16 +139,21 @@ export type ExtensionDetailResponse = {
 export type Extension = ExtensionContent & {
   name?: string;
   description?: string;
+  homepage_url?: string;
   license?: string;
   icon_url?: string;
   version?: string;
+  download_url?: string;
   id: string;
   developer: PublicDeveloper;
 };
 
 export type ManifestRequirements = {
   fossbilling: string;
-  php: string;
+  /**
+   * Additional PHP constraint; when omitted, FOSSBilling runtime requirements apply
+   */
+  php?: string;
   modules?: {
     [key: string]: string;
   };
@@ -202,9 +207,11 @@ export type OwnedExtension = OwnedExtensionListItem & {
           min_fossbilling_version?: string;
         }
       >;
+      homepage_url?: string;
       license?: string;
       icon_url?: string;
       version?: string;
+      download_url?: string;
     } | null);
   pending_revision?: PendingRevisionRef &
     ({
@@ -572,7 +579,7 @@ export type GetExtensionsError = GetExtensionsErrors[keyof GetExtensionsErrors];
 
 export type GetExtensionsResponses = {
   /**
-   * Extensions matching the scope: extension cards for scope=public, owned rows for scope=mine/all
+   * Extensions matching the scope: extension cards for scope=public, owned rows for scope=mine, moderation rows for scope=all
    */
   200: UnifiedExtensionListResponse;
 };
@@ -803,19 +810,17 @@ export type PutExtensionsByIdResponses = {
 export type PutExtensionsByIdResponse =
   PutExtensionsByIdResponses[keyof PutExtensionsByIdResponses];
 
-export type GetExtensionsByIdRevisionsData = {
+export type GetExtensionsByIdRevisionsByRevisionIdData = {
   body?: never;
   path: {
     id: string;
+    revisionId: string;
   };
-  query?: {
-    limit?: number;
-    cursor?: string;
-  };
-  url: '/extensions/{id}/revisions';
+  query?: never;
+  url: '/extensions/{id}/revisions/{revisionId}';
 };
 
-export type GetExtensionsByIdRevisionsErrors = {
+export type GetExtensionsByIdRevisionsByRevisionIdErrors = {
   /**
    * Missing or invalid bearer token
    */
@@ -825,11 +830,15 @@ export type GetExtensionsByIdRevisionsErrors = {
    */
   403: Error;
   /**
-   * No extension with that id
+   * No extension or revision with that id
    */
   404: Error;
   /**
-   * Pagination query failed validation
+   * Oversized legacy content requires administrative export or resubmission
+   */
+  409: Error;
+  /**
+   * Path failed validation
    */
   422: Error;
   /**
@@ -838,24 +847,23 @@ export type GetExtensionsByIdRevisionsErrors = {
   500: Error;
 };
 
-export type GetExtensionsByIdRevisionsError =
-  GetExtensionsByIdRevisionsErrors[keyof GetExtensionsByIdRevisionsErrors];
+export type GetExtensionsByIdRevisionsByRevisionIdError =
+  GetExtensionsByIdRevisionsByRevisionIdErrors[keyof GetExtensionsByIdRevisionsByRevisionIdErrors];
 
-export type GetExtensionsByIdRevisionsResponses = {
+export type GetExtensionsByIdRevisionsByRevisionIdResponses = {
   /**
-   * Every version proposed for this extension, with its review outcome
+   * One revision with its review outcome; content is null when compacted
    */
   200: {
-    result: Array<ExtensionRevisionSummary>;
-    pagination: Pagination;
+    result: ExtensionRevision;
   };
 };
 
-export type GetExtensionsByIdRevisionsResponse =
-  GetExtensionsByIdRevisionsResponses[keyof GetExtensionsByIdRevisionsResponses];
+export type GetExtensionsByIdRevisionsByRevisionIdResponse =
+  GetExtensionsByIdRevisionsByRevisionIdResponses[keyof GetExtensionsByIdRevisionsByRevisionIdResponses];
 
-export type GetExtensionsByIdRevisionsByRevisionIdData = {
-  body?: never;
+export type PutExtensionsByIdRevisionsByRevisionIdData = {
+  body?: ExtensionUpdate;
   path: {
     id: string;
     revisionId: string;
@@ -864,47 +872,114 @@ export type GetExtensionsByIdRevisionsByRevisionIdData = {
   url: '/extensions/{id}/revisions/{revisionId}';
 };
 
-export type GetExtensionsByIdRevisionsByRevisionIdErrors = {
+export type PutExtensionsByIdRevisionsByRevisionIdErrors = {
   /**
    * Missing or invalid bearer token
    */
   401: Error;
   /**
-   * The account is inactive, or the caller neither owns this extension nor moderates
+   * The account is inactive, or the caller does not own this extension
    */
   403: Error;
   /**
-   * No extension or revision with that id
+   * No extension with that id
    */
   404: Error;
   /**
-   * Oversized legacy content requires administrative export or resubmission
+   * The pending revision changed, was reviewed, ownership changed, or the pending-revision limit was reached
    */
   409: Error;
   /**
-   * Path failed validation
+   * Raw request exceeds 512 KiB
+   */
+  413: Error;
+  /**
+   * Body failed validation
    */
   422: Error;
+  /**
+   * Extension write allowance exhausted; see Retry-After
+   */
+  429: Error;
   /**
    * Database error
    */
   500: Error;
+  /**
+   * Write admission unavailable
+   */
+  503: Error;
 };
 
-export type GetExtensionsByIdRevisionsByRevisionIdError =
-  GetExtensionsByIdRevisionsByRevisionIdErrors[keyof GetExtensionsByIdRevisionsByRevisionIdErrors];
+export type PutExtensionsByIdRevisionsByRevisionIdError =
+  PutExtensionsByIdRevisionsByRevisionIdErrors[keyof PutExtensionsByIdRevisionsByRevisionIdErrors];
 
-export type GetExtensionsByIdRevisionsByRevisionIdResponses = {
+export type PutExtensionsByIdRevisionsByRevisionIdResponses = {
   /**
-   * One revision with its review outcome; content is null when compacted
+   * Replaced with a new pending revision ID. Published content and reviewed history are unchanged.
+   */
+  202: {
+    result: {
+      id: string;
+      revision_id: string;
+      status: 'pending';
+    };
+  };
+};
+
+export type PutExtensionsByIdRevisionsByRevisionIdResponse =
+  PutExtensionsByIdRevisionsByRevisionIdResponses[keyof PutExtensionsByIdRevisionsByRevisionIdResponses];
+
+export type GetExtensionsByIdRevisionsData = {
+  body?: never;
+  path: {
+    id: string;
+  };
+  query?: {
+    limit?: number;
+    cursor?: string;
+  };
+  url: '/extensions/{id}/revisions';
+};
+
+export type GetExtensionsByIdRevisionsErrors = {
+  /**
+   * Missing or invalid bearer token
+   */
+  401: Error;
+  /**
+   * The account is inactive, or the caller neither owns this extension nor moderates
+   */
+  403: Error;
+  /**
+   * No extension with that id
+   */
+  404: Error;
+  /**
+   * Pagination query failed validation
+   */
+  422: Error;
+  /**
+   * Database error
+   */
+  500: Error;
+};
+
+export type GetExtensionsByIdRevisionsError =
+  GetExtensionsByIdRevisionsErrors[keyof GetExtensionsByIdRevisionsErrors];
+
+export type GetExtensionsByIdRevisionsResponses = {
+  /**
+   * Every version proposed for this extension, with its review outcome
    */
   200: {
-    result: ExtensionRevision;
+    result: Array<ExtensionRevisionSummary>;
+    pagination: Pagination;
   };
 };
 
-export type GetExtensionsByIdRevisionsByRevisionIdResponse =
-  GetExtensionsByIdRevisionsByRevisionIdResponses[keyof GetExtensionsByIdRevisionsByRevisionIdResponses];
+export type GetExtensionsByIdRevisionsResponse =
+  GetExtensionsByIdRevisionsResponses[keyof GetExtensionsByIdRevisionsResponses];
 
 export type PutUsersMeIdentityData = {
   body?: UserIdentityInput;
diff --git a/src/lib/extension-draft.ts b/src/lib/extension-draft.ts
new file mode 100644
index 00000000..ff82ae15
--- /dev/null
+++ b/src/lib/extension-draft.ts
@@ -0,0 +1,311 @@
+import type { ExtensionUpdate } from '@/lib/api/client';
+import { isExtensionType, isSourceType, type Release } from '@/types';
+import {
+  buildLicense,
+  buildRequirements,
+  ExtensionValidationError,
+} from './extension-form';
+import { isPackageIconPath } from './package-icon';
+import { latestRelease } from './releases';
+import { repositoryFromFields } from './repository';
+import { withHttpsScheme } from './url-prefix';
+
+export type DraftSection = 'listing' | 'readme';
+export interface ExtensionDraft {
+  baselineHash: string;
+  pendingRevisionId?: string;
+  sections: Partial<Record<DraftSection, Record<string, string>>>;
+  releases?: Release[];
+}
+
+// Escape the HTML script boundary without changing values after JSON.parse.
+export function serializeDraftConfig(value: object): string {
+  return JSON.stringify(value).replace(/</g, '\\u003c');
+}
+
+function record(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+
+// Historical submissions can be incomplete. Only offer the editor when a
+// complete baseline exists; never fill missing published fields with blanks.
+export function editableContent(value: unknown): ExtensionUpdate | null {
+  if (
+    !record(value) ||
+    !isExtensionType(typeof value.type === 'string' ? value.type : null)
+  )
+    return null;
+  const strings = [
+    'name',
+    'description',
+    'readme',
+    'version',
+    'download_url',
+  ] as const;
+  if (
+    strings.some((key) => typeof value[key] !== 'string') ||
+    !Array.isArray(value.releases) ||
+    value.manifest_version !== 1 ||
+    typeof value.license !== 'string' ||
+    !record(value.author) ||
+    typeof value.author.name !== 'string' ||
+    !record(value.requires) ||
+    typeof value.requires.fossbilling !== 'string' ||
+    (value.requires.php !== undefined &&
+      typeof value.requires.php !== 'string') ||
+    value.releases.some(
+      (release) =>
+        !record(release) ||
+        !record(release.requires) ||
+        typeof release.requires.fossbilling !== 'string' ||
+        (release.requires.php !== undefined &&
+          typeof release.requires.php !== 'string'),
+    ) ||
+    !record(value.source) ||
+    !isSourceType(String(value.source.type)) ||
+    typeof value.source.repo !== 'string'
+  )
+    return null;
+  const content = value as unknown as ExtensionUpdate;
+  return {
+    manifest_version: 1,
+    author: content.author,
+    requires: content.requires,
+    type: content.type,
+    name: content.name,
+    description: content.description,
+    homepage_url: content.homepage_url,
+    icon_url: content.icon_url,
+    readme: content.readme,
+    license: content.license,
+    source: content.source,
+    releases: content.releases,
+    version: content.version,
+    download_url: content.download_url,
+  };
+}
+
+// Compacted or pre-v2 rejected submissions can lack required fields. Owners
+// can rebuild these sections in a draft rather than losing the extension ID.
+export function reconstructionContent(value: unknown): ExtensionUpdate {
+  const fields = record(value) ? value : {};
+  const string = (key: string) =>
+    typeof fields[key] === 'string' ? fields[key] : '';
+  const type = string('type');
+  return {
+    manifest_version: 1,
+    author:
+      record(fields.author) && typeof fields.author.name === 'string'
+        ? (fields.author as ExtensionUpdate['author'])
+        : { name: '' },
+    requires: record(fields.requires)
+      ? (fields.requires as ExtensionUpdate['requires'])
+      : { fossbilling: '', php: '' },
+    type: isExtensionType(type) ? type : 'module',
+    name: string('name'),
+    description: string('description'),
+    homepage_url: string('homepage_url') || string('website') || undefined,
+    icon_url: string('icon_url') || undefined,
+    readme: string('readme'),
+    source:
+      record(fields.source) &&
+      isSourceType(String(fields.source.type)) &&
+      typeof fields.source.repo === 'string'
+        ? (fields.source as ExtensionUpdate['source'])
+        : { type: 'github', repo: '' },
+    license:
+      typeof fields.license === 'string'
+        ? fields.license
+        : record(fields.license)
+          ? String(fields.license.spdx_id ?? fields.license.name ?? '')
+          : '',
+    releases: Array.isArray(fields.releases)
+      ? fields.releases.map((value) => {
+          const release = record(value) ? value : {};
+          return {
+            tag: String(release.tag ?? ''),
+            date: String(release.date ?? ''),
+            download_url: String(release.download_url ?? ''),
+            changelog_url:
+              typeof release.changelog_url === 'string'
+                ? release.changelog_url
+                : undefined,
+            requires: record(release.requires)
+              ? (release.requires as ExtensionUpdate['requires'])
+              : { fossbilling: '', php: '' },
+          };
+        })
+      : [],
+    version: string('version'),
+    download_url: string('download_url'),
+  };
+}
+
+function toFormData(fields: Record<string, unknown>): FormData {
+  const form = new FormData();
+  for (const [key, value] of Object.entries(fields))
+    if (typeof value === 'string') form.set(key, value);
+  return form;
+}
+function text(fields: Record<string, unknown>, key: string): string {
+  return typeof fields[key] === 'string' ? fields[key].trim() : '';
+}
+function required(
+  fields: Record<string, unknown>,
+  key: string,
+  label: string,
+): string {
+  const value = text(fields, key);
+  if (!value) throw new ExtensionValidationError(`${label} is required.`);
+  return value;
+}
+function url(
+  fields: Record<string, unknown>,
+  key: string,
+  label: string,
+  optional = false,
+): string | undefined {
+  const raw = text(fields, key);
+  if (!raw && optional) return undefined;
+  const value = withHttpsScheme(raw);
+  try {
+    if (value && new URL(value).hostname) return value;
+  } catch {
+    /* Report the field below. */
+  }
+  throw new ExtensionValidationError(`Enter a valid ${label}.`);
+}
+
+export function releaseFromFields(fields: Record<string, unknown>): Release {
+  const date = required(fields, 'release_date', 'Release date');
+  if (
+    !/^\d{4}-\d{2}-\d{2}$/.test(date) ||
+    Number.isNaN(Date.parse(date)) ||
+    new Date(date).toISOString().slice(0, 10) !== date
+  )
+    throw new ExtensionValidationError('Enter a valid release date.');
+  return {
+    tag: required(fields, 'version_tag', 'Version tag'),
+    date,
+    download_url: url(fields, 'download_url', 'download URL')!,
+    changelog_url: url(fields, 'changelog_url', 'changelog URL', true),
+    requires: buildRequirements(toFormData(fields)),
+  };
+}
+
+function applySourceAndLicense(
+  result: ExtensionUpdate,
+  raw: Record<string, unknown>,
+): void {
+  const source = repositoryFromFields(raw);
+  if (!source)
+    throw new ExtensionValidationError(
+      'Enter a valid Source URL. Repository paths and custom URLs must be at most 500 characters.',
+    );
+  result.source = source;
+  result.license = buildLicense(toFormData(raw));
+}
+
+// Merge only editable section fields into the latest server-owned baseline.
+// The browser cannot overwrite ownership, identity, or unrelated sections.
+export function applyExtensionDraft(
+  base: ExtensionUpdate,
+  value: unknown,
+): ExtensionUpdate {
+  if (!record(value) || !record(value.sections))
+    throw new ExtensionValidationError('This draft could not be read.');
+  const result = structuredClone(base);
+  for (const [section, raw] of Object.entries(value.sections)) {
+    if (!record(raw))
+      throw new ExtensionValidationError(
+        'This draft contains an invalid section.',
+      );
+    if (section === 'listing') {
+      const type = text(raw, 'type');
+      if (!isExtensionType(type))
+        throw new ExtensionValidationError('Choose a valid extension type.');
+      result.name = required(raw, 'name', 'Name');
+      result.description = required(raw, 'description', 'Description');
+      result.type = type;
+      result.homepage_url = url(raw, 'homepage_url', 'homepage URL', true);
+      const icon = text(raw, 'icon_url');
+      if (icon && !isPackageIconPath(icon))
+        throw new ExtensionValidationError(
+          'Enter an icon path relative to the package root.',
+        );
+      result.icon_url = icon || undefined;
+      result.author = {
+        name: required(raw, 'author_name', 'Author name'),
+        url: url(raw, 'author_url', 'author URL', true),
+      };
+      if (
+        [
+          'source_url',
+          'license_spdx_id',
+          'license_name_custom',
+          'license_url',
+        ].some((key) => key in raw)
+      )
+        applySourceAndLicense(result, raw);
+    } else if (section === 'readme') {
+      result.readme = required(raw, 'readme', 'README');
+    } else
+      throw new ExtensionValidationError(
+        'This draft contains an unknown section.',
+      );
+  }
+  if (value.releases !== undefined) {
+    if (
+      !Array.isArray(value.releases) ||
+      value.releases.length < 1 ||
+      value.releases.length > 100
+    )
+      throw new ExtensionValidationError('Keep between 1 and 100 releases.');
+    const tags = new Set<string>();
+    result.releases = value.releases.map((raw) => {
+      if (!record(raw))
+        throw new ExtensionValidationError(
+          'This draft contains an invalid release.',
+        );
+      // Preserve untouched historical releases, including timestamp dates and
+      // HTTP URLs; only changed release fields need input normalization.
+      const original = base.releases.find((release) => release.tag === raw.tag);
+      const release =
+        original && JSON.stringify(original) === JSON.stringify(raw)
+          ? structuredClone(original)
+          : releaseFromFields({
+              version_tag: raw.tag,
+              release_date: raw.date,
+              download_url: raw.download_url,
+              changelog_url: raw.changelog_url,
+              requires_fossbilling: record(raw.requires)
+                ? raw.requires.fossbilling
+                : undefined,
+              requires_php: record(raw.requires) ? raw.requires.php : undefined,
+              requires_modules:
+                record(raw.requires) && record(raw.requires.modules)
+                  ? Object.entries(raw.requires.modules)
+                      .map(([id, constraint]) => `${id}: ${constraint}`)
+                      .join('\n')
+                  : '',
+            });
+      if (tags.has(release.tag.replace(/^v/, '')))
+        throw new ExtensionValidationError(
+          `A release tagged "${release.tag}" already exists.`,
+        );
+      tags.add(release.tag.replace(/^v/, ''));
+      return release;
+    });
+  }
+  // Keep the primary download aligned with the latest release.
+  if (Object.keys(value.sections).length || value.releases !== undefined) {
+    const latest = latestRelease(result.releases);
+    if (latest) {
+      // Keep the manifest aligned with its latest release.
+      result.requires = structuredClone(latest.requires);
+      result.version = latest.tag.replace(/^v(?=\d)/, '');
+      result.download_url = latest.download_url;
+    }
+  }
+  return result;
+}
diff --git a/src/lib/extension-form.ts b/src/lib/extension-form.ts
index 9fe00cfd..7bd472ad 100644
--- a/src/lib/extension-form.ts
+++ b/src/lib/extension-form.ts
@@ -1,7 +1,9 @@
 import { isPackageIconPath } from './package-icon';
-import { isExtensionType, isSourceType, SPDX_LICENSE_IDS } from '@/types';
+import { isExtensionType, SPDX_LICENSE_IDS } from '@/types';
 import type { Extension, Release } from '@/types';
 import type { ExtensionCreate, ExtensionUpdate } from '@/lib/api/client';
+import { latestRelease } from './releases';
+import { repositoryFromFields, repositoryInputUrl } from './repository';
 import { formString } from './form';
 import { withHttpsScheme } from './url-prefix';
 
