diff --git a/rust/crates/mxaccess-asb-nettcp/src/nmf.rs b/rust/crates/mxaccess-asb-nettcp/src/nmf.rs
index 6551509..85968cb 100644
--- a/rust/crates/mxaccess-asb-nettcp/src/nmf.rs
+++ b/rust/crates/mxaccess-asb-nettcp/src/nmf.rs
@@ -220,7 +220,7 @@ impl NmfRecord {
     }
 
     /// Encode to a fresh buffer. Convenience wrapper around
-    /// [`encode_into`].
+    /// [`Self::encode_into`].
     pub fn encode(&self) -> Result<Vec<u8>, NmfError> {
         let mut out = Vec::new();
         self.encode_into(&mut out)?;
diff --git a/rust/crates/mxaccess-callback/src/exporter.rs b/rust/crates/mxaccess-callback/src/exporter.rs
index d1b10fa..33594f0 100644
--- a/rust/crates/mxaccess-callback/src/exporter.rs
+++ b/rust/crates/mxaccess-callback/src/exporter.rs
@@ -18,10 +18,9 @@
 //! - `INmxSvcCallback` (IID `B49F92F7-C748-4169-8ECA-A0670B012746`,
 //!   `NmxProcedureMetadata.cs:6`) — opnums 3 (`DataReceived`),
 //!   4 (`StatusReceived`). The handler decodes the inbound buffer via
-//!   [`crate::nmx_callback_messages::parse_callback_request`] (re-export
-//!   from `mxaccess-rpc::nmx_callback_messages`), emits a typed event,
-//!   and returns the success response built by
-//!   [`crate::nmx_callback_messages::encode_callback_response`].
+//!   [`mxaccess_rpc::nmx_callback_messages::parse_callback_request`],
+//!   emits a typed event, and returns the success response built by
+//!   [`mxaccess_rpc::nmx_callback_messages::encode_callback_response`].
 //!
 //! Auth3 PDUs are accepted but ignored (`ManagedCallbackExporter.cs:133-137`)
 //! — NTLM packet integrity for inbound frames is not yet wired (open
diff --git a/rust/crates/mxaccess-codec/src/asb_variant.rs b/rust/crates/mxaccess-codec/src/asb_variant.rs
index 185155e..b4278bb 100644
--- a/rust/crates/mxaccess-codec/src/asb_variant.rs
+++ b/rust/crates/mxaccess-codec/src/asb_variant.rs
@@ -154,7 +154,7 @@ impl AsbVariant {
         }
     }
 
-    /// Standalone encode: convenience wrapper around [`encode_into`].
+    /// Standalone encode: convenience wrapper around [`Self::encode_into`].
     pub fn encode(&self) -> Vec<u8> {
         let mut out = Vec::with_capacity(self.wire_len());
         self.encode_into(&mut out);
diff --git a/rust/crates/mxaccess-codec/src/item_control.rs b/rust/crates/mxaccess-codec/src/item_control.rs
index 1655f6e..b24ac4d 100644
--- a/rust/crates/mxaccess-codec/src/item_control.rs
+++ b/rust/crates/mxaccess-codec/src/item_control.rs
@@ -2,7 +2,7 @@
 //!
 //! Direct port of `src/MxNativeCodec/NmxItemControlMessage.cs`. The body
 //! carries an advise-supervisory or unadvise command together with a 16-byte
-//! item correlation GUID and a 14-byte projection of an [`MxReferenceHandle`]
+//! item correlation GUID and a 14-byte projection of an [`crate::reference_handle::MxReferenceHandle`]
 //! (handle bytes 6..20 — `object_id` through `attribute_index`).
 //!
 //! ## Wire layout
@@ -87,7 +87,7 @@ const PAYLOAD_LENGTH: usize = 18; // cs:28 — 7×u16 + u32 tail = 18 bytes
 pub const DEFAULT_TAIL: u32 = 3;
 
