Extract cpds-protocol, support atomic applyWrites, and split repository, Space, identity, and database responsibilities. Repair OAuth redemption and schema upgrades, restrict blob visibility, and document the cleanup and verification evidence.