@@ -15,7 +17,7 @@ export class ExtensionValidationError extends Error {}
 // The combobox offers SPDX identifiers; Other also accepts compound expressions.
 export const OTHER_LICENSE = 'other';
 
-function buildLicense(form: FormData): string {
+export function buildLicense(form: FormData): string {
   const selected = formString(form, 'license_spdx_id');
   const license =
     selected === OTHER_LICENSE
@@ -54,16 +56,24 @@ function moduleRequirements(input: string): Record<string, string> | undefined {
   return modules;
 }
 
-function buildRequirements(form: FormData) {
+export function formatModuleRequirements(
+  modules?: Record<string, string>,
+): string {
+  return Object.entries(modules ?? {})
+    .map(([id, constraint]) => `${id}: ${constraint}`)
+    .join('\n');
+}
+
+export function buildRequirements(form: FormData) {
   const fossbilling = formString(form, 'requires_fossbilling');
   const php = formString(form, 'requires_php');
-  if (!fossbilling || !php || fossbilling.length > 1000 || php.length > 1000)
+  if (!fossbilling || fossbilling.length > 1000 || php.length > 1000)
     throw new ExtensionValidationError(
-      'Enter the FOSSBilling and PHP version requirements.',
+      'Enter a FOSSBilling requirement and, optionally, an additional PHP constraint (up to 1,000 characters each).',
     );
   return {
     fossbilling,
-    php,
+    ...(php ? { php } : {}),
     modules: moduleRequirements(formString(form, 'requires_modules')),
   };
 }
@@ -97,7 +107,11 @@ function buildContent(
     // collision — since it replaces the whole array verbatim on approval, a
     // collision would silently duplicate the entry. Catch both here instead
     // of only one of them surfacing as a 422 from the api.
-    if (releases.some((r) => r.tag === newReleaseTag)) {
+    if (
+      releases.some(
+        (r) => r.tag.replace(/^v/, '') === newReleaseTag.replace(/^v/, ''),
+      )
+    ) {
       throw new ExtensionValidationError(
         `A release tagged "${newReleaseTag}" already exists — use a different version tag.`,
       );
@@ -128,12 +142,21 @@ function buildContent(
     downloadUrl = release.download_url;
   }
 
+  const latest = latestRelease(releases);
+  if (latest) {
+    version = latest.tag.replace(/^v(?=\d)/, '');
+    downloadUrl = latest.download_url;
+  }
+
   const typeInput = str('type');
-  const sourceTypeInput = str('source_type');
-  if (!isExtensionType(typeInput) || !isSourceType(sourceTypeInput)) {
+  const sourceFields = Object.fromEntries(form);
+  const source = repositoryFromFields(sourceFields);
+  if (!source)
     throw new ExtensionValidationError(
-      'Choose a valid extension type and repository host.',
+      'Enter a valid Source URL. Repository paths and custom URLs must be at most 500 characters.',
     );
+  if (!isExtensionType(typeInput)) {
+    throw new ExtensionValidationError('Choose a valid extension type.');
   }
 
   const icon = str('icon_url');
@@ -158,10 +181,7 @@ function buildContent(
     license: buildLicense(form),
     icon_url: icon || undefined,
     readme: str('readme'),
-    source: {
-      type: sourceTypeInput,
-      repo: str('source_repo'),
-    },
+    source,
     version,
     download_url: downloadUrl,
   };
@@ -231,9 +251,9 @@ export function echoExtensionFromForm(
     license: isRecognizedLicense
       ? selectedLicenseId
       : formString(form, 'license_name_custom'),
-    source: {
-      type: formString(form, 'source_type') as Extension['source']['type'],
-      repo: formString(form, 'source_repo'),
+    source: repositoryFromFields(Object.fromEntries(form)) ?? {
+      type: 'custom',
+      repo: repositoryInputUrl(Object.fromEntries(form)),
     },
   };
 }
diff --git a/src/lib/extension-view.ts b/src/lib/extension-view.ts
new file mode 100644
index 00000000..759314a1
--- /dev/null
+++ b/src/lib/extension-view.ts
@@ -0,0 +1,43 @@
+import {
+  ApiRequestError,
+  createApiClient,
+  getExtensionById,
+  type OwnedExtension,
+} from './api/client';
+import type { Extension } from '@/types';
+import type { ApplicationEnv } from './runtime';
+import type { SessionUser } from './session';
+
+export type ExtensionView =
+  | { kind: 'owner'; owned: OwnedExtension; userId: string }
+  | { kind: 'public'; extension: Extension };
+
+// The detail API also gives moderators an owned-shaped record. That shape
+// alone does not grant editing: match the extension's developer against the
+// caller's active, API-verified own profile. Cookie role flags are navigation
+// hints, never an editing permission. Mutation endpoints recheck ownership.
+export async function loadExtensionView(
+  env: ApplicationEnv,
+  id: string,
+  user: SessionUser | null,
+): Promise<ExtensionView> {
+  if (user) {
+    const api = createApiClient(env, user.sub);
+    try {
+      const developer = await api.getOwnDeveloper();
+      if (developer) {
+        const owned = await api.getMyExtension(id);
+        if (owned.developer.id === developer.id)
+          return { kind: 'owner', owned, userId: user.sub };
+      }
+    } catch (error) {
+      // Missing/inactive profiles and unrelated extensions get the public
+      // projection. Outages remain retryable errors, not lost permissions.
+      if (!(
+        error instanceof ApiRequestError && [403, 404].includes(error.status)
+      ))
+        throw error;
+    }
+  }
+  return { kind: 'public', extension: await getExtensionById(env, id) };
+}
diff --git a/src/lib/license.ts b/src/lib/license.ts
new file mode 100644
index 00000000..11481f41
--- /dev/null
+++ b/src/lib/license.ts
@@ -0,0 +1,15 @@
+import { SPDX_LICENSE_IDS } from '@/types';
+import { isSafeHttpUrl } from './safe-url';
+import type { StoredExtensionFields } from './extensions-data';
+
+export function licenseUrl(
+  license: StoredExtensionFields['license'],
+): string | undefined {
+  if (!license) return undefined;
+  if (typeof license !== 'string' && isSafeHttpUrl(license.URL))
+    return license.URL;
+  const id = typeof license === 'string' ? license : license.spdx_id;
+  return id && SPDX_LICENSE_IDS.includes(id)
+    ? `https://spdx.org/licenses/${id}.html`
+    : undefined;
+}
diff --git a/src/lib/markdown.ts b/src/lib/markdown.ts
index 7de39021..2a8821a3 100644
--- a/src/lib/markdown.ts
+++ b/src/lib/markdown.ts
@@ -2,7 +2,8 @@ import { marked } from 'marked';
 import sanitizeHtml from 'sanitize-html';
 
 // The site's single markdown pipeline, so moderators preview exactly what
-// the public directory renders (see Overview.astro). Readme content is
+// the public extension directory renders (see ExtensionWorkspace.astro).
+// Readme content is
 // untrusted author input rendered in other users' sessions — always sanitize,
 // never inject marked output directly.
 const SANITIZE_OPTIONS: sanitizeHtml.IOptions = {
diff --git a/src/lib/releases.ts b/src/lib/releases.ts
new file mode 100644
index 00000000..0c2b7a6d
--- /dev/null
+++ b/src/lib/releases.ts
@@ -0,0 +1,36 @@
+import valid from 'semver/functions/valid.js';
+import rcompare from 'semver/functions/rcompare.js';
+import type { Release } from '@/types';
+
+function releaseTime(release: Release): number {
+  const time = Date.parse(release.date);
+  return Number.isFinite(time) ? time : Number.NEGATIVE_INFINITY;
+}
+
+function compareReleases(a: Release, b: Release): number {
+  const aVersion = valid(a.tag);
+  const bVersion = valid(b.tag);
+  if (aVersion && bVersion) {
+    const order = rcompare(aVersion, bVersion);
+    if (order) return order;
+  } else if (aVersion || bVersion) {
+    return aVersion ? -1 : 1;
+  }
+  const aTime = releaseTime(a);
+  const bTime = releaseTime(b);
+  return aTime === bTime ? 0 : aTime > bTime ? -1 : 1;
+}
+
+export function latestRelease(
+  releases: readonly Release[],
+): Release | undefined {
+  return releases.reduce<Release | undefined>(
+    (latest, release) =>
+      !latest || compareReleases(release, latest) < 0 ? release : latest,
+    undefined,
+  );
+}
+
+export function releasesDescending(releases: readonly Release[]): Release[] {
+  return [...releases].sort(compareReleases);
+}
diff --git a/src/lib/repository.ts b/src/lib/repository.ts
new file mode 100644
index 00000000..0dd08f06
--- /dev/null
+++ b/src/lib/repository.ts
@@ -0,0 +1,58 @@
+import type { Repository } from '@/types';
+
+// Form inputs use one URL; the API retains its existing typed repository
+// representation. Match real public hostnames rather than lookalike suffixes.
+export function parseRepositoryUrl(value: string): Repository | null {
+  let url: URL;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (
+    !['http:', 'https:'].includes(url.protocol) ||
+    url.username ||
+    url.password
+  )
+    return null;
+  const custom = (): Repository | null =>
+    url.href.length <= 500 ? { type: 'custom', repo: url.href } : null;
+  const host = url.hostname.toLowerCase().replace(/^www\./, '');
+  if (!url.port && (host === 'github.com' || host === 'gitlab.com')) {
+    let parts: string[];
+    try {
+      parts = url.pathname.split('/').filter(Boolean).map(decodeURIComponent);
+    } catch {
+      return null;
+    }
+    if (
+      parts.length < 2 ||
+      (host === 'github.com' && parts.length !== 2) ||
+      parts.includes('-')
+    )
+      return custom();
+    parts[parts.length - 1] = parts[parts.length - 1].replace(/\.git$/i, '');
+    if (
+      parts.some(
+        (part) => !/^[\w.-]+$/.test(part) || part === '.' || part === '..',
+      )
+    )
+      return custom();
+    if (parts.join('/').length > 500) return null;
+    return {
+      type: host === 'github.com' ? 'github' : 'gitlab',
+      repo: parts.join('/'),
+    };
+  }
+  return custom();
+}
+
+export function repositoryInputUrl(fields: Record<string, unknown>): string {
+  return typeof fields.source_url === 'string' ? fields.source_url : '';
+}
+
+export function repositoryFromFields(
+  fields: Record<string, unknown>,
+): Repository | null {
+  return parseRepositoryUrl(repositoryInputUrl(fields));
+}
diff --git a/src/lib/requirements.ts b/src/lib/requirements.ts
new file mode 100644
index 00000000..a599fc0d
--- /dev/null
+++ b/src/lib/requirements.ts
@@ -0,0 +1,6 @@
+// Only humanize a simple lower bound. Composer and compound constraints stay
+// verbatim so presentation cannot change their meaning.
+export function compatibilityLabel(constraint: string): string {
+  const minimum = constraint.trim().match(/^>=\s*(\d+(?:\.\d+){0,2})$/);
+  return minimum ? `${minimum[1]} or Later` : constraint;
+}
diff --git a/src/middleware.ts b/src/middleware.ts
index c427d403..242c568f 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -29,5 +29,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
   context.locals.timeZone = getRequestTimeZone(context.request);
 
