diff --git a/rust/cpp.rs b/rust/cpp.rs
index 66f6508c2b..2b5359c04d 100644
--- a/rust/cpp.rs
+++ b/rust/cpp.rs
@@ -12,16 +12,16 @@ use crate::{
     IntoProxied, Map, MapIter, Mut, ProtoBytes, ProtoStr, ProtoString, Proxied, ProxiedInMapValue,
     ProxiedInRepeated, Repeated, RepeatedMut, RepeatedView, View,
 };
-use core::fmt::Debug;
 use paste::paste;
-use std::convert::identity;
-use std::ffi::{c_int, c_void};
 use std::fmt;
+use std::slice;
+use std::convert::identity;
+use core::fmt::Debug;
 use std::marker::PhantomData;
-use std::mem::{ManuallyDrop, MaybeUninit};
 use std::ops::Deref;
 use std::ptr::{self, NonNull};
-use std::slice;
+use std::ffi::{c_int, c_void};
+use std::mem::{ManuallyDrop, MaybeUninit};
 
 /// Defines a set of opaque, unique, non-accessible pointees.
 ///
@@ -29,6 +29,7 @@ use std::slice;
 /// though this should use [`extern type`] when that is stabilized.
 /// [nomicon]: https://doc.rust-lang.org/nomicon/ffi.html#representing-opaque-structs
 /// [`extern type`]: https://github.com/rust-lang/rust/issues/43467
+#[doc(hidden)]
 mod _opaque_pointees {
     /// Opaque pointee for [`RawMessage`]
     ///
@@ -78,19 +79,24 @@ mod _opaque_pointees {
 }
 
 /// A raw pointer to the underlying message for this runtime.
+#[doc(hidden)]
 pub type RawMessage = NonNull<_opaque_pointees::RawMessageData>;
 
 /// A raw pointer to the underlying repeated field container for this runtime.
+#[doc(hidden)]
 pub type RawRepeatedField = NonNull<_opaque_pointees::RawRepeatedFieldData>;
 
 /// A raw pointer to the underlying arena for this runtime.
+#[doc(hidden)]
 pub type RawMap = NonNull<_opaque_pointees::RawMapData>;
 
 /// A raw pointer to a std::string.
+#[doc(hidden)]
 pub type CppStdString = NonNull<_opaque_pointees::CppStdStringData>;
 
 /// Kernel-specific owned `string` and `bytes` field type.
 #[derive(Debug)]
+#[doc(hidden)]
 pub struct InnerProtoString {
     owned_ptr: CppStdString,
 }
@@ -124,14 +130,14 @@ impl InnerProtoString {
         unsafe { proto2_rust_cpp_string_to_view(self.owned_ptr).as_ref() }
     }
 
-    pub fn into_raw(self, _private: Private) -> CppStdString {
+    pub fn into_raw(self) -> CppStdString {
         let s = ManuallyDrop::new(self);
         s.owned_ptr
     }
 
     /// # Safety
     ///  - `src` points to a valid CppStdString.
-    pub unsafe fn from_raw(_private: Private, src: CppStdString) -> InnerProtoString {
+    pub unsafe fn from_raw(src: CppStdString) -> InnerProtoString {
         InnerProtoString { owned_ptr: src }
     }
 }
@@ -161,6 +167,7 @@ extern "C" {
 /// null data pointer to be invalid.
 #[repr(C)]
 #[derive(Copy, Clone)]
+#[doc(hidden)]
 pub struct PtrAndLen {
     /// Pointer to the first byte.
     /// Borrows the memory.
@@ -216,7 +223,7 @@ pub struct SerializedData {
 }
 
 impl SerializedData {
-    pub fn new(_private: Private) -> Self {
+    pub fn new() -> Self {
         Self { data: NonNull::dangling(), len: 0 }
     }
 
@@ -296,6 +303,7 @@ impl fmt::Debug for SerializedData {
 ///   * `.data` contains exactly `.len` bytes.
 ///   * The empty string is represented as `.data.is_null() == true`.
 #[repr(C)]
+#[doc(hidden)]
 pub struct RustStringRawParts {
     data: *const u8,
     len: usize,
@@ -321,7 +329,7 @@ extern "C" {
     fn proto2_rust_utf8_debug_string(msg: RawMessage) -> RustStringRawParts;
 }
 
