The public com.atproto.sync.getBlob and sync.listBlobs endpoints served any blob in the account's store, including a private repository's bundle chunks. They now refuse a blob that only space records reference; the authenticated com.atproto.space.getBlob remains the path to those. A blob between upload and its first reference stays served, which the public write flow needs, and the gap closes at the first reference. The repositories page now covers private repos the way GitHub covers its own. The listing shows space-held repos with a Private badge and space-form clone URLs; browsing reads their records and blobs from storage through a space reader the platform injects, since the account page is the owner's own surface. A New repository dialog picks visibility, creates the space behind a private repo (one space per repository by default, both fields editable), and shows the push commands. The repo page shows the space's member list with add by handle or DID and remove, backed by new account API endpoints and a SpaceAdminPort built by @pdsjs/spaces and injected by the node and cloudflare adapters. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>