   const response = await next();
-  return applySecurityHeaders(response);
+  const secured = applySecurityHeaders(response);
+  // Apply after rewrites too: a cached anonymous 404 must not mask the same
+  // unpublished extension for its owner on their next request.
+  if (context.url.pathname.startsWith('/extension/')) {
+    secured.headers.set('Cache-Control', 'private, no-store');
+    secured.headers.set('Cloudflare-CDN-Cache-Control', 'no-store');
+  }
+  return secured;
 });
diff --git a/src/pages/account/extensions/[id]/edit.astro b/src/pages/account/extensions/[id]/edit.astro
deleted file mode 100644
index 28826853..00000000
--- a/src/pages/account/extensions/[id]/edit.astro
+++ /dev/null
@@ -1,159 +0,0 @@
----
-import Base from '../../../../layouts/Base.astro';
-import ExtensionForm from '@/components/ExtensionForm.astro';
-import ConfirmDeleteDialog from '@/components/ConfirmDeleteDialog.astro';
-import { requireUser } from '@/lib/auth-guard';
-import {
-  createApiClient,
-  ApiRequestError,
-  getApiErrorMessage,
-} from '@/lib/api/client';
-import { getOwnedExtension } from '@/lib/extensions-data';
-import {
-  buildExtensionUpdatePayload,
-  echoExtensionFromForm,
-  echoReleaseDraftFromForm,
-  ExtensionValidationError,
-  type ReleaseDraft,
-} from '@/lib/extension-form';
-import { formatDate } from '@/lib/format-date';
-import { setFlash } from '@/lib/flash';
-import type { Extension } from '@/types';
-
-const env = Astro.locals.env;
-const guard = await requireUser(Astro, env);
-if (guard instanceof Response) return guard;
-const user = guard;
-
-const { id } = Astro.params;
-if (!id) {
-  return Astro.redirect('/404');
-}
-
-// getMyExtension enforces ownership itself (403 for anyone else), so a
-// missing result here already covers both "no such extension" and "not
-// yours" — no separate developer-ownership check is needed.
-const owned = await getOwnedExtension(env, user.sub, id);
-if (!owned) {
-  return Astro.redirect('/404');
-}
-
-// The base to edit: the current published content, or — for an extension
-// that's never been published (rejected and not yet resubmitted) — a blank
-// starting point carrying only the fixed id and developer.
-const base: Extension =
-  owned.published ??
-  ({
-    manifest_version: 1,
-    author: { name: owned.developer.name, url: owned.developer.URL },
-    requires: { fossbilling: '', php: '' },
-    id: owned.id,
-    type: 'module',
-    name: '',
-    description: '',
-    releases: [],
-    homepage_url: '',
-    license: '',
-    readme: '',
-    source: { type: 'github', repo: '' },
-    version: '',
-    download_url: '',
-    developer: owned.developer,
-  } satisfies Extension);
-
-let error: string | null = null;
-// Falls back to the just-submitted values on a rejected edit, so the form
-// doesn't reset to the previous content and discard the edit.
-let submitted: ReturnType<typeof echoExtensionFromForm> | null = null;
-let submittedReleaseDraft: ReleaseDraft | null = null;
-
-// Only one revision may be unreviewed at a time — the api rejects a second
-// edit with 409 while one is pending, so this page doesn't even offer the
-// form in that state (see the pendingRevision branch below).
-if (!owned.pendingRevision && Astro.request.method === 'POST') {
-  const form = await Astro.request.formData();
-  submitted = echoExtensionFromForm(form, base);
-  submittedReleaseDraft = echoReleaseDraftFromForm(form);
-
-  const api = createApiClient(env, user.sub);
-  try {
-    const payload = buildExtensionUpdatePayload(form, owned.published);
-    await api.updateExtension(owned.id, payload);
-    await setFlash(Astro, Astro.locals.env.sessionSecret, {
-      title: 'Submitted for Review.',
-    });
-    return Astro.redirect('/account');
-  } catch (e) {
-    error =
-      e instanceof ApiRequestError
-        ? getApiErrorMessage(e)
-        : e instanceof ExtensionValidationError
-          ? e.message
-          : 'Something went wrong submitting your edit. Please try again.';
-  }
-}
-
-const title = base.name || owned.id;
----
-
-<Base title={`Edit ${title} — FOSSBilling Extensions`}>
-  <div class="max-w-2xl mx-auto space-y-6">
-    <h1 class="text-2xl font-semibold tracking-tight">Edit {title}</h1>
-
-    {owned.pendingRevision ? (
-      <div class="alert">
-        <section>
-          An edit submitted {formatDate(owned.pendingRevision.createdAt)} is
-          still awaiting review. You can submit another edit once a moderator
-          has reviewed this one.
-        </section>
-      </div>
-    ) : (
-      <Fragment>
-        <p class="text-muted-foreground text-sm">
-          Edits are reviewed by a moderator before replacing the published
-          listing.
-        </p>
-        <ExtensionForm
-          developer={owned.developer}
-          extension={base}
-          echo={submitted ?? undefined}
-          releaseDraft={submittedReleaseDraft ?? undefined}
-          error={error}
-        />
-      </Fragment>
-    )}
-
-    {!owned.published && (
-      <div class="card">
-        <header>
-          <h2 class="font-semibold text-destructive">Withdraw Extension</h2>
-        </header>
-        <section class="space-y-3">
-          <p class="text-sm text-muted-foreground">
-            This extension has never been published, so it can still be
-            withdrawn. Permanently deletes it and its revision history, and
-            releases its id. This can't be undone.
-          </p>
-          <button
-            type="button"
-            class="btn"
-            data-size="sm"
-            data-variant="outline"
-            onclick="document.getElementById('withdraw-extension').showModal()"
-          >
-            Withdraw Extension
-          </button>
-          <ConfirmDeleteDialog
-            id="withdraw-extension"
-            title="Withdraw extension"
-            description="Permanently deletes this extension and its revision history, and releases its id for someone else to use. This can't be undone."
-            confirmText={owned.id}
-            formAction={`/account/extensions/${owned.id}/withdraw`}
-            submitLabel="Withdraw Extension"
-          />
-        </section>
-      </div>
-    )}
-  </div>
-</Base>
diff --git a/src/pages/account/extensions/new.astro b/src/pages/account/extensions/new.astro
index aadb1545..07838d7a 100644
--- a/src/pages/account/extensions/new.astro
+++ b/src/pages/account/extensions/new.astro
@@ -40,7 +40,7 @@ if (Astro.request.method === 'POST') {
     await setFlash(Astro, Astro.locals.env.sessionSecret, {
       title: 'Submitted for Review.',
     });
-    return Astro.redirect('/account');
+    return Astro.redirect(`/extension/${payload.id}`);
   } catch (e) {
     error =
       e instanceof ApiRequestError
diff --git a/src/pages/account/index.astro b/src/pages/account/index.astro
index 6da2f93a..a7ec52b4 100644
--- a/src/pages/account/index.astro
+++ b/src/pages/account/index.astro
@@ -365,7 +365,12 @@ const reconnectUrl = buildGithubReconnectUrl(Astro.url.origin, '/account');
               return (
                 <li class="py-3 flex items-center justify-between gap-3">
                   <div>
-                    <p class="font-medium">{ext.published?.name ?? ext.id}</p>
+                    <a
+                      href={`/extension/${ext.id}`}
+                      class="font-medium hover:underline underline-offset-4"
+                    >
+                      {ext.published?.name ?? ext.id}
+                    </a>
                     <p class="text-sm text-muted-foreground">
                       {ext.published ? `v${ext.published.version}` : ext.id}
                     </p>
@@ -380,7 +385,7 @@ const reconnectUrl = buildGithubReconnectUrl(Astro.url.origin, '/account');
                   <div class="flex items-center gap-2">
                     {ext.pending_revision ? (
                       <span class="badge" data-variant="secondary">
-                        Awaiting review
+                        Pending
                       </span>
                     ) : rejectedNeverPublished ? (
                       <span class="badge" data-variant="destructive">
@@ -391,23 +396,13 @@ const reconnectUrl = buildGithubReconnectUrl(Astro.url.origin, '/account');
                         Edit rejected
                       </span>
                     ) : null}
-                    {ext.published && (
-                      <a
-                        href={`/extension/${ext.id}`}
-                        class="btn"
-                        data-size="sm"
-                        data-variant="ghost"
-                      >
-                        View
-                      </a>
-                    )}
                     <a
-                      href={`/account/extensions/${ext.id}/edit`}
+                      href={`/extension/${ext.id}`}
                       class="btn"
                       data-size="sm"
                       data-variant="outline"
                     >
-                      Edit
+                      Manage
                     </a>
                   </div>
                 </li>
diff --git a/src/pages/extension/[id].astro b/src/pages/extension/[id].astro
index df9bd54d..d6006b00 100644
--- a/src/pages/extension/[id].astro
+++ b/src/pages/extension/[id].astro
@@ -1,16 +1,12 @@
 ---
-import { extensionIconUrl } from '@/lib/extension-icon';
 import Base from '@/layouts/Base.astro';
+import OwnerExtensionView from '@/components/OwnerExtensionView.astro';
+import { loadExtensionView, type ExtensionView } from '@/lib/extension-view';
+import { extensionIconUrl } from '@/lib/extension-icon';
+import { getSessionUser } from '@/lib/session';
 import ExtensionHeader from '@/components/ExtensionHeader.astro';
-import DetailsCard from '@/components/DetailsCard.astro';
-import ReleasesCard from '@/components/ReleasesCard.astro';
-import Overview from '@/components/Overview.astro';
-import ReleasesTable from '@/components/ReleasesTable.astro';
-import {
-  ApiRequestError,
-  getApiErrorMessage,
-  getExtensionById,
-} from '@/lib/api/client';
+import ExtensionWorkspace from '@/components/ExtensionWorkspace.astro';
+import { ApiRequestError, getApiErrorMessage } from '@/lib/api/client';
 
 const env = Astro.locals.env;
 const { id } = Astro.params;
@@ -19,141 +15,97 @@ if (!id) {
   return Astro.rewrite('/404');
 }
 
-// Transient upstream failures render a retryable error instead of throwing:
-// a throw would surface as a bare 500 during real navigation.
-let ext;
+Astro.cache.set(false);
+Astro.response.headers.set('Cache-Control', 'private, no-store');
+let view: ExtensionView | undefined;
 let detailError: string | null = null;
 try {
-  ext = await getExtensionById(env, id);
+  const user = await getSessionUser(Astro.cookies, env.sessionSecret);
+  view = await loadExtensionView(env, id, user);
 } catch (error) {
-  if (error instanceof ApiRequestError && error.status === 404) {
+  if (error instanceof ApiRequestError && error.status === 404)
     return Astro.rewrite('/404');
-  }
-  if (
-    error instanceof ApiRequestError &&
-    (error.status === 429 ||
-      error.status >= 500 ||
-      error.code === 'RATE_LIMITED' ||
-      error.code === 'SERVICE_UNAVAILABLE')
-  ) {
-    detailError = getApiErrorMessage(error);
-    Astro.response.status = error.status === 429 ? 429 : 503;
-    // Opt out of the /extension/[id] route rule: cache headers are stamped
-    // after render, so without this the error card stays CDN-cached to maxAge.
-    Astro.cache.set(false);
-    Astro.response.headers.set('Cache-Control', 'no-store');
-  } else {
-    throw error;
-  }
-}
-
-if (!ext && !detailError) {
-  return Astro.rewrite('/404');
+  if (!(error instanceof ApiRequestError))
+    console.error('[extension] Unable to load extension details:', error);
+  detailError =
+    error instanceof ApiRequestError
+      ? getApiErrorMessage(error)
+      : 'Extension details are temporarily unavailable. Please try again.';
+  Astro.response.status =
+    error instanceof ApiRequestError && error.status === 429 ? 429 : 503;
 }
-
-// Truncate on code points — UTF-16 slice() can split a surrogate pair and
-// leave a lone surrogate in the shared metadata.
-const descriptionCodePoints = ext ? [...ext.description] : [];
-const shareDescription = ext
+const ext = view?.kind === 'public' ? view.extension : undefined;
+const metadata =
+  view?.kind === 'owner'
+    ? Astro.url.searchParams.get('version') === 'published'
+      ? (view.owned.published ?? view.owned.pending_revision?.content)
+      : (view.owned.pending_revision?.content ?? view.owned.published)
+    : ext;
+const name = metadata?.name ?? id;
+// Truncate on code points to avoid splitting a Unicode surrogate pair.
+const descriptionCodePoints = [...(metadata?.description ?? '')];
+const shareDescription = metadata
   ? descriptionCodePoints.length > 160
     ? `${descriptionCodePoints.slice(0, 157).join('')}...`
-    : ext.description
+    : metadata.description
   : (detailError ?? 'Extension details are temporarily unavailable.');
-// og:image uses the original icon rather than the 64x64 icon variant:
-// social scrapers want the largest available image for large-card previews.
-// Stored URLs arrive unvalidated from upstream, and Base builds the share
-// URL with `new URL(image, Astro.site)` — which throws on malformed input
-// and would 500 the whole page — so only pass cleanly-parseable URLs.
-const shareImage = ext ? extensionIconUrl(ext) : undefined;
+let shareImage: string | undefined;
+const metadataIcon = metadata
+  ? extensionIconUrl({
+      ...metadata,
+      id,
+      source: metadata.source ?? { type: 'custom', repo: '' },
+    })
+  : undefined;
+if (metadataIcon) {
+  try {
+    shareImage = new URL(metadataIcon).href;
+  } catch {
+    /* Omit malformed stored URLs. */
+  }
+}
+const releasesView = Astro.url.searchParams.get('view') === 'releases';
 ---
 