 /// Decoded NMX item-control body. The fields after `item_correlation_id`
-/// project bytes 6..20 of an [`MxReferenceHandle`] — see
+/// project bytes 6..20 of an [`crate::reference_handle::MxReferenceHandle`] — see
 /// `NmxItemControlMessage.cs:71-81, 134-141`.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub struct NmxItemControlMessage {
diff --git a/rust/crates/mxaccess-codec/src/metadata_query.rs b/rust/crates/mxaccess-codec/src/metadata_query.rs
index 79ca782..56a7727 100644
--- a/rust/crates/mxaccess-codec/src/metadata_query.rs
+++ b/rust/crates/mxaccess-codec/src/metadata_query.rs
@@ -1,7 +1,7 @@
 //! `NmxMetadataQueryMessage` — observed pre-advise metadata-query body.
 //!
 //! Direct port of `src/MxNativeCodec/NmxMetadataQueryMessage.cs`. The .NET
-//! reference exposes a single static helper, [`encode_observed_pre_advise`],
+//! reference exposes a single static helper, `encode_observed_pre_advise`,
 //! which returns a fixed observed body with a 16-byte item-correlation GUID
 //! patched in at offset `0x8a`.
 //!
diff --git a/rust/crates/mxaccess-codec/src/observed_write_template.rs b/rust/crates/mxaccess-codec/src/observed_write_template.rs
index 7c15e8a..b181405 100644
--- a/rust/crates/mxaccess-codec/src/observed_write_template.rs
+++ b/rust/crates/mxaccess-codec/src/observed_write_template.rs
@@ -44,7 +44,7 @@
 //! `Encode` (`.cs:51-64`) writes:
 //!
 //! 1. The captured prefix (`_prefix`, raw bytes) — preserved verbatim.
-//! 2. The freshly-encoded value bytes from [`encode_value`].
+//! 2. The freshly-encoded value bytes from `encode_value_bytes`.
 //! 3. The captured suffix (`_suffixBeforeWriteIndex`) — preserved verbatim.
 //! 4. The fresh `writeIndex` as i32 LE in the trailing 4 bytes.
 //!
@@ -167,12 +167,12 @@ impl ObservedWriteBodyTemplate {
         }
     }
 
-    /// Captured opcode at body[0]. Mirrors `_prefix[0]`.
+    /// Captured opcode at `body[0]`. Mirrors `_prefix[0]`.
     pub fn command(&self) -> u8 {
         self.command
     }
 
-    /// Captured wire-kind byte at body[17]. Drawn from the captured prefix,
+    /// Captured wire-kind byte at `body[17]`. Drawn from the captured prefix,
     /// not from the runtime [`MxValueKind`] (which can disambiguate
     /// String vs DateTime past the encoder collapse).
     pub fn wire_kind(&self) -> u8 {
diff --git a/rust/crates/mxaccess-codec/src/reference_handle.rs b/rust/crates/mxaccess-codec/src/reference_handle.rs
index 84d6e93..61e0db3 100644
--- a/rust/crates/mxaccess-codec/src/reference_handle.rs
+++ b/rust/crates/mxaccess-codec/src/reference_handle.rs
@@ -34,8 +34,9 @@ const CRC16_IBM_POLYNOMIAL: u16 = 0xa001;
 ///
 /// `object_signature` and `attribute_signature` are derived values. The Rust
 /// port keeps them private — the only constructor that produces a handle from
-/// names is [`from_names`]; the only mutators that update one signature are
-/// [`with_object_tag_name`] and [`with_attribute_name`], which both
+/// names is [`MxReferenceHandle::from_names`]; the only mutators that update
+/// one signature are [`MxReferenceHandle::with_object_tag_name`] and
+/// [`MxReferenceHandle::with_attribute_name`], which both
 /// recompute. This is a deliberate tightening over the .NET reference (which
 /// is a record with public init-only signature fields).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
@@ -157,7 +158,7 @@ impl MxReferenceHandle {
     /// # Panics
     ///
     /// Panics if `destination.len() < 20`. Use a 20-byte slice or call
-    /// [`encode`] for a fresh buffer.
+    /// [`Self::encode`] for a fresh buffer.
     pub fn write_to(self, destination: &mut [u8]) {
         assert!(
             destination.len() >= Self::ENCODED_LEN,
diff --git a/rust/crates/mxaccess-codec/src/write_message.rs b/rust/crates/mxaccess-codec/src/write_message.rs
index 94d602b..0ae3483 100644
--- a/rust/crates/mxaccess-codec/src/write_message.rs
+++ b/rust/crates/mxaccess-codec/src/write_message.rs
@@ -72,8 +72,8 @@
 //! 28..    payload
 //! ```
 //!
-//! The encoder writes `count` (u16) at body[22] and `element_width` (u16) at
-//! body[24]. The decoder/subscription side reads `element_width` as `i32` at
+//! The encoder writes `count` (u16) at `body[22]` and `element_width` (u16) at
+//! `body[24]`. The decoder/subscription side reads `element_width` as `i32` at
 //! a different offset — that asymmetry is documented in the subscription
 //! message module, not here. Encoder element widths are 2/4/4/8 for
 //! Boolean/Int32/Float32/Float64 arrays; for variable arrays (String,
diff --git a/rust/crates/mxaccess-nmx/src/client.rs b/rust/crates/mxaccess-nmx/src/client.rs
index eddbd05..b14cda3 100644
--- a/rust/crates/mxaccess-nmx/src/client.rs
+++ b/rust/crates/mxaccess-nmx/src/client.rs
@@ -88,7 +88,7 @@ pub enum NmxClientError {
 
