diff --git a/swarm-controller/src/status.rs b/swarm-controller/src/status.rs
index 5090cd7a..92e89f78 100644
--- a/swarm-controller/src/status.rs
+++ b/swarm-controller/src/status.rs
@@ -102,8 +102,14 @@ pub struct HiveStatus {
 }
 
 /// A snapshot as retained by the bucket.
+///
+/// `pub(crate)`, matching [`render`] and [`row`] below: a private struct
+/// used in a `pub(crate)` function's signature is a rustc
+/// `private_interfaces` warning (promoted to an error by this workspace's
+/// lints), since something outside this module could otherwise see a type
+/// it can't name.
 #[derive(Clone, Debug)]
-struct Offered {
+pub(crate) struct Offered {
     received_at: SystemTime,
     /// `None` when the stored bytes are not JSON — see [`HiveStatus::snapshot`].
     payload: Option<serde_json::Value>,
@@ -260,7 +266,14 @@ fn to_system_time(unix_seconds: i64) -> SystemTime {
 /// rule the acceptance criterion cares about lives, and keeping it a
 /// pure function means those rules are tested against a table rather
 /// than against a running NATS server.
-fn render(
+///
+/// `pub(crate)`, not private: `agent_status.rs`'s doc comments link to this
+/// by name, and an intra-doc link to a private item in another module
+/// doesn't resolve even under `cargo doc --document-private-items` (that
+/// flag controls rendering, not the link resolver's visibility check) — so
+/// the checked link this repo's `docs-rustdoc` CI enforces needs this to be
+/// at least crate-visible. Still invisible outside the crate.
+pub(crate) fn render(
     roster: &[HiveEntry],
     entries: &BTreeMap<String, Offered>,
     now: SystemTime,
@@ -300,7 +313,10 @@ fn render(
     rows
 }
 
-fn row(
+/// `pub(crate)` for the same reason as [`render`] above: `agent_status.rs`
+/// links to this by name and the link needs a crate-visible target to
+/// resolve.
+pub(crate) fn row(
     name: String,
     domain: Option<String>,
     offered: &Offered,