 <Base
   title={
-    ext
-      ? `${ext.name} | FOSSBilling Extensions`
+    view
+      ? `${name} | FOSSBilling Extensions`
       : 'Temporarily Unavailable | FOSSBilling Extensions'
   }
   description={shareDescription}
   image={shareImage}
 >
-  {detailError || !ext ? (
+  {detailError || !view ? (
     <div
       class="card flex min-h-32 flex-col items-center justify-center px-6 py-12 text-center"
       role="alert"
     >
       <h2 class="font-semibold">Extension Temporarily Unavailable</h2>
       <p class="text-muted-foreground mt-2">{detailError}</p>
-      <a href={Astro.url.pathname} class="btn mt-4">
+      <a href={`${Astro.url.pathname}${Astro.url.search}`} class="btn mt-4">
         Try Again
       </a>
     </div>
   ) : (
-    <>
-      <ExtensionHeader ext={ext} />
-
-      <div class="tabs mt-6" id="extension-tabs">
-        <nav
-          role="tablist"
-          aria-orientation="horizontal"
-          aria-label="Extension tabs"
-        >
-          <button
-            type="button"
-            role="tab"
-            id="overview-tab"
-            aria-selected="true"
-            aria-controls="overview-panel"
-            tabindex="0"
-          >
-            Overview
-          </button>
-          <button
-            type="button"
-            role="tab"
-            id="release-history-tab"
-            aria-selected="false"
-            aria-controls="release-history-panel"
-            tabindex="0"
-          >
-            Release History
-          </button>
-        </nav>
-
-        <div class="grid gap-6 lg:grid-cols-6 mt-6">
-          <div class="lg:col-span-4">
-            <article class="card h-full">
-              <div class="h-full">
-                <div
-                  role="tabpanel"
-                  id="overview-panel"
-                  class="p-6"
-                  aria-labelledby="overview-tab"
-                  tabindex="-1"
-                  aria-selected="true"
-                >
-                  <Overview ext={ext} />
-                </div>
-                <div
-                  role="tabpanel"
-                  id="release-history-panel"
-                  class="p-6"
-                  aria-labelledby="release-history-tab"
-                  tabindex="-1"
-                  aria-selected="false"
-                  hidden
-                >
-                  <ReleasesTable ext={ext} />
-                </div>
-              </div>
-            </article>
-          </div>
-
-          <div class="lg:col-span-2 space-y-6">
-            <DetailsCard ext={ext} />
-            <ReleasesCard ext={ext} />
-          </div>
-        </div>
-      </div>
-    </>
+    <div class="mx-auto max-w-6xl space-y-8">
+      {view.kind === 'owner' ? (
+        <OwnerExtensionView owned={view.owned} userId={view.userId} />
+      ) : (
+        <>
+          <ExtensionHeader
+            id={view.extension.id}
+            content={view.extension}
+            developer={view.extension.developer}
+          />
+          <ExtensionWorkspace
+            id={view.extension.id}
+            content={view.extension}
+            developerName={view.extension.developer.name}
+            releases={releasesView}
+          />
+        </>
+      )}
+    </div>
   )}
 </Base>
diff --git a/src/pages/extension/[id]/draft.ts b/src/pages/extension/[id]/draft.ts
new file mode 100644
index 00000000..06b8f95e
--- /dev/null
+++ b/src/pages/extension/[id]/draft.ts
@@ -0,0 +1,89 @@
+import type { APIRoute } from 'astro';
+import { requireUser } from '@/lib/auth-guard';
+import {
+  createApiClient,
+  ApiRequestError,
+  getApiErrorMessage,
+} from '@/lib/api/client';
+import {
+  applyExtensionDraft,
+  editableContent,
+  reconstructionContent,
+} from '@/lib/extension-draft';
+import { ExtensionValidationError } from '@/lib/extension-form';
+import { sha256Hex } from '@/lib/hash';
+import { formString } from '@/lib/form';
+import { setFlash } from '@/lib/flash';
+
+export const POST: APIRoute = async (context) => {
+  const env = context.locals.env;
+  const guard = await requireUser(context, env);
+  if (guard instanceof Response) return guard;
+  const { id } = context.params;
+  if (!id) return new Response(null, { status: 404 });
+  const fail = (message: string, status = 422) =>
+    Response.json(
+      { error: message },
+      { status, headers: { 'Cache-Control': 'no-store' } },
+    );
+  try {
+    const raw = formString(await context.request.formData(), 'draft');
+    if (raw.length > 300_000) return fail('This draft is too large to submit.');
+    let draft;
+    try {
+      draft = JSON.parse(raw);
+    } catch {
+      return fail('This draft could not be read.');
+    }
+    const api = createApiClient(env, guard.sub);
+    const owned = await api.getMyExtension(id);
+    const pending = owned.pending_revision;
+    if ((draft?.pendingRevisionId ?? null) !== (pending?.id ?? null))
+      return fail(
+        'The pending submission changed or was reviewed. Your local draft has been kept. Reload the overview before editing again.',
+        409,
+      );
+    const previous =
+      !pending && !owned.published && owned.last_review
+        ? await api.getRevision(id, owned.last_review.revision_id)
+        : null;
+    const stored = pending?.content ?? owned.published ?? previous?.content;
+    const base =
+      editableContent(stored) ??
+      (pending || !owned.published
+        ? editableContent(reconstructionContent(stored))
+        : null);
+    if (!base)
+      return fail(
+        'The original content is unavailable. Your local draft has been kept.',
+        409,
+      );
+    if (draft?.baselineHash !== (await sha256Hex(JSON.stringify(base))))
+      return fail(
+        'This extension changed since you started editing. Your local draft has been kept. Reload the overview to review it.',
+        409,
+      );
+    const payload = applyExtensionDraft(base, draft);
+    if (JSON.stringify(payload) === JSON.stringify(base))
+      return fail('There are no changes to submit.');
+    if (pending) await api.replacePendingRevision(id, pending.id, payload);
+    else await api.updateExtension(id, payload);
+    await setFlash(context, env.sessionSecret, {
+      title: pending
+        ? 'Pending Submission Updated.'
+        : 'Changes Submitted for Review.',
+    });
+    return Response.json(
+      { success: true },
+      { headers: { 'Cache-Control': 'no-store' } },
+    );
+  } catch (error) {
+    if (error instanceof ExtensionValidationError) return fail(error.message);
+    if (error instanceof ApiRequestError)
+      return fail(getApiErrorMessage(error), error.status);
+    return fail(
+      'Unable to submit your changes. Your local draft has been kept. Please try again.',
+      503,
+    );
+  }
+};
diff --git a/src/pages/account/extensions/[id]/withdraw.ts b/src/pages/extension/[id]/withdraw.ts
similarity index 86%
rename from src/pages/account/extensions/[id]/withdraw.ts
rename to src/pages/extension/[id]/withdraw.ts
index 7f244a19..78d3c15c 100644
--- a/src/pages/account/extensions/[id]/withdraw.ts
+++ b/src/pages/extension/[id]/withdraw.ts
@@ -7,11 +7,11 @@ import { setFlash } from '@/lib/flash';
 
