diff --git a/docs/architecture/migration-progress.md b/docs/architecture/migration-progress.md
index 9a70094e0..f4774d2de 100644
--- a/docs/architecture/migration-progress.md
+++ b/docs/architecture/migration-progress.md
@@ -2624,6 +2624,22 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
     migration/layer guards, formatting, diff hygiene, Rust risk scan, branch
     freshness check, pre-commit quality gate, and three-expert review.
 
+- [x] `R-067` Narrow startup orchestration module visibility.
+  - Do: make internal startup orchestration modules crate-private while keeping
+    the binary entrypoint and existing compatibility/test-facing startup paths
+    public.
+  - Acceptance: `startup_entrypoint`, `startup_iam`, `startup_profiling`, and
+    `startup_optional_runtimes` keep their public paths, while fs-guard,
+    lifecycle, optional-runtime sidecars, preflight, protocols, runtime,
+    runtime hooks, server, services, shutdown, storage, and TLS material modules
+    are no longer public library modules.
+  - Must preserve: binary startup entrypoint access, embedded public API,
+    startup ordering, readiness behavior, optional runtime compatibility,
+    profiling compatibility, IAM test/debug hooks, and all log fields.
+  - Verification: RustFS lib and bin check, focused startup checks,
+    migration/layer guards, formatting, diff hygiene, Rust risk scan, branch
+    freshness check, pre-commit quality gate, and three-expert review.
+
 - [x] `E-001/E-SET-001` Add ECStore layout skeleton and set-layout boundary.
   - Do: create the ECStore internal layout ownership buckets and pin static set
     layout versus runtime `Sets`/`SetDisks` orchestration boundaries before any
@@ -2873,15 +2889,15 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
 
 | Expert | Status | Notes |
 |---|---|---|
-| Quality/architecture | passed | R-056 through R-066 keep startup services as orchestration while moving KMS, IAM facade, bucket metadata, notification, auth, background, observability, audit, deadlock, and embedded optional ownership to focused startup modules, then narrowing those internal owner modules to crate visibility. |
-| Migration preservation | passed | KMS singleton reuse/init behavior, embedded/main IAM wiring, bucket metadata migration/resync order, notification/auth/background/observability/audit/deadlock setup, readiness stages, public embedded API, and log behavior stay unchanged. |
+| Quality/architecture | passed | R-056 through R-067 keep startup services as orchestration while moving KMS, IAM facade, bucket metadata, notification, auth, background, observability, audit, deadlock, and embedded optional ownership to focused startup modules, then narrowing internal owner and orchestration modules to crate visibility. |
+| Migration preservation | passed | KMS singleton reuse/init behavior, embedded/main IAM wiring, bucket metadata migration/resync order, notification/auth/background/observability/audit/deadlock setup, readiness stages, public embedded API, startup compatibility paths, and log behavior stay unchanged. |
 | Testing/verification | passed | Focused startup IAM/KMS/service/notification/audit checks, RustFS lib/bin check, architecture/layer/unsafe guards, formatting, diff hygiene, Rust risk scan, and pre-commit gate passed. |
 
 ## Verification Notes
 
 Passed before push:
 
-- Issue #660 R-056/R-066 current slice:
+- Issue #660 R-056/R-067 current slice:
   - `cargo test -p rustfs --lib startup_kms -- --nocapture`: passed; 2
     tests.
   - `cargo test -p rustfs --lib startup_iam -- --nocapture`: passed; 8
diff --git a/rustfs/src/lib.rs b/rustfs/src/lib.rs
index 36fdd72f8..63c842c7e 100644
--- a/rustfs/src/lib.rs
+++ b/rustfs/src/lib.rs
@@ -76,23 +76,23 @@ pub(crate) mod startup_deadlock;
 pub(crate) mod startup_embedded;
 pub(crate) mod startup_embedded_optional;
 pub mod startup_entrypoint;
-pub mod startup_fs_guard;
+pub(crate) mod startup_fs_guard;
 pub mod startup_iam;
-pub mod startup_lifecycle;
+pub(crate) mod startup_lifecycle;
 pub(crate) mod startup_notification;
 pub(crate) mod startup_observability;
-pub mod startup_optional_runtime_sidecars;
+pub(crate) mod startup_optional_runtime_sidecars;
 pub mod startup_optional_runtimes;
-pub mod startup_preflight;
+pub(crate) mod startup_preflight;
 pub mod startup_profiling;
-pub mod startup_protocols;
-pub mod startup_runtime;
-pub mod startup_runtime_hooks;
-pub mod startup_server;
-pub mod startup_services;
-pub mod startup_shutdown;
-pub mod startup_storage;
-pub mod startup_tls_material;
+pub(crate) mod startup_protocols;
+pub(crate) mod startup_runtime;
+pub(crate) mod startup_runtime_hooks;
+pub(crate) mod startup_server;
+pub(crate) mod startup_services;
+pub(crate) mod startup_shutdown;
+pub(crate) mod startup_storage;
+pub(crate) mod startup_tls_material;
 pub mod storage;
 pub(crate) mod storage_compat;
 pub(crate) mod table_catalog;