-pub fn debug_string(_private: Private, msg: RawMessage, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+pub fn debug_string(msg: RawMessage, f: &mut fmt::Formatter<'_>) -> fmt::Result {
     // SAFETY:
     // - `msg` is a valid protobuf message.
     let dbg_str: String = unsafe { proto2_rust_utf8_debug_string(msg) }.into();
@@ -336,7 +344,7 @@ extern "C" {
 
 /// # Safety
 /// - `msg1` and `msg2` legally dereferencable MessageLite* pointers.
-pub unsafe fn raw_message_equals(_private: Private, msg1: RawMessage, msg2: RawMessage) -> bool {
+pub unsafe fn raw_message_equals(msg1: RawMessage, msg2: RawMessage) -> bool {
     // SAFETY: Same constraints placed on caller.
     unsafe { proto2_rust_messagelite_equals(msg1, msg2) }
 }
@@ -345,6 +353,7 @@ pub type RawMapIter = UntypedMapIterator;
 
 /// The raw contents of every generated message.
 #[derive(Debug)]
+#[doc(hidden)]
 pub struct MessageInner {
     pub msg: RawMessage,
 }
@@ -364,24 +373,24 @@ pub struct MessageInner {
 ///   cannot be `Clone` but *can* reborrow itself with `.as_mut()`, which
 ///   converts `&'b mut Mut<'a, T>` to `Mut<'b, T>`.
 #[derive(Clone, Copy, Debug)]
+#[doc(hidden)]
 pub struct MutatorMessageRef<'msg> {
     msg: RawMessage,
     _phantom: PhantomData<&'msg mut ()>,
 }
 impl<'msg> MutatorMessageRef<'msg> {
     #[allow(clippy::needless_pass_by_ref_mut)] // Sound construction requires mutable access.
-    pub fn new(_private: Private, msg: &'msg mut MessageInner) -> Self {
+    pub fn new(msg: &'msg mut MessageInner) -> Self {
         MutatorMessageRef { msg: msg.msg, _phantom: PhantomData }
     }
 
     /// # Safety
     /// - The underlying pointer must be sound and live for the lifetime 'msg.
-    pub unsafe fn wrap_raw(_private: Private, raw: RawMessage) -> Self {
+    pub unsafe fn wrap_raw(raw: RawMessage) -> Self {
         MutatorMessageRef { msg: raw, _phantom: PhantomData }
     }
 
     pub fn from_parent(
-        _private: Private,
         _parent_msg: MutatorMessageRef<'msg>,
         message_field_ptr: RawMessage,
     ) -> Self {
@@ -392,20 +401,21 @@ impl<'msg> MutatorMessageRef<'msg> {
         self.msg
     }
 
-    pub fn from_raw_msg(_private: Private, msg: &RawMessage) -> Self {
+    pub fn from_raw_msg(msg: &RawMessage) -> Self {
         Self { msg: *msg, _phantom: PhantomData }
     }
 }
 
 /// The raw type-erased version of an owned `Repeated`.
 #[derive(Debug)]
+#[doc(hidden)]
 pub struct InnerRepeated {
     raw: RawRepeatedField,
 }
 
 impl InnerRepeated {
     pub fn as_mut(&mut self) -> InnerRepeatedMut<'_> {
-        InnerRepeatedMut::new(Private, self.raw)
+        InnerRepeatedMut::new(self.raw)
     }
 
     pub fn raw(&self) -> RawRepeatedField {
@@ -415,7 +425,7 @@ impl InnerRepeated {
     /// # Safety
     /// - `raw` must be a valid `proto2::RepeatedField*` or
     ///   `proto2::RepeatedPtrField*`.
-    pub unsafe fn from_raw(_: Private, raw: RawRepeatedField) -> Self {
+    pub unsafe fn from_raw(raw: RawRepeatedField) -> Self {
         Self { raw }
     }
 }
@@ -424,6 +434,7 @@ impl InnerRepeated {
 ///
 /// Contains a `proto2::RepeatedField*` or `proto2::RepeatedPtrField*`.
 #[derive(Clone, Copy, Debug)]
+#[doc(hidden)]
 pub struct InnerRepeatedMut<'msg> {
     pub(crate) raw: RawRepeatedField,
     _phantom: PhantomData<&'msg ()>,
@@ -431,7 +442,7 @@ pub struct InnerRepeatedMut<'msg> {
 
 impl<'msg> InnerRepeatedMut<'msg> {
     #[doc(hidden)]
-    pub fn new(_private: Private, raw: RawRepeatedField) -> Self {
+    pub fn new(raw: RawRepeatedField) -> Self {
         InnerRepeatedMut { raw, _phantom: PhantomData }
     }
 }
@@ -474,7 +485,7 @@ impl CppTypeConversions for ProtoString {
     }
 
     fn into_insertelem(v: Self) -> CppStdString {
-        v.into_inner(Private).into_raw(Private)
+        v.into_inner(Private).into_raw()
     }
 }
 