 export const POST: APIRoute = formAction({
   guard: requireUser,
-  // A failure lands back on the edit form so the author can retry; the
+  // A failure lands back on the overview so the author can retry; the
   // success path below overrides this with the account overview.
   redirect: (context) => {
     const { id } = context.params;
-    return id ? `/account/extensions/${id}/edit` : '/account';
+    return id ? `/extension/${id}` : '/account';
   },
   fallbackError: 'Unable to withdraw extension.',
   run: async ({ context, env, user }) => {
diff --git a/src/scripts/extension-workspace.ts b/src/scripts/extension-workspace.ts
new file mode 100644
index 00000000..8c6d9722
--- /dev/null
+++ b/src/scripts/extension-workspace.ts
@@ -0,0 +1,602 @@
+import {
+  applyExtensionDraft,
+  releaseFromFields,
+  type ExtensionDraft,
+  type DraftSection,
+} from '@/lib/extension-draft';
+import { formatModuleRequirements } from '@/lib/extension-form';
+import { compatibilityLabel } from '@/lib/requirements';
+import { latestRelease, releasesDescending } from '@/lib/releases';
+import type { ExtensionUpdate } from '@/lib/api/client';
+import { EXTENSION_TYPE_LABELS, repositoryURL } from '@/types';
+import { licenseUrl } from '@/lib/license';
+import { isSafeHttpUrl } from '@/lib/safe-url';
+import { renderMarkdown } from '@/lib/markdown';
+
+export function initExtensionWorkspace() {
+  const container = document.querySelector<HTMLElement>(
+    '[data-extension-workspace]',
+  );
+  if (!container) return;
+  const root = container;
+  const configNode = root.querySelector('[data-draft-config]');
+  if (!configNode) return;
+  const config = JSON.parse(configNode.textContent!) as {
+    base: ExtensionUpdate;
+    developerName?: string;
+    baselineHash: string;
+    pendingRevisionId?: string;
+    submitLabel: string;
+    key: string;
+    submitUrl: string;
+  };
+  const find = <T extends HTMLElement>(selector: string) =>
+    root.querySelector<T>(selector)!;
+  const message = find<HTMLElement>('[data-draft-error]');
+  const submit = find<HTMLButtonElement>('[data-submit-draft]');
+  const discard = find<HTMLButtonElement>('[data-discard-draft]');
+  const status = find<HTMLElement>('[data-draft-status]');
+  const headerName = document.querySelector<HTMLElement>(
+    '[data-extension-name]',
+  );
+  const fallbackName = headerName?.textContent?.trim() ?? '';
+  const draftBar = find<HTMLElement>('[data-draft-bar]');
+  const unsaved = new Set<HTMLFormElement>();
+  const empty = (): ExtensionDraft => ({
+    baselineHash: config.baselineHash,
+    pendingRevisionId: config.pendingRevisionId,
+    sections: {},
+  });
+  let draft = empty();
+  let stored = false;
+  let blocked = false;
+  let busy = false;
+  const error = (text: string) => {
+    message.textContent = text;
+    message.hidden = !text;
+  };
+  try {
+    const raw = localStorage.getItem(config.key);
+    if (raw) {
+      stored = true;
+      draft = JSON.parse(raw);
+      applyExtensionDraft(config.base, draft);
+      if (
+        draft.baselineHash !== config.baselineHash ||
+        draft.pendingRevisionId !== config.pendingRevisionId
+      ) {
+        blocked = true;
+        error(
+          'The extension changed since this draft was started. Your draft is kept here so you can copy your changes. Discard it to start from the latest version.',
+        );
+      }
+    }
+  } catch {
+    blocked = true;
+    error(
+      'This browser’s draft storage could not be read. Your saved draft has not been removed. Check browser storage or discard the draft to start again.',
+    );
+    draft = empty();
+  }
+
+  const fields = (form: HTMLFormElement) =>
+    Object.fromEntries(
+      [...new FormData(form)].filter(
+        (entry): entry is [string, string] => typeof entry[1] === 'string',
+      ),
+    );
+  function content() {
+    return applyExtensionDraft(config.base, draft);
+  }
+  function updateButtons() {
+    let changed = false;
+    try {
+      changed = JSON.stringify(content()) !== JSON.stringify(config.base);
+    } catch {
+      /* Invalid stored draft stays blocked. */
+    }
+    submit.disabled = busy || blocked || !changed || unsaved.size > 0;
+    discard.disabled = busy || (!stored && !unsaved.size && !blocked);
+    draftBar.hidden = !changed && !unsaved.size && !blocked && !busy;
+    status.textContent = blocked
+      ? 'Draft Needs Attention'
+      : unsaved.size
+        ? 'Unsaved Section Edits'
+        : changed
+          ? 'Draft Saved in This Browser'
+          : 'No Local Changes';
+  }
+  function save(next: ExtensionDraft) {
+    if (blocked || busy)
+      throw new Error(
+        'Reload or discard the draft before saving more changes.',
+      );
+    applyExtensionDraft(config.base, next);
+    // Only announce a save after storage succeeds. Never silently lose edits
+    // when private browsing, quotas, or disabled storage prevents persistence.
+    try {
+      localStorage.setItem(config.key, JSON.stringify(next));
+    } catch {
+      throw new Error(
+        'Your draft could not be saved in this browser. Your edits are still in the form. Check browser storage and try again.',
+      );
+    }
+    draft = next;
+    stored = true;
+    error('');
+  }
+  function text(selector: string, value: string) {
+    root
+      .querySelectorAll<HTMLElement>(selector)
+      .forEach((node) => (node.textContent = value));
+  }
+  function refresh() {
+    const current = content();
+    if (headerName) headerName.textContent = current.name || fallbackName;
+    const latest = latestRelease(current.releases);
+    const requires = latest?.requires ?? current.requires;
+    const version = latest?.tag ?? current.version;
+    const headerVersion = document.querySelector<HTMLElement>(
+      '[data-extension-version]',
+    );
+    if (headerVersion) {
+      headerVersion.hidden = !version;
+      const value = headerVersion.querySelector<HTMLElement>(
+        '[data-extension-version-value]',
+      );
+      if (value)
+        value.textContent = /^\d/.test(version) ? `v${version}` : version;
+    }
+    const downloadUrl = latest?.download_url ?? current.download_url;
+    const headerDownload = document.querySelector<HTMLAnchorElement>(
+      '[data-extension-download]',
+    );
+    if (headerDownload) {
+      headerDownload.hidden = !isSafeHttpUrl(downloadUrl);
+      if (isSafeHttpUrl(downloadUrl)) headerDownload.href = downloadUrl;
+      else headerDownload.removeAttribute('href');
+    }
+    text('[data-preview-description]', current.description);
+    text('[data-preview-type]', EXTENSION_TYPE_LABELS[current.type]);
+    text('[data-preview-website]', current.homepage_url || 'Not Available');
+    const websiteLink = find<HTMLAnchorElement>('[data-preview-website]');
+    if (websiteLink) {
+      const safe = isSafeHttpUrl(current.homepage_url ?? '');
+      if (safe) websiteLink.href = current.homepage_url ?? '';
+      else websiteLink.removeAttribute('href');
+      websiteLink.classList.toggle('underline', safe);
+    }
+    text('[data-preview-icon]', current.icon_url || '');
+    const iconUrlDetail = find<HTMLElement>('[data-icon-url-detail]');
+    if (iconUrlDetail) iconUrlDetail.hidden = !current.icon_url;
+
+    const sourceUrl = repositoryURL(current.source);
+    const github = current.source.type === 'github';
+    text('[data-preview-source]', github ? current.source.repo : sourceUrl);
+    const sourceLink = find<HTMLAnchorElement>('[data-preview-source-link]');
+    if (sourceLink) {
+      if (isSafeHttpUrl(sourceUrl)) sourceLink.href = sourceUrl;
+      else sourceLink.removeAttribute('href');
+      find<HTMLElement>('[data-source-github-icon]').hidden = !github;
+      find<HTMLElement>('[data-source-link-icon]').hidden = github;
+    }
+    text('[data-preview-license]', current.license);
+    const licenseLink = find<HTMLAnchorElement>('[data-preview-license]');
+    if (licenseLink) {
+      const href = licenseUrl(current.license);
+      if (href) licenseLink.href = href;
+      else licenseLink.removeAttribute('href');
+      licenseLink.classList.toggle('underline', Boolean(href));
+    }
+    text('[data-preview-author]', current.author.name);
+    const authorLink = find<HTMLAnchorElement>('[data-preview-author]');
+    if (authorLink) {
+      if (isSafeHttpUrl(current.author.url))
+        authorLink.href = current.author.url ?? '';
+      else authorLink.removeAttribute('href');
+      authorLink.classList.toggle(
+        'underline',
+        isSafeHttpUrl(current.author.url),
+      );
+      find<HTMLElement>('[data-author-detail]').hidden =
+        !current.author.name ||
+        current.author.name.trim() === config.developerName?.trim();
+    }
+    text(
+      '[data-preview-requirements]',
+      [
+        `FOSSBilling ${compatibilityLabel(requires.fossbilling)}`,
+        ...(requires.php ? [`PHP ${compatibilityLabel(requires.php)}`] : []),
+        ...Object.entries(requires.modules ?? {}).map(
+          ([id, constraint]) => `${id}: ${constraint}`,
+        ),
+      ].join('\n'),
+    );
+    const requirementsDetail = find<HTMLElement>('[data-requirements-detail]');
+    if (requirementsDetail) requirementsDetail.hidden = false;
+    text('[data-release-count]', String(current.releases.length));
+    const readme = find<HTMLElement>('[data-preview-readme]');
+    if (readme) readme.innerHTML = renderMarkdown(current.readme);
+    root
+      .querySelectorAll<HTMLElement>('[data-section-changed]')
+      .forEach((node) => {
+        node.hidden =
+          !draft.sections[node.dataset.sectionChanged as DraftSection];
+      });
+    renderReleases(current);
+    updateButtons();
+  }
+  function fill(form: HTMLFormElement, values: Record<string, string>) {
+    for (const [name, value] of Object.entries(values)) {
+      const field = form.elements.namedItem(name);
+      if (
+        field instanceof HTMLInputElement ||
+        field instanceof HTMLTextAreaElement ||
+        field instanceof HTMLSelectElement
+      )
+        field.value = value;
+    }
+    customLicense(form);
+  }
+  function customLicense(form: HTMLFormElement) {
+    const select = form.elements.namedItem('license_spdx_id');
+    const wrapper = form.querySelector<HTMLElement>('[data-custom-license]');
+    const input = form.elements.namedItem('license_name_custom');
+    if (
+      select instanceof HTMLSelectElement &&
+      wrapper &&
+      input instanceof HTMLInputElement
+    ) {
+      wrapper.hidden = select.value !== 'other';
+      input.required = !wrapper.hidden;
+    }
+  }
+  function setSectionEditing(
+    form: HTMLFormElement,
+    section: string,
+    editing: boolean,
+  ) {
+    form.hidden = !editing;
+    find<HTMLElement>(`[data-section-preview="${section}"]`).hidden = editing;
+    const button = find<HTMLButtonElement>(`[data-edit-section="${section}"]`);
+    button.setAttribute('aria-expanded', String(editing));
+    button.querySelector<HTMLElement>('[data-edit-label]')!.textContent =
+      editing ? 'Close' : 'Edit';
+  }
+  function closeSection(form: HTMLFormElement, section: string) {
+    setSectionEditing(form, section, false);
+    const button = find<HTMLButtonElement>(`[data-edit-section="${section}"]`);
+    unsaved.delete(form);
+    updateButtons();
+    button.focus();
+  }
+  root
+    .querySelectorAll<HTMLFormElement>('[data-section-form]')
+    .forEach((form) => {
+      const section = form.dataset.sectionForm as DraftSection;
+      const initial = fields(form);
+      const sectionError = form.querySelector<HTMLElement>(
+        '[data-section-error]',
+      )!;
+      find<HTMLButtonElement>(
+        `[data-edit-section="${section}"]`,
+      ).addEventListener('click', () => {
+        if (!form.hidden) {
+          setSectionEditing(form, section, false);
+          return;
+        }
+        if (!unsaved.has(form))
+          fill(form, {
+            ...initial,
+            ...draft.sections[section],
+          });
+        setSectionEditing(form, section, true);
+        form.querySelector<HTMLElement>('input, textarea, select')?.focus();
+      });
+      form.addEventListener('input', () => {
+        unsaved.add(form);
+        customLicense(form);
+        updateButtons();
+      });
+      form.addEventListener('change', () => {
+        unsaved.add(form);
+        customLicense(form);
+        updateButtons();
+      });
+      find<HTMLButtonElement>(
+        `[data-cancel-section="${section}"]`,
+      ).addEventListener('click', () => {
+        sectionError.hidden = true;
+        closeSection(form, section);
+      });
+      form.addEventListener('submit', (event) => {
+        event.preventDefault();
+        try {
+          const sections = { ...draft.sections, [section]: fields(form) };
+          save({ ...draft, sections });
+          sectionError.hidden = true;
+          closeSection(form, section);
+          refresh();
+        } catch (cause) {
+          sectionError.textContent =
+            cause instanceof Error
+              ? cause.message
+              : 'Unable to save this section.';
+          sectionError.hidden = false;
+        }
+      });
+    });
+
+  const releaseForm = find<HTMLFormElement>('[data-release-form]');
+  const releaseEditor = find<HTMLElement>('[data-release-editor]');
+  function editRelease(tag?: string) {
+    if (!releaseForm) return;
+    if (
+      unsaved.has(releaseForm) &&
+      !confirm('Discard the unsaved release edits?')
+    )
+      return;
+    releaseForm.reset();
+    const current = content();
+    const release = current.releases.find((item) => item.tag === tag);
+    fill(releaseForm, {
+      original_tag: tag ?? '',
+      version_tag: release?.tag ?? '',
+      release_date: release?.date.slice(0, 10) ?? '',
+      download_url: release?.download_url ?? '',
+      changelog_url: release?.changelog_url ?? '',
+      requires_fossbilling: release?.requires.fossbilling ?? '',
+      requires_php: release?.requires.php ?? '',
+      requires_modules: formatModuleRequirements(release?.requires.modules),
+    });
+    find('[data-release-form-title]').textContent = tag
+      ? 'Edit Release'
+      : 'Add Release';
+    find('[data-release-error]').hidden = true;
+    releaseEditor.hidden = false;
+    unsaved.delete(releaseForm);
+    updateButtons();
+    (releaseForm.elements.namedItem('version_tag') as HTMLInputElement).focus();
+  }
+  function renderReleases(current: ExtensionUpdate) {
+    const list = find<HTMLUListElement>('[data-release-list]');
+    if (!list) return;
+    const emptyState = find<HTMLElement>('[data-release-empty]');
+    if (emptyState) emptyState.hidden = current.releases.length > 0;
+    list.replaceChildren();
+    const latest = latestRelease(current.releases);
+    for (const release of releasesDescending(current.releases)) {
+      const li = document.createElement('li');
+      li.className =
+        'flex flex-wrap items-center justify-between gap-4 p-5 sm:px-6';
+      const info = document.createElement('div');
+      info.className = 'min-w-0 max-w-full';
+      const title = document.createElement('p');
+      title.className = 'text-sm font-semibold';
+      title.textContent = `${release.tag}${release.tag === latest?.tag ? ' · Latest Version' : ''}`;
+      const detail = document.createElement('p');
+      detail.className = 'mt-1 text-xs text-muted-foreground';
+      detail.textContent = `${release.date} · FOSSBilling ${compatibilityLabel(release.requires.fossbilling)}${release.requires.php ? ` · PHP ${compatibilityLabel(release.requires.php)}` : ''}`;
+      const links = document.createElement('p');
+      links.className = 'mt-2 max-w-xl text-xs text-muted-foreground';
+      const download = document.createElement('a');
+      download.className = 'break-all underline-offset-4';
+      download.textContent = release.download_url;
+      if (isSafeHttpUrl(release.download_url)) {
+        download.href = release.download_url;
+        download.target = '_blank';
+        download.rel = 'noopener noreferrer';
+        download.classList.add('underline');
+      }
+      info.appendChild(title);
+      info.appendChild(detail);
+      links.appendChild(download);
+      if (release.changelog_url && isSafeHttpUrl(release.changelog_url)) {
+        const changelog = document.createElement('a');
+        changelog.className = 'underline underline-offset-4';
+        changelog.textContent = 'Changelog';
+        changelog.href = release.changelog_url;
+        changelog.target = '_blank';
+        changelog.rel = 'noopener noreferrer';
+        changelog.setAttribute('aria-label', `Changelog for ${release.tag}`);
+        const changelogGroup = document.createElement('span');
+        changelogGroup.className = 'whitespace-nowrap';
+        const separator = document.createElement('span');
+        separator.setAttribute('aria-hidden', 'true');
+        separator.textContent = ' | ';
+        changelogGroup.appendChild(separator);
+        changelogGroup.appendChild(changelog);
+        links.appendChild(changelogGroup);
+      }
+      info.appendChild(links);
+      const actions = document.createElement('div');
+      actions.className = 'flex flex-wrap gap-2';
+      const edit = document.createElement('button');
+      edit.type = 'button';
+      edit.className = 'btn';
+      edit.dataset.variant = 'outline';
+      edit.dataset.size = 'sm';
+      edit.textContent = 'Edit';
+      edit.setAttribute('aria-label', `Edit Release ${release.tag}`);
+      edit.addEventListener('click', () => editRelease(release.tag));
+      actions.appendChild(edit);
+      const remove = document.createElement('button');
+      remove.type = 'button';
+      remove.className = 'btn';
+      remove.dataset.variant = 'destructive';
+      remove.dataset.size = 'sm';
+      remove.textContent = 'Remove';
+      remove.setAttribute('aria-label', `Remove Release ${release.tag}`);
+      remove.disabled = current.releases.length === 1;
+      if (remove.disabled) remove.title = 'Keep at least one release.';
+      remove.addEventListener('click', () => {
+        if (!confirm(`Remove Release ${release.tag} from this draft?`)) return;
+        try {
+          save({
+            ...draft,
+            releases: current.releases.filter(
+              (item) => item.tag !== release.tag,
+            ),
+          });
+          refresh();
+        } catch (cause) {
+          error(
+            cause instanceof Error
+              ? cause.message
+              : 'Unable to remove this release.',
+          );
+        }
+      });
+      actions.appendChild(remove);
+      li.appendChild(info);
+      li.appendChild(actions);
+      list.appendChild(li);
+    }
+  }
+  find<HTMLButtonElement>('[data-add-release]')?.addEventListener('click', () =>
+    editRelease(),
+  );
+  find<HTMLButtonElement>('[data-cancel-release]')?.addEventListener(
+    'click',
+    () => {
+      releaseEditor.hidden = true;
+      unsaved.delete(releaseForm);
+      updateButtons();
+    },
+  );
+  releaseForm?.addEventListener('input', () => {
+    unsaved.add(releaseForm);
+    updateButtons();
+  });
+  releaseForm?.addEventListener('change', () => {
+    unsaved.add(releaseForm);
+    updateButtons();
+  });
+  releaseForm?.addEventListener('submit', (event) => {
+    event.preventDefault();
+    try {
+      const input = fields(releaseForm);
+      const release = releaseFromFields(input);
+      const current = content();
+      if (
+        current.releases.some(
+          (item) =>
+            item.tag.replace(/^v/, '') === release.tag.replace(/^v/, '') &&
+            item.tag !== input.original_tag,
+        )
+      )
+        throw new Error(`A release tagged "${release.tag}" already exists.`);
+      if (
+        input.original_tag &&
+        !current.releases.some((item) => item.tag === input.original_tag)
+      )
+        throw new Error(
+          'This release was removed from the draft. Close the editor and choose another release.',
+        );
+      const releases = input.original_tag
+        ? current.releases.map((item) =>
+            item.tag === input.original_tag ? release : item,
+          )
+        : [...current.releases, release];
+      save({
+        ...draft,
+        releases,
+      });
+      releaseEditor.hidden = true;
+      unsaved.delete(releaseForm);
+      refresh();
+    } catch (cause) {
+      const node = find('[data-release-error]');
+      node.textContent =
+        cause instanceof Error ? cause.message : 'Unable to save release.';
+      node.hidden = false;
+    }
+  });
+  discard.addEventListener('click', () => {
+    if (!confirm('Discard all local draft changes for this extension?')) return;
+    try {
+      localStorage.removeItem(config.key);
+    } catch {
+      error('The draft could not be removed from browser storage.');
+      return;
+    }
+    unsaved.clear();
+    stored = false;
+    blocked = false;
+    draft = empty();
+    root
+      .querySelectorAll<HTMLFormElement>('[data-section-form]')
+      .forEach((form) => {
+        setSectionEditing(form, form.dataset.sectionForm!, false);
+      });
+    if (releaseEditor) releaseEditor.hidden = true;
+    error('');
+    refresh();
+  });
+  submit.addEventListener('click', async () => {
+    if (submit.disabled) return;
+    busy = true;
+    updateButtons();
+    submit.textContent = 'Submitting…';
+    root.inert = true;
+    root.setAttribute('aria-busy', 'true');
+    try {
+      const body = new FormData();
+      body.set('draft', JSON.stringify(draft));
+      const response = await fetch(config.submitUrl, {
+        method: 'POST',
+        body,
+        redirect: 'manual',
+      });
+      if (response.status === 0 || response.status === 302)
+        throw new Error(
+          'Your session has expired. Sign in again; your local draft has been kept.',
+        );
+      const result = (await response.json()) as {
+        error?: string;
+      };
+      if (!response.ok)
+        throw new Error(
+          result.error ||
+            'Unable to submit changes. Your local draft has been kept.',
+        );
+      try {
+        localStorage.removeItem(config.key);
+      } catch {
+        /* A stale draft will be flagged on the next editable visit. */
+      }
+      stored = false;
+      unsaved.clear();
+      const next = new URL(window.location.href);
+      next.searchParams.set('version', 'pending');
+      next.hash = '';
+      window.location.assign(next.href);
+    } catch (cause) {
+      error(
+        cause instanceof Error
+          ? cause.message
+          : 'Unable to submit changes. Your local draft has been kept.',
+      );
+      busy = false;
+      root.inert = false;
+      root.removeAttribute('aria-busy');
+      submit.textContent = config.submitLabel;
+      updateButtons();
+    }
+  });
+  window.addEventListener('beforeunload', (event) => {
+    if (unsaved.size) {
+      event.preventDefault();
+    }
+  });
+  window.addEventListener('storage', (event) => {
+    if (event.key === config.key || event.key === null) {
+      blocked = true;
+      error(
+        'This draft changed in another tab. Reload before editing or submitting so those changes are not overwritten.',
+      );
+      updateButtons();
+    }
+  });
+  refresh();
+}
diff --git a/src/types/index.ts b/src/types/index.ts
index 819cb47d..6a6021ca 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -1,5 +1,4 @@
-import gt from 'semver/functions/gt.js';
-import lt from 'semver/functions/lt.js';
+import { latestRelease, releasesDescending } from '@/lib/releases';
 import SPDX_LICENSE_IDS from 'spdx-license-ids/index.json';
 