     /// The metadata's `(mx_data_type, is_array)` pair has no LMX wire
     /// encoding (e.g. arrays of `ElapsedTime`, scalars of
-    /// `ReferenceType`). Returned by [`NmxClient::resolve_write_kind`]
+    /// `ReferenceType`). Returned by [`GalaxyTagMetadata::resolve_write_kind`]
     /// helpers when the caller asks for a kind that
     /// [`mxaccess_codec::MxValueKind::for_data_type`] rejects.
     /// Mirrors the `ArgumentOutOfRangeException` paths in the .NET
@@ -530,7 +530,7 @@ impl NmxClient {
     }
 
     /// `INmxService2::RemoveSubscriberEngine` (opnum 8). Mirrors
-    /// `cs:137-147`. Same wire shape as [`add_subscriber_engine`].
+    /// `cs:137-147`. Same wire shape as [`Self::add_subscriber_engine`].
     ///
     /// # Errors
     /// Transport or codec.
diff --git a/rust/crates/mxaccess-rpc/src/pdu.rs b/rust/crates/mxaccess-rpc/src/pdu.rs
index d343c34..ef7a781 100644
--- a/rust/crates/mxaccess-rpc/src/pdu.rs
+++ b/rust/crates/mxaccess-rpc/src/pdu.rs
@@ -539,7 +539,7 @@ impl BindPdu {
 
     /// Encode the Bind / AlterContext PDU. Returns the wire bytes
     /// (`DceRpcPdu.cs:264-290`). Sets `frag_length` and `auth_length=0` on
-    /// the encoded header — to attach an auth verifier use [`encode_with_auth`].
+    /// the encoded header — to attach an auth verifier use [`Self::encode_with_auth`].
     pub fn encode(&self) -> Vec<u8> {
         let length: usize = BIND_BODY_OFFSET
             + self
@@ -955,7 +955,7 @@ impl BindAckPdu {
 ///
 /// The .NET `Encode` (`DceRpcPdu.cs:118-124`) defaults `packet_flags` to
 /// `0x03` (PFC_FIRST_FRAG | PFC_LAST_FRAG) only when the supplied flags are
-/// 0; the Rust port keeps the same exact behaviour in [`encode`].
+/// 0; the Rust port keeps the same exact behaviour in [`RequestPdu::encode`].
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RequestPdu {
     pub header: PduHeader,
@@ -1081,7 +1081,7 @@ pub struct ResponsePdu {
 