@@ -487,7 +498,7 @@ impl CppTypeConversions for ProtoBytes {
     }
 
     fn into_insertelem(v: Self) -> CppStdString {
-        v.into_inner(Private).into_raw(Private)
+        v.into_inner(Private).into_raw()
     }
 }
 
@@ -591,12 +602,11 @@ impl_repeated_primitives!(i32, u32, i64, u64, f32, f64, bool, ProtoString, Proto
 
 /// Cast a `RepeatedView<SomeEnum>` to `RepeatedView<c_int>`.
 pub fn cast_enum_repeated_view<E: Enum + ProxiedInRepeated>(
-    private: Private,
     repeated: RepeatedView<E>,
 ) -> RepeatedView<c_int> {
     // SAFETY: the implementer of `Enum` has promised that this
     // raw repeated is a type-erased `proto2::RepeatedField<int>*`.
-    unsafe { RepeatedView::from_raw(private, repeated.as_raw(Private)) }
+    unsafe { RepeatedView::from_raw(Private, repeated.as_raw(Private)) }
 }
 
 /// Cast a `RepeatedMut<SomeEnum>` to `RepeatedMut<c_int>`.
@@ -604,14 +614,13 @@ pub fn cast_enum_repeated_view<E: Enum + ProxiedInRepeated>(
 /// Writing an unknown value is sound because all enums
 /// are representationally open.
 pub fn cast_enum_repeated_mut<E: Enum + ProxiedInRepeated>(
-    private: Private,
     mut repeated: RepeatedMut<E>,
 ) -> RepeatedMut<c_int> {
     // SAFETY: the implementer of `Enum` has promised that this
     // raw repeated is a type-erased `proto2::RepeatedField<int>*`.
     unsafe {
         RepeatedMut::from_inner(
-            private,
+            Private,
             InnerRepeatedMut { raw: repeated.as_raw(Private), _phantom: PhantomData },
         )
     }
@@ -620,19 +629,18 @@ pub fn cast_enum_repeated_mut<E: Enum + ProxiedInRepeated>(
 /// Cast a `RepeatedMut<SomeEnum>` to `RepeatedMut<c_int>` and call
 /// repeated_reserve.
 pub fn reserve_enum_repeated_mut<E: Enum + ProxiedInRepeated>(
-    private: Private,
     repeated: RepeatedMut<E>,
     additional: usize,
 ) {
-    let int_repeated = cast_enum_repeated_mut(private, repeated);
+    let int_repeated = cast_enum_repeated_mut(repeated);
     ProxiedInRepeated::repeated_reserve(int_repeated, additional);
 }
 
-pub fn new_enum_repeated<E: Enum + ProxiedInRepeated>(_: Private) -> Repeated<E> {
+pub fn new_enum_repeated<E: Enum + ProxiedInRepeated>() -> Repeated<E> {
     let int_repeated = Repeated::<c_int>::new();
     let raw = int_repeated.inner.raw();
     std::mem::forget(int_repeated);
-    unsafe { Repeated::from_inner(Private, InnerRepeated::from_raw(Private, raw)) }
+    unsafe { Repeated::from_inner(Private, InnerRepeated::from_raw(raw)) }
 }
 
 /// Cast a `RepeatedMut<SomeEnum>` to `RepeatedMut<c_int>` and call
@@ -640,25 +648,23 @@ pub fn new_enum_repeated<E: Enum + ProxiedInRepeated>(_: Private) -> Repeated<E>
 /// # Safety
 /// - The passed in `&mut Repeated<E>` must not be used after this function is
 ///   called.
-pub unsafe fn free_enum_repeated<E: Enum + ProxiedInRepeated>(
-    _: Private,
-    repeated: &mut Repeated<E>,
-) {
+pub unsafe fn free_enum_repeated<E: Enum + ProxiedInRepeated>(repeated: &mut Repeated<E>) {
     unsafe {
         let mut int_r: Repeated<c_int> =
-            Repeated::from_inner(Private, InnerRepeated::from_raw(Private, repeated.inner.raw()));
+            Repeated::from_inner(Private, InnerRepeated::from_raw(repeated.inner.raw()));
         ProxiedInRepeated::repeated_free(Private, &mut int_r);
         std::mem::forget(int_r);
     }
 }
 