 // SPDX identifiers offered as form suggestions; manifest licenses are strings.
@@ -16,6 +15,15 @@ export const EXTENSION_TYPES = [
 
 export type ExtensionType = (typeof EXTENSION_TYPES)[number];
 
+export const EXTENSION_TYPE_LABELS: Record<ExtensionType, string> = {
+  module: 'Module',
+  theme: 'Theme',
+  'payment-gateway': 'Payment Gateway',
+  'server-manager': 'Server Manager',
+  'domain-registrar': 'Domain Registrar',
+  translation: 'Translation',
+};
+
 export const SOURCE_TYPES = ['github', 'gitlab', 'custom'] as const;
 
 export type SourceType = (typeof SOURCE_TYPES)[number];
@@ -42,7 +50,7 @@ export function isDeveloperType(value: string): value is DeveloperType {
 // components. These intentionally do not depend on API transport DTOs.
 export type Requirements = {
   fossbilling: string;
-  php: string;
+  php?: string;
   modules?: Record<string, string>;
 };
 export type PackageAuthor = { name: string; url?: string };
@@ -111,32 +119,11 @@ export type PublicDeveloperProfile = Omit<
 > & { unclaimed: boolean };
 
 export function getLatestRelease(extension: Extension): Release | undefined {
-  if (extension.releases.length === 0) {
-    return undefined;
-  }
-
-  let latestRelease = extension.releases[0];
-  for (let i = 1; i < extension.releases.length; i++) {
-    const release = extension.releases[i];
-
-    if (gt(release.tag, latestRelease.tag)) {
-      latestRelease = release;
-    }
-  }
-
-  return latestRelease;
+  return latestRelease(extension.releases);
 }
 
 export function sortReleasesDescending(releases: Release[]): Release[] {
-  return [...releases].sort((a, b) => {
-    if (gt(a.tag, b.tag)) {
-      return -1;
-    } else if (lt(a.tag, b.tag)) {
-      return 1;
-    } else {
-      return 0;
-    }
-  });
+  return releasesDescending(releases);
 }
 