 impl ResponsePdu {
     /// Decode a Response PDU (`DceRpcPdu.cs:141-168`). The .NET reference
-    /// has no encoder for Response — the Rust port adds [`encode`] for tests
+    /// has no encoder for Response — the Rust port adds [`Self::encode`] for tests
     /// and round-trip use.
     pub fn decode(buf: &[u8]) -> Result<Self, RpcError> {
         let header = PduHeader::decode(buf)?;
diff --git a/rust/crates/mxaccess/src/asb_session.rs b/rust/crates/mxaccess/src/asb_session.rs
index d67dc9f..5ea9523 100644
--- a/rust/crates/mxaccess/src/asb_session.rs
+++ b/rust/crates/mxaccess/src/asb_session.rs
@@ -21,14 +21,15 @@
 //! Implements:
 //! * [`AsbSession::connect`] — TCP connect → preamble → DH handshake
 //!   → ready session.
-//! * [`AsbSession::register_items`] / [`unregister_items`] /
-//!   [`read`] / [`write`] — per-operation thin async wrappers.
-//! * [`AsbSession::keep_alive`] / [`disconnect`] / [`shutdown`] —
-//!   lifecycle.
+//! * [`AsbSession::register_items`] / [`AsbSession::unregister_items`] /
+//!   [`AsbSession::read`] / [`AsbSession::write`] — per-operation thin
+//!   async wrappers.
+//! * [`AsbSession::keep_alive`] / [`AsbSession::disconnect`] /
+//!   `AsbSession::shutdown` — lifecycle.
 //! * [`AsbSession::create_subscription`] /
-//!   [`add_monitored_items`] / [`publish`] /
-//!   [`delete_monitored_items`] / [`delete_subscription`] —
-//!   subscription primitives.
+//!   [`AsbSession::add_monitored_items`] / [`AsbSession::publish`] /
+//!   [`AsbSession::delete_monitored_items`] /
+//!   [`AsbSession::delete_subscription`] — subscription primitives.
 //! * [`AsbSession::subscribe`] — returns an [`AsbSubscription`]
 //!   `Stream<Item = Result<MonitoredItemValue, Error>>` driven by a
 //!   background publish-loop. Drop of the stream aborts the loop.
diff --git a/rust/crates/mxaccess/src/lib.rs b/rust/crates/mxaccess/src/lib.rs
index c38f6b0..4379403 100644
--- a/rust/crates/mxaccess/src/lib.rs
+++ b/rust/crates/mxaccess/src/lib.rs
@@ -397,8 +397,8 @@ impl Session {
     }
 
     /// Write a value to a tag (`MxValue` overload). Delegates to
-    /// [`Self::write_value`] after converting `value` via
-    /// [`mxvalue_to_writevalue`].
+    /// [`Self::write_value`] after converting `value` via the private
+    /// `mxvalue_to_writevalue` helper.
     ///
     /// # Errors
     /// As for [`Self::write_value`], plus
diff --git a/rust/crates/mxaccess/src/session.rs b/rust/crates/mxaccess/src/session.rs
index 92b2f29..a6411f7 100644
--- a/rust/crates/mxaccess/src/session.rs
+++ b/rust/crates/mxaccess/src/session.rs
@@ -119,7 +119,7 @@ const CALLBACK_BROADCAST_CAPACITY: usize = 256;
 /// ## Lag behavior
 ///
 /// The underlying broadcast channel has a fixed capacity
-/// ([`CALLBACK_BROADCAST_CAPACITY`]). Slow consumers that fall behind
+/// (`CALLBACK_BROADCAST_CAPACITY`). Slow consumers that fall behind
 /// receive `Some(Err(Error::Configuration(InvalidArgument)))` whose
 /// detail string contains the lag-loss count. The stream stays open
 /// and resumes from the next available message — same shape as
@@ -449,7 +449,7 @@ impl Session {
     /// `(host, port, service_ipid)` before `RegisterEngine2`. This
     /// constructor takes the resolved triple by hand — useful for
     /// tests, deterministic probes, and non-Windows builds. Use
-    /// [`Self::connect_nmx_auto`] (Windows + `windows-com` feature) to
+    /// `Self::connect_nmx_auto` (Windows + `windows-com` feature) to
     /// drive the auto-resolving path.
     ///
     /// On success: a `RegisterEngine2` round-trip has completed and the
@@ -650,7 +650,7 @@ impl Session {
     /// `RecoverConnectionCore` (`cs:442-474`).
     ///
     /// Per attempt: emit [`RecoveryEvent::Started`], invoke
-    /// [`recover_connection_core`](Self::recover_connection_core) (rebuild
+    /// the private `recover_connection_core` helper (rebuild
     /// the NMX transport via the installed [`RebuildFactory`], re-run
     /// `RegisterEngine2` with the saved callback OBJREF, replay every
     /// active subscription's `AdviseSupervisory`, atomically swap the
@@ -821,7 +821,7 @@ impl Session {
     /// This accessor is the test seam + escape hatch consumers can use
     /// today to observe the raw stream.
     ///
-    /// Receivers can lag by up to [`CALLBACK_BROADCAST_CAPACITY`]
+    /// Receivers can lag by up to `CALLBACK_BROADCAST_CAPACITY`
     /// messages before the broadcast channel starts dropping; lagged
     /// receivers see [`tokio::sync::broadcast::error::RecvError::Lagged`].
     #[must_use]