 export function repositoryURL(repository: Repository): string {
diff --git a/test/extension-draft-submit.test.ts b/test/extension-draft-submit.test.ts
new file mode 100644
index 00000000..f410b143
--- /dev/null
+++ b/test/extension-draft-submit.test.ts
@@ -0,0 +1,214 @@
+import type { APIContext } from 'astro';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const mocks = vi.hoisted(() => ({
+  guard: vi.fn(),
+  getMyExtension: vi.fn(),
+  getRevision: vi.fn(),
+  updateExtension: vi.fn(),
+  replacePendingRevision: vi.fn(),
+  setFlash: vi.fn(),
+}));
+vi.mock('@/lib/auth-guard', () => ({ requireUser: mocks.guard }));
+vi.mock('@/lib/flash', () => ({ setFlash: mocks.setFlash }));
+vi.mock('@/lib/api/client', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/api/client')>()),
+  createApiClient: () => mocks,
+}));
+import { POST } from '@/pages/extension/[id]/draft';
+import { sha256Hex } from '@/lib/hash';
+import { editableContent, reconstructionContent } from '@/lib/extension-draft';
+import { ApiRequestError, type ExtensionUpdate } from '@/lib/api/client';
+const base: ExtensionUpdate = {
+  manifest_version: 1,
+  author: { name: 'Author' },
+  requires: { fossbilling: '>=0.7.0', php: '>=8.3' },
+  type: 'module',
+  name: 'Original',
+  description: 'Original description',
+  homepage_url: 'https://example.test',
+  readme: '# Original',
+  license: 'MIT',
+  source: { type: 'github', repo: 'example/original' },
+  releases: [
+    {
+      tag: '1.0.0',
+      date: '2026-01-01',
+      download_url: 'https://example.test/1.zip',
+      requires: { fossbilling: '>=0.7.0', php: '>=8.3' },
+    },
+  ],
+  version: '1.0.0',
+  download_url: 'https://example.test/1.zip',
+};
+async function context(overrides: Record<string, unknown> = {}) {
+  const body = new FormData();
+  body.set(
+    'draft',
+    JSON.stringify({
+      baselineHash: await sha256Hex(JSON.stringify(editableContent(base))),
+      sections: { readme: { readme: '# Changed' } },
+      ...overrides,
+    }),
+  );
+  return {
+    params: { id: 'example' },
+    locals: { env: { sessionSecret: 'test' } },
+    request: new Request('https://example.test/extension/example/draft', {
+      method: 'POST',
+      body,
+    }),
+  } as unknown as APIContext;
+}
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.guard.mockResolvedValue({ sub: 'owner' });
+  mocks.getMyExtension.mockResolvedValue({
+    published: base,
+    pending_revision: null,
+  });
+  mocks.updateExtension.mockResolvedValue({});
+});
+describe('draft submission', () => {
+  it('submits the merged content and returns success', async () => {
+    const response = await POST(await context());
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      success: true,
+    });
+    expect(mocks.updateExtension).toHaveBeenCalledWith('example', {
+      ...base,
+      readme: '# Changed',
+    });
+  });
+  it('authorizes before reading any extension content', async () => {
+    mocks.guard.mockResolvedValue(new Response(null, { status: 302 }));
+    expect((await POST(await context())).status).toBe(302);
+    expect(mocks.getMyExtension).not.toHaveBeenCalled();
+  });
+  it('keeps API ownership enforcement active', async () => {
+    mocks.getMyExtension.mockRejectedValue(
+      new ApiRequestError(403, 'FORBIDDEN', 'Forbidden'),
+    );
+    expect((await POST(await context())).status).toBe(403);
+    expect(mocks.updateExtension).not.toHaveBeenCalled();
+  });
+  it('rejects stale baselines and pending submissions without writing', async () => {
+    expect((await POST(await context({ baselineHash: 'old' }))).status).toBe(
+      409,
+    );
+    mocks.getMyExtension.mockResolvedValue({
+      published: base,
+      pending_revision: { id: 'pending' },
+    });
+    expect((await POST(await context())).status).toBe(409);
+    expect(mocks.updateExtension).not.toHaveBeenCalled();
+  });
+  it('updates pending content while leaving published content alone', async () => {
+    mocks.getMyExtension.mockResolvedValue({
+      published: { ...base, readme: '# Published' },
+      pending_revision: { id: 'pending', content: base },
+    });
+    const response = await POST(
+      await context({ pendingRevisionId: 'pending' }),
+    );
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      success: true,
+    });
+    expect(mocks.replacePendingRevision).toHaveBeenCalledWith(
+      'example',
+      'pending',
+      { ...base, readme: '# Changed' },
+    );
+    expect(mocks.updateExtension).not.toHaveBeenCalled();
+  });
+  it('edits the first pending submission before anything is published', async () => {
+    mocks.getMyExtension.mockResolvedValue({
+      published: null,
+      pending_revision: { id: 'pending', content: base },
+    });
+    expect(
+      (await POST(await context({ pendingRevisionId: 'pending' }))).status,
+    ).toBe(200);
+    expect(mocks.replacePendingRevision).toHaveBeenCalled();
+  });
+  it('keeps stale pending drafts after a review or replacement', async () => {
+    expect(
+      (await POST(await context({ pendingRevisionId: 'pending' }))).status,
+    ).toBe(409);
+    mocks.getMyExtension.mockResolvedValue({
+      published: base,
+      pending_revision: { id: 'new-pending', content: base },
+    });
+    expect(
+      (await POST(await context({ pendingRevisionId: 'pending' }))).status,
+    ).toBe(409);
+    expect(mocks.updateExtension).not.toHaveBeenCalled();
+    expect(mocks.replacePendingRevision).not.toHaveBeenCalled();
+  });
+  it('handles a concurrent API review without falling back to a fresh submission', async () => {
+    mocks.getMyExtension.mockResolvedValue({
+      published: base,
+      pending_revision: { id: 'pending', content: base },
+    });
+    mocks.replacePendingRevision.mockRejectedValueOnce(
+      new ApiRequestError(409, 'CONFLICT', 'The submission was reviewed'),
+    );
+    expect(
+      (await POST(await context({ pendingRevisionId: 'pending' }))).status,
+    ).toBe(409);
+    expect(mocks.updateExtension).not.toHaveBeenCalled();
+    expect(mocks.setFlash).not.toHaveBeenCalled();
+  });
+  it('uses the previous rejected submission when nothing was published', async () => {
+    mocks.getMyExtension.mockResolvedValue({
+      published: null,
+      last_review: { revision_id: 'rejected' },
+    });
+    mocks.getRevision.mockResolvedValue({ content: base });
+    expect((await POST(await context())).status).toBe(200);
+    expect(mocks.getRevision).toHaveBeenCalledWith('example', 'rejected');
+    expect(mocks.updateExtension).toHaveBeenCalledWith('example', {
+      ...base,
+      readme: '# Changed',
+    });
+  });
+  it('saves rebuilt pending content using the same normalized baseline as the browser', async () => {
+    const stored = {
+      ...base,
+      manifest_version: undefined,
+      license: { name: 'MIT' },
+    };
+    const rebuilt = editableContent(reconstructionContent(stored))!;
+    mocks.getMyExtension.mockResolvedValue({
+      published: null,
+      pending_revision: { id: 'pending', content: stored },
+    });
+    const response = await POST(
+      await context({
+        pendingRevisionId: 'pending',
+        baselineHash: await sha256Hex(JSON.stringify(rebuilt)),
+      }),
+    );
+    expect(response.status).toBe(200);
+    expect(mocks.replacePendingRevision).toHaveBeenCalledWith(
+      'example',
+      'pending',
+      { ...rebuilt, readme: '# Changed' },
+    );
+  });
+  it('rejects empty changes and malformed section edits', async () => {
+    expect((await POST(await context({ sections: {} }))).status).toBe(422);
+    expect(
+      (await POST(await context({ sections: { readme: { readme: '' } } })))
+        .status,
+    ).toBe(422);
+    expect(mocks.updateExtension).not.toHaveBeenCalled();
+  });
+  it('returns a recoverable failure when the API is unavailable', async () => {
+    mocks.updateExtension.mockRejectedValue(new Error('offline'));
+    const response = await POST(await context());
+    expect(response.status).toBe(503);
+    expect(await response.text()).toContain('draft has been kept');
+  });
+});
diff --git a/test/extension-draft.test.ts b/test/extension-draft.test.ts
new file mode 100644
index 00000000..8142630a
--- /dev/null
+++ b/test/extension-draft.test.ts
@@ -0,0 +1,421 @@
+import { describe, expect, it } from 'vitest';
+import {
+  applyExtensionDraft,
+  editableContent,
+  reconstructionContent,
+  releaseFromFields,
+  serializeDraftConfig,
+  type ExtensionDraft,
+} from '@/lib/extension-draft';
+import { ExtensionValidationError } from '@/lib/extension-form';
+import type { ExtensionUpdate } from '@/lib/api/client';
+
+export const base: ExtensionUpdate = {
+  manifest_version: 1,
+  author: { name: 'Author' },
+  requires: { fossbilling: '>=0.7.0', php: '>=8.3' },
+  type: 'module',
+  name: 'Original',
+  description: 'Original description',
+  homepage_url: 'http://example.test',
+  icon_url: 'icon.svg',
+  readme: '# Original',
+  license: 'MIT',
+  source: { type: 'github', repo: 'example/original' },
+  releases: [
+    {
+      tag: '1.0.0',
+      date: '2026-01-01',
+      download_url: 'https://example.test/1.zip',
+      requires: { fossbilling: '>=0.7.0', php: '>=8.3' },
+    },
+  ],
+  version: '1.0.0',
+  download_url: 'https://example.test/1.zip',
+};
+const draft = (sections: ExtensionDraft['sections']): ExtensionDraft => ({
+  baselineHash: 'hash',
+  sections,
+});
+
+describe('extension drafts', () => {
+  it('saves source and license with the merged Listing section while retaining README and releases', () => {
+    const result = applyExtensionDraft(
+      base,
+      draft({
+        listing: {
+          author_name: 'Author',
+          requires_fossbilling: '>=0.7.0',
+          requires_php: '>=8.3',
+          name: 'Updated Listing',
+          description: 'Updated description',
+          type: 'module',
+          homepage_url: 'https://example.test',
+          icon_url: '',
+          source_url: 'https://gitlab.com/example/updated',
+          license_spdx_id: 'Apache-2.0',
+          license_url: 'https://example.test/license',
+        },
+      }),
+    );
+    expect(result.name).toBe('Updated Listing');
+    expect(result.source).toEqual({ type: 'gitlab', repo: 'example/updated' });
+    expect(result.license).toBe('Apache-2.0');
+    expect(result.readme).toBe(base.readme);
+    expect(result.releases).toEqual(base.releases);
+    expect(result.version).toBe(base.version);
+  });
+  it('merges multiple edited sections without replacing unrelated fields or releases', () => {
+    const result = applyExtensionDraft(
+      base,
+      draft({
+        readme: { readme: '# Revised' },
+        listing: {
+          author_name: 'Author',
+          requires_fossbilling: '>=0.7.0',
+          requires_php: '>=8.3',
+          name: 'Revised',
+          description: 'Revised description',
+          type: 'theme',
+          homepage_url: 'https://example.test/new',
+          icon_url: '',
+        },
+      }),
+    );
+    expect(result).toMatchObject({
+      name: 'Revised',
+      type: 'theme',
+      readme: '# Revised',
+    });
+    expect(result.icon_url).toBeUndefined();
+    expect(result.releases).toEqual(base.releases);
+    expect(result.version).toBe(base.version);
+    expect(result.download_url).toBe(base.download_url);
+    expect(result.source).toEqual(base.source);
+    expect(base.name).toBe('Original');
+  });
+  it('preserves untouched HTTP URLs exactly', () => {
+    expect(
+      applyExtensionDraft(base, draft({ readme: { readme: '# Changed' } }))
+        .homepage_url,
+    ).toBe('http://example.test');
+  });
+  it('ignores attempts to overwrite other fields inside an edited section', () => {
+    const result = applyExtensionDraft(
+      base,
+      draft({
+        readme: {
+          readme: '# Changed',
+          name: 'Injected',
+          developer_id: 'another',
+          releases: '[]',
+        },
+      }),
+    );
+    expect(result.name).toBe(base.name);
+    expect(result.releases).toEqual(base.releases);
+    expect(result).not.toHaveProperty('developer_id');
+  });
+  it('saves custom licensing and source through the overview', () => {
+    const result = applyExtensionDraft(
+      base,
+      draft({
+        listing: {
+          name: base.name,
+          description: base.description,
+          type: base.type,
+          author_name: base.author.name,
+          source_url: 'https://example.test/source',
+          license_spdx_id: 'other',
+          license_name_custom: 'Commercial',
+          license_url: 'https://example.test/license',
+        },
+      }),
+    );
+    expect(result.source).toEqual({
+      type: 'custom',
+      repo: 'https://example.test/source',
+    });
+    expect(result.license).toBe('Commercial');
+    expect(result.name).toBe(base.name);
+    expect(result.readme).toBe(base.readme);
+  });
+  it('derives the latest version and download automatically, ignoring an old manual selection', () => {
+    const next = {
+      ...base.releases[0],
+      tag: '2.0.0',
+      download_url: 'https://example.test/2.zip',
+    };
+    const result = applyExtensionDraft(base, {
+      ...draft({}),
+      releases: [...base.releases, next],
+      currentRelease: '1.0.0',
+      download_url: 'https://injected.test',
+    });
+    expect(result.version).toBe('2.0.0');
+    expect(result.download_url).toBe(next.download_url);
+    expect(result.name).toBe(base.name);
+  });
+
+  it('automatically selects the next release when the latest is removed', () => {
+    const newer = {
+      ...base.releases[0],
+      tag: '2.0.0',
+      download_url: 'https://example.test/2.zip',
+    };
+    const published = {
+      ...base,
+      releases: [...base.releases, newer],
+      version: '2.0.0',
+      download_url: newer.download_url,
+    };
+    const result = applyExtensionDraft(published, {
+      ...draft({}),
+      releases: base.releases,
+    });
+    expect(result.version).toBe('1.0.0');
+    expect(result.download_url).toBe(base.download_url);
+  });
+  it('updates the primary download when the latest release is edited', () => {
+    const changed = {
+      ...base.releases[0],
+      download_url: 'https://example.test/fixed.zip',
+    };
+    const result = applyExtensionDraft(base, {
+      ...draft({}),
+      releases: [changed],
+    });
+    expect(result.download_url).toBe(changed.download_url);
+    expect(result.version).toBe('1.0.0');
+  });
+  it('normalizes a stale primary release when other draft sections are submitted', () => {
+    const newer = {
+      ...base.releases[0],
+      tag: '2.0.0',
+      download_url: 'https://example.test/2.zip',
+    };
+    const result = applyExtensionDraft(
+      { ...base, releases: [...base.releases, newer] },
+      draft({ readme: { readme: '# Edited' } }),
+    );
+    expect(result.version).toBe('2.0.0');
+    expect(result.download_url).toBe(newer.download_url);
+  });
+  it('keeps the version label and untouched historic release values when editing another release', () => {
+    const published = {
+      ...base,
+      releases: [
+        {
+          ...base.releases[0],
+          tag: 'v1.0.0',
+          date: '2026-01-01T12:00:00Z',
+          download_url: 'http://example.test/1.zip',
+        },
+      ],
+      download_url: 'http://example.test/1.zip',
+    };
+    const next = {
+      ...base.releases[0],
+      tag: '0.9.0',
+      download_url: 'https://example.test/old.zip',
+    };
+    const result = applyExtensionDraft(published, {
+      ...draft({}),
+      releases: [...published.releases, next],
+      currentRelease: 'v1.0.0',
+    });
+    expect(result.version).toBe('1.0.0');
+    expect(result.releases[0]).toEqual(published.releases[0]);
+    expect(result.download_url).toBe('http://example.test/1.zip');
+  });
+  it.each([
+    { releases: [], currentRelease: '' },
+    { releases: [base.releases[0], base.releases[0]], currentRelease: '1.0.0' },
+    {
+      releases: new Array(101).fill(base.releases[0]),
+      currentRelease: '1.0.0',
+    },
+  ])('rejects invalid release sets: %j', (releases) => {
+    expect(() =>
+      applyExtensionDraft(base, { ...draft({}), ...releases }),
+    ).toThrow(ExtensionValidationError);
+  });
+  it.each([
+    null,
+    { sections: [] },
+    { sections: { unknown: {} } },
+    { sections: { readme: { readme: '' } } },
+    { sections: { details: { source_type: 'invalid' } } },
+  ])('rejects invalid draft input: %j', (input) => {
+    expect(() => applyExtensionDraft(base, input)).toThrow(
+      ExtensionValidationError,
+    );
+  });
+  it('derives overview compatibility from releases without rewriting their requirements', () => {
+    const requires = { fossbilling: '^0.8.9 || ^1.0', php: '>=8.3 <9' };
+    const manifest = { ...base, requires };
+    const result = applyExtensionDraft(
+      manifest,
+      draft({
+        listing: {
+          name: base.name,
+          description: 'Updated listing',
+          type: base.type,
+          author_name: base.author.name,
+          requires_fossbilling: requires.fossbilling,
+          requires_php: requires.php,
+        },
+      }),
+    );
+    expect(result.requires).toEqual(base.releases[0].requires);
+    expect(result.releases).toEqual(base.releases);
+  });
+  it('keeps overview requirements aligned with the latest release, including inherited PHP', () => {
+    const requires = { fossbilling: '>=0.8.0' };
+    const releases = [
+      ...base.releases,
+      { ...base.releases[0], tag: '2.0.0', requires },
+    ];
+    const result = applyExtensionDraft(base, { ...draft({}), releases });
+    expect(result.requires).toEqual(requires);
+    expect(result.requires).not.toHaveProperty('php');
+    expect(base.requires.php).toBe('>=8.3');
+  });
+  it('normalizes the latest release tag for the manifest version', () => {
+    const releases = [{ ...base.releases[0], tag: 'v2.0.0' }];
+    expect(applyExtensionDraft(base, { ...draft({}), releases }).version).toBe(
+      '2.0.0',
+    );
+  });
+  it('rejects alternate v-prefixed spellings of the same release', () => {
+    expect(() =>
+      applyExtensionDraft(base, {
+        ...draft({}),
+        releases: [base.releases[0], { ...base.releases[0], tag: 'v1.0.0' }],
+      }),
+    ).toThrow(ExtensionValidationError);
+  });
+  it('rejects impossible release dates and invalid URLs', () => {
+    const fields = {
+      version_tag: '2.0.0',
+      release_date: '2026-02-30',
+      download_url: 'https://example.test/2.zip',
+      requires: { fossbilling: '>=0.7.0', php: '>=8.3' },
+    };
+    expect(() => releaseFromFields(fields)).toThrow('date');
+    expect(() =>
+      releaseFromFields({
+        ...fields,
+        release_date: '2026-02-28',
+        download_url: 'https://%',
+      }),
+    ).toThrow('URL');
+  });
+  it('does not treat incomplete historical content as an editable baseline', () => {
+    expect(editableContent({ name: 'Historical name' })).toBeNull();
+    expect(
+      editableContent({ ...base, id: 'immutable', developer: {} }),
+    ).toEqual(base);
+    expect(editableContent({ ...base, source: null })).toBeNull();
+  });
+  it('allows an editable baseline with inherited PHP requirements', () => {
+    const requires = { fossbilling: '>=0.7.0' };
+    const content = {
+      ...base,
+      requires,
+      releases: base.releases.map((release) => ({ ...release, requires })),
+    };
+    expect(editableContent(content)).toEqual(content);
+    expect(
+      editableContent({ ...content, requires: { ...requires, php: null } }),
+    ).toBeNull();
+  });
+  it('keeps available historical fields when rebuilding an incomplete submission', () => {
+    const reconstructed = reconstructionContent({
+      name: 'Historical name',
+      readme: '# Retained',
+    });
+    expect(reconstructed).toMatchObject({
+      name: 'Historical name',
+      readme: '# Retained',
+      releases: [],
+      source: { type: 'github', repo: '' },
+    });
+    expect(
+      applyExtensionDraft(
+        reconstructed,
+        draft({ readme: { readme: '# Revised' } }),
+      ).name,
+    ).toBe('Historical name');
+  });
+});
+
+describe('draft configuration embedded in HTML', () => {
+  it('escapes < so README HTML cannot close the embedded script', () => {
+    const config = {
+      base: {
+        readme:
+          '# README\n<div>Unicode 🦊 & HTML</div>\n</script><script>example()</script>',
+      },
+    };
+    const serialized = serializeDraftConfig(config);
+    expect(serialized).not.toContain('<');
+    expect(JSON.parse(serialized)).toEqual(config);
+  });
+});
+
+describe('manifest fields in section drafts', () => {
+  it('preserves opaque requirements and author attribution across unrelated edits', () => {
+    const requires = {
+      fossbilling: '^0.8.9 || ^1.0',
+      php: '>=8.3 <9',
+      modules: { branding: '^1.2' },
+    };
+    const manifest = {
+      ...base,
+      author: { name: 'Package Author', url: 'https://author.example.test' },
+      requires,
+      releases: base.releases.map((release) => ({ ...release, requires })),
+    };
+    const result = applyExtensionDraft(
+      manifest,
+      draft({ readme: { readme: '# Revised' } }),
+    );
+    expect(result.author).toEqual(manifest.author);
+    expect(result.requires).toEqual(requires);
+    expect(result.releases).toEqual(manifest.releases);
+  });
+  it('saves release-specific requirements without rewriting constraints', () => {
+    const release = releaseFromFields({
+      version_tag: '2.0.0',
+      release_date: '2026-11-04',
+      download_url: 'https://example.test/2.zip',
+      requires_fossbilling: '^0.8.9 || ^1.0',
+      requires_php: '>=8.3 <9',
+      requires_modules: 'branding: ^1.2',
+    });
+    expect(release.requires).toEqual({
+      fossbilling: '^0.8.9 || ^1.0',
+      php: '>=8.3 <9',
+      modules: { branding: '^1.2' },
+    });
+  });
+  it('does not invent compatibility requirements when rebuilding old submissions', () => {
+    const reconstructed = reconstructionContent({
+      name: 'Old',
+      releases: [
+        {
+          tag: '1.0.0',
+          date: '2026-01-01',
+          download_url: 'https://example.test/1.zip',
+          min_fossbilling_version: '0.7.0',
+        },
+      ],
+    });
+    expect(reconstructed.requires).toEqual({ fossbilling: '', php: '' });
+    expect(reconstructed.releases[0].requires).toEqual({
+      fossbilling: '',
+      php: '',
+    });
+  });
+});
diff --git a/test/extension-form.test.ts b/test/extension-form.test.ts
index 632d2df1..ca66cb39 100644
--- a/test/extension-form.test.ts
+++ b/test/extension-form.test.ts
@@ -24,8 +24,7 @@ function extensionForm(overrides: Record<string, string | undefined> = {}) {
     requires_modules: 'branding: ^1.2',
     license_spdx_id: 'MIT',
     readme: '# Example',
-    source_type: 'github',
-    source_repo: 'fossbilling/example',
+    source_url: 'https://github.com/fossbilling/example',
     version_tag: '1.0.0',
     release_date: '2026-01-01',
     download_url: 'example.test/example.zip',
@@ -129,6 +128,20 @@ describe('manifest publishing forms', () => {
     expect(body.releases[1].requires.php).toBe('>=8.4');
     expect(body.version).toBe('1.1.0');
   });
+  it('normalizes v-prefixed latest versions and rejects duplicate tag spellings', () => {
+    expect(
+      buildExtensionUpdatePayload(
+        extensionForm({ version_tag: 'v2.0.0' }),
+        published,
+      ).version,
+    ).toBe('2.0.0');
+    expect(() =>
+      buildExtensionUpdatePayload(
+        extensionForm({ version_tag: 'v1.0.0' }),
+        published,
+      ),
+    ).toThrow(ExtensionValidationError);
+  });
   it('rejects duplicate tags and overflowing release history', () => {
     expect(() =>
       buildExtensionUpdatePayload(extensionForm(), published),
@@ -191,13 +204,19 @@ describe('manifest publishing forms', () => {
       buildExtensionCreatePayload(extensionForm({ icon_url })),
     ).toThrow(ExtensionValidationError);
   });
+  it('inherits FOSSBilling PHP requirements when no additional constraint is set', () => {
+    const body = buildExtensionCreatePayload(
+      extensionForm({ requires_php: '' }),
+    );
+    expect(body.requires).not.toHaveProperty('php');
+    expect(body.releases[0].requires).not.toHaveProperty('php');
+  });
   it('validates required metadata and dependency syntax without losing ranges', () => {
     for (const overrides of [
       { author_name: '' },
-      { requires_php: '' },
       { requires_fossbilling: '' },
       { type: 'mod' },
-      { source_type: 'ftp' },
+      { source_url: 'ftp://example.test/source' },
       { requires_modules: 'bad/name: ^1' },
       { requires_modules: 'branding: ^1\nbranding: ^2' },
     ] satisfies Record<string, string>[])
@@ -262,3 +281,10 @@ it('safely echoes blank new-extension and release submissions', () => {
   });
   expect(echo.releaseDraft).toEqual(echoReleaseDraftFromForm(form));
 });
+
+it('infers the source host from the single URL field', () => {
+  const payload = buildExtensionCreatePayload(
+    extensionForm({ source_url: 'https://gitlab.com/example/source' }),
+  );
+  expect(payload.source).toEqual({ type: 'gitlab', repo: 'example/source' });
+});
diff --git a/test/extension-view.test.ts b/test/extension-view.test.ts
new file mode 100644
index 00000000..24b43476
--- /dev/null
+++ b/test/extension-view.test.ts
@@ -0,0 +1,112 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const mocks = vi.hoisted(() => ({
+  getOwnDeveloper: vi.fn(),
+  getMyExtension: vi.fn(),
+  getExtensionById: vi.fn(),
+  createApiClient: vi.fn(),
+}));
+vi.mock('@/lib/api/client', async (original) => ({
+  ...(await original<typeof import('@/lib/api/client')>()),
+  createApiClient: mocks.createApiClient,
+  getExtensionById: mocks.getExtensionById,
+}));
+import { loadExtensionView } from '@/lib/extension-view';
+import { ApiRequestError } from '@/lib/api/client';
+import { makeEnv } from './helpers/env';
+const env = makeEnv();
+const user = { sub: 'owner', name: 'Owner', email: 'owner@example.test' };
+const published = { id: 'sample', name: 'Published' };
+const owned = {
+  id: 'sample',
+  developer: { id: 'my-profile' },
+  published,
+  pending_revision: { content: { name: 'Private pending' } },
+};
+beforeEach(() => {
+  vi.resetAllMocks();
+  mocks.createApiClient.mockReturnValue(mocks);
+  mocks.getOwnDeveloper.mockResolvedValue({ id: 'my-profile' });
+  mocks.getMyExtension.mockResolvedValue(owned);
+  mocks.getExtensionById.mockResolvedValue(published);
+});
+describe('permission-aware extension view', () => {
+  it('uses only the public read for anonymous visitors', async () => {
+    expect(await loadExtensionView(env, 'sample', null)).toEqual({
+      kind: 'public',
+      extension: published,
+    });
+    expect(mocks.createApiClient).not.toHaveBeenCalled();
+  });
+  it('enables editing only for the API-verified owner', async () => {
+    expect(await loadExtensionView(env, 'sample', user)).toEqual({
+      kind: 'owner',
+      owned,
+      userId: user.sub,
+    });
+    expect(mocks.createApiClient).toHaveBeenCalledWith(env, user.sub);
+    expect(mocks.getExtensionById).not.toHaveBeenCalled();
+  });
+  it('allows an owner to view a first submission without a public listing', async () => {
+    mocks.getMyExtension.mockResolvedValue({ ...owned, published: null });
+    expect((await loadExtensionView(env, 'sample', user)).kind).toBe('owner');
+    expect(mocks.getExtensionById).not.toHaveBeenCalled();
+  });
+  it('does not grant editing from a moderator cookie flag', async () => {
+    mocks.getOwnDeveloper.mockResolvedValue(null);
+    expect(
+      await loadExtensionView(env, 'sample', { ...user, is_moderator: true }),
+    ).toEqual({ kind: 'public', extension: published });
+    expect(mocks.getMyExtension).not.toHaveBeenCalled();
+  });
+  it('does not mistake a moderator-readable record for an owned extension', async () => {
+    mocks.getMyExtension.mockResolvedValue({
+      ...owned,
+      developer: { id: 'someone-else' },
+    });
+    expect(await loadExtensionView(env, 'sample', user)).toEqual({
+      kind: 'public',
+      extension: published,
+    });
+  });
+  it.each([403, 404])(
+    'falls back to public content when the account/profile is unavailable (%s)',
+    async (status) => {
+      mocks.getOwnDeveloper.mockRejectedValue(
+        new ApiRequestError(status, 'FORBIDDEN', 'Unavailable'),
+      );
+      expect((await loadExtensionView(env, 'sample', user)).kind).toBe(
+        'public',
+      );
+    },
+  );
+  it('falls back to public content for another developer’s extension', async () => {
+    mocks.getMyExtension.mockRejectedValue(
+      new ApiRequestError(404, 'NOT_FOUND', 'Not owned'),
+    );
+    expect(await loadExtensionView(env, 'sample', user)).toEqual({
+      kind: 'public',
+      extension: published,
+    });
+  });
+  it('keeps unpublished content inaccessible to unrelated visitors', async () => {
+    mocks.getOwnDeveloper.mockResolvedValue(null);
+    mocks.getExtensionById.mockRejectedValue(
+      new ApiRequestError(404, 'NOT_FOUND', 'Not published'),
+    );
+    await expect(loadExtensionView(env, 'sample', user)).rejects.toMatchObject({
+      status: 404,
+    });
+  });
+  it.each(['getOwnDeveloper', 'getMyExtension'] as const)(
+    'keeps %s outages retryable rather than hiding owner controls',
+    async (method) => {
+      mocks[method].mockRejectedValue(
+        new ApiRequestError(503, 'SERVICE_UNAVAILABLE', 'Offline'),
+      );
+      await expect(
+        loadExtensionView(env, 'sample', user),
+      ).rejects.toMatchObject({ status: 503 });
+      expect(mocks.getExtensionById).not.toHaveBeenCalled();
+    },
+  );
+});
diff --git a/test/license.test.ts b/test/license.test.ts
new file mode 100644
index 00000000..e43ff00a
--- /dev/null
+++ b/test/license.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+import { licenseUrl } from '@/lib/license';
+
+describe('license links', () => {
+  it('links manifest SPDX license strings directly', () => {
+    expect(licenseUrl('MIT')).toBe('https://spdx.org/licenses/MIT.html');
+    expect(licenseUrl('MIT OR Apache-2.0')).toBeUndefined();
+  });
+  it('prefers a supplied License URL over the SPDX page', () => {
+    expect(
+      licenseUrl({
+        name: 'MIT',
+        spdx_id: 'MIT',
+        URL: 'https://example.test/license',
+      }),
+    ).toBe('https://example.test/license');
+  });
+  it('falls back to the SPDX page', () => {
+    expect(licenseUrl({ name: 'MIT License', spdx_id: 'MIT' })).toBe(
+      'https://spdx.org/licenses/MIT.html',
+    );
+  });
+  it('leaves a custom license without a URL unlinked', () => {
+    expect(licenseUrl({ name: 'Custom License' })).toBeUndefined();
+  });
+  it('does not infer an SPDX identifier from a license name', () => {
+    expect(licenseUrl({ name: 'MIT' })).toBeUndefined();
+  });
+  it('rejects unsafe URLs and unknown identifiers', () => {
+    expect(
+      licenseUrl({
+        name: 'License',
+        URL: 'javascript:alert(1)',
+        spdx_id: '../../unexpected',
+      }),
+    ).toBeUndefined();
+    expect(
+      licenseUrl({ name: 'MIT', URL: 'javascript:alert(1)', spdx_id: 'MIT' }),
+    ).toBe('https://spdx.org/licenses/MIT.html');
+    expect(licenseUrl(undefined)).toBeUndefined();
+  });
+});
diff --git a/test/middleware.test.ts b/test/middleware.test.ts
new file mode 100644
index 00000000..ff8ea5f5
--- /dev/null
+++ b/test/middleware.test.ts
@@ -0,0 +1,70 @@
+import type { APIContext } from 'astro';
+import { describe, expect, it, vi } from 'vitest';
+vi.mock('astro:middleware', () => ({
+  defineMiddleware: (handler: unknown) => handler,
+}));
+vi.mock('@/platform/cloudflare', () => ({
+  getApplicationEnv: () => ({}),
+  getRequestTimeZone: () => 'UTC',
+}));
+import { onRequest } from '@/middleware';
+function context(path: string) {
+  return {
+    url: new URL(path, 'https://extensions.example.test'),
+    request: new Request('https://extensions.example.test' + path),
+    locals: {},
+  } as APIContext;
+}
+describe('personalized extension HTML caching', () => {
+  it.each([200, 404, 503])(
+    'prevents shared and browser caching, including rewritten/error responses (%s)',
+    async (status) => {
+      const response = await onRequest(
+        context('/extension/example'),
+        async () =>
+          new Response('content', {
+            status,
+            headers: {
+              'Cloudflare-CDN-Cache-Control': 'public, max-age=60',
+              'Cache-Control': 'public, max-age=60',
+            },
+          }),
+      );
+      if (!response) throw new Error('Expected a response');
+      expect(response.headers.get('Cache-Control')).toBe('private, no-store');
+      expect(response.headers.get('Cloudflare-CDN-Cache-Control')).toBe(
+        'no-store',
+      );
+      expect(response.status).toBe(status);
+    },
+  );
+  it('also protects immutable redirect responses', async () => {
+    const response = await onRequest(
+      context('/extension/example/withdraw'),
+      async () => Response.redirect('https://extensions.example.test/account'),
+    );
+    if (!response) throw new Error('Expected a response');
+    expect(response.headers.get('Cache-Control')).toBe('private, no-store');
+    expect(response.headers.get('X-Frame-Options')).toBe('DENY');
+    expect(response.headers.get('Cloudflare-CDN-Cache-Control')).toBe(
+      'no-store',
+    );
+    expect(response.status).toBe(302);
+    expect(response.headers.get('Location')).toBe(
+      'https://extensions.example.test/account',
+    );
+  });
+  it('preserves extension directory page caching', async () => {
+    const response = await onRequest(
+      context('/'),
+      async () =>
+        new Response('extensions', {
+          headers: { 'Cloudflare-CDN-Cache-Control': 'public, max-age=120' },
+        }),
+    );
+    if (!response) throw new Error('Expected a response');
+    expect(response.headers.get('Cloudflare-CDN-Cache-Control')).toBe(
+      'public, max-age=120',
+    );
+  });
+});
diff --git a/test/releases.test.ts b/test/releases.test.ts
new file mode 100644
index 00000000..792944e7
--- /dev/null
+++ b/test/releases.test.ts
@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest';
+import { latestRelease, releasesDescending } from '@/lib/releases';
+import type { Release } from '@/types';
+
+function release(tag: string, date = '2026-01-01'): Release {
+  return {
+    tag,
+    date,
+    download_url: `https://example.test/${tag}.zip`,
+    requires: { fossbilling: '>=0.7.0', php: '>=8.3' },
+  };
+}
+
+describe('automatic latest release', () => {
+  it('uses semantic version order rather than date, insertion order, or lexical order', () => {
+    const releases = [
+      release('1.9.0', '2026-11-01'),
+      release('v1.10.0', '2026-01-01'),
+      release('1.2.0', '2026-12-01'),
+    ];
+    expect(latestRelease(releases)?.tag).toBe('v1.10.0');
+    expect(releasesDescending(releases).map((item) => item.tag)).toEqual([
+      'v1.10.0',
+      '1.9.0',
+      '1.2.0',
+    ]);
+    expect(releases[0].tag).toBe('1.9.0');
+  });
+  it('handles prereleases using semantic version precedence', () => {
+    expect(
+      latestRelease([
+        release('2.0.0-beta.2'),
+        release('2.0.0'),
+        release('2.0.0-beta.10'),
+      ])?.tag,
+    ).toBe('2.0.0');
+    expect(
+      latestRelease([release('2.0.0-beta.2'), release('2.0.0-beta.10')])?.tag,
+    ).toBe('2.0.0-beta.10');
+  });
+  it('uses release dates when no tags are semantic versions', () => {
+    expect(
+      latestRelease([
+        release('earlier', '2026-01-01'),
+        release('later', '2026-02-01'),
+        release('unknown', 'invalid'),
+      ])?.tag,
+    ).toBe('later');
+  });
+  it('prefers versioned releases when mixed with unversioned historical tags', () => {
+    expect(
+      latestRelease([
+        release('nightly', '2026-12-01'),
+        release('v1.0.0', '2026-01-01'),
+      ])?.tag,
+    ).toBe('v1.0.0');
+  });
+  it('handles empty lists and unparseable legacy dates deterministically', () => {
+    expect(latestRelease([])).toBeUndefined();
+    expect(
+      latestRelease([release('first', 'invalid'), release('second', 'invalid')])
+        ?.tag,
+    ).toBe('first');
+  });
+});
diff --git a/test/repository.test.ts b/test/repository.test.ts
new file mode 100644
index 00000000..5fd32fbc
--- /dev/null
+++ b/test/repository.test.ts
@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest';
+import { parseRepositoryUrl, repositoryFromFields } from '@/lib/repository';
+
+describe('Source URL detection', () => {
+  it.each([
+    [
+      'https://github.com/FOSSBilling/example',
+      { type: 'github', repo: 'FOSSBilling/example' },
+    ],
+    [
+      'https://WWW.GITHUB.COM/FOSSBilling/example.git/?tab=readme#usage',
+      { type: 'github', repo: 'FOSSBilling/example' },
+    ],
+    [
+      'https://gitlab.com/group/subgroup/project.git',
+      { type: 'gitlab', repo: 'group/subgroup/project' },
+    ],
+    [
+      'https://code.example.test/team/project',
+      { type: 'custom', repo: 'https://code.example.test/team/project' },
+    ],
+    [
+      'http://code.example.test/project',
+      { type: 'custom', repo: 'http://code.example.test/project' },
+    ],
+    [
+      'https://github.com.evil.test/team/project',
+      { type: 'custom', repo: 'https://github.com.evil.test/team/project' },
+    ],
+    [
+      'https://github.com:8443/team/project',
+      { type: 'custom', repo: 'https://github.com:8443/team/project' },
+    ],
+  ])('detects and normalizes %s', (input, expected) => {
+    expect(parseRepositoryUrl(input)).toEqual(expected);
+  });
+  it.each([
+    '',
+    'owner/project',
+    'git@github.com:owner/project.git',
+    'javascript:alert(1)',
+    'ftp://example.test/project',
+    'https://user:secret@github.com/owner/project',
+  ])('rejects an invalid or ambiguous source: %s', (input) => {
+    expect(parseRepositoryUrl(input)).toBeNull();
+  });
+  it.each([
+    'https://github.com/owner',
+    'https://github.com/owner/project/tree/main',
+    'https://gitlab.com/group/project/-/tree/main',
+    'https://github.com/owner/%2fproject',
+    'https://github.com/owner/.git',
+  ])('preserves non-repository host paths as custom sources: %s', (url) => {
+    expect(parseRepositoryUrl(url)).toEqual({ type: 'custom', repo: url });
+  });
+  it('enforces the stored repository limit after host detection', () => {
+    const prefix = 'https://code.example.test/';
+    expect(
+      parseRepositoryUrl(prefix + 'a'.repeat(500 - prefix.length))?.repo,
+    ).toHaveLength(500);
+    expect(
+      parseRepositoryUrl(prefix + 'a'.repeat(501 - prefix.length)),
+    ).toBeNull();
+    const repo = 'owner/' + 'a'.repeat(494);
+    expect(parseRepositoryUrl('https://github.com/' + repo)).toEqual({
+      type: 'github',
+      repo,
+    });
+    expect(parseRepositoryUrl('https://github.com/' + repo + 'a')).toBeNull();
+  });
+  it('reads the source URL from form fields', () => {
+    expect(
+      repositoryFromFields({ source_url: 'https://gitlab.com/group/project' }),
+    ).toEqual({ type: 'gitlab', repo: 'group/project' });
+    expect(repositoryFromFields({ source_url: '' })).toBeNull();
+    expect(repositoryFromFields({})).toBeNull();
+  });
+});
diff --git a/test/requirements.test.ts b/test/requirements.test.ts
new file mode 100644
index 00000000..86723f37
--- /dev/null
+++ b/test/requirements.test.ts
@@ -0,0 +1,13 @@
+import { expect, it } from 'vitest';
+import { compatibilityLabel } from '@/lib/requirements';
+
+it.each([
+  ['>=0.7.0', '0.7.0 or Later'],
+  ['>= 8.3', '8.3 or Later'],
+  ['>=8.3 <9', '>=8.3 <9'],
+  ['^0.8.9 || ^1.0', '^0.8.9 || ^1.0'],
+  ['~8.3', '~8.3'],
+  ['>=8.4-beta', '>=8.4-beta'],
+])('presents %s without changing constraint semantics', (range, expected) => {
+  expect(compatibilityLabel(range)).toBe(expected);
+});