 #[derive(Debug)]
+#[doc(hidden)]
 pub struct InnerMap {
     pub(crate) raw: RawMap,
 }
 
 impl InnerMap {
-    pub fn new(_private: Private, raw: RawMap) -> Self {
+    pub fn new(raw: RawMap) -> Self {
         Self { raw }
     }
 
@@ -668,6 +674,7 @@ impl InnerMap {
 }
 
 #[derive(Clone, Copy, Debug)]
+#[doc(hidden)]
 pub struct InnerMapMut<'msg> {
     pub(crate) raw: RawMap,
     _phantom: PhantomData<&'msg ()>,
@@ -675,12 +682,11 @@ pub struct InnerMapMut<'msg> {
 
 #[doc(hidden)]
 impl<'msg> InnerMapMut<'msg> {
-    pub fn new(_private: Private, raw: RawMap) -> Self {
+    pub fn new(raw: RawMap) -> Self {
         InnerMapMut { raw, _phantom: PhantomData }
     }
 
-    #[doc(hidden)]
-    pub fn as_raw(&self, _private: Private) -> RawMap {
+    pub fn as_raw(&self) -> RawMap {
         self.raw
     }
 }
@@ -690,6 +696,7 @@ impl<'msg> InnerMapMut<'msg> {
 /// This struct is ABI-compatible with `proto2::internal::UntypedMapIterator`.
 /// It is trivially constructible and destructible.
 #[repr(C)]
+#[doc(hidden)]
 pub struct UntypedMapIterator {
     node: *mut c_void,
     map: *const c_void,
@@ -720,7 +727,7 @@ impl UntypedMapIterator {
     #[inline(always)]
     pub unsafe fn next_unchecked<'a, K, V, FfiKey, FfiValue>(
         &mut self,
-        _private: Private,
+
         iter_get_thunk: unsafe extern "C" fn(
             iter: &mut UntypedMapIterator,
             size_info: MapNodeSizeInfo,
@@ -954,7 +961,6 @@ macro_rules! impl_ProxiedInMapValue_for_non_generated_value_types {
                     // - The thunk does not increment the iterator.
                     unsafe {
                         iter.as_raw_mut(Private).next_unchecked::<$key_t, Self, _, _>(
-                            Private,
                             [< proto2_rust_thunk_Map_ $key_t _ $t _iter_get >],
                             MapNodeSizeInfo(0),
                             $from_ffi_key,
@@ -978,11 +984,11 @@ fn ptrlen_to_str<'msg>(val: PtrAndLen) -> &'msg ProtoStr {
 }
 
 fn protostr_into_cppstdstring(val: ProtoString) -> CppStdString {
-    val.into_inner(Private).into_raw(Private)
+    val.into_inner(Private).into_raw()
 }
 
 fn protobytes_into_cppstdstring(val: ProtoBytes) -> CppStdString {
-    val.into_inner(Private).into_raw(Private)
+    val.into_inner(Private).into_raw()
 }
 
 // Warning: this function is unsound on its own! `val.as_ref()` must be safe to
diff --git a/rust/proxied.rs b/rust/proxied.rs
index 2aab4e016a..07c1753a85 100644
--- a/rust/proxied.rs
+++ b/rust/proxied.rs
@@ -239,6 +239,7 @@ pub trait MutProxy<'msg>: SealedInternal + Proxy<'msg> + AsMut + IntoMut<'msg> {
 /// runtime. We expect it to change in backwards incompatible ways in the
 /// future.
 pub trait IntoProxied<T: Proxied> {
+    #[doc(hidden)]
     fn into_proxied(self, _private: Private) -> T;
 }
 
diff --git a/rust/repeated.rs b/rust/repeated.rs
index 9e8ab97ac1..b1a406b3cd 100644
--- a/rust/repeated.rs
+++ b/rust/repeated.rs
@@ -5,7 +5,6 @@
 // license that can be found in the LICENSE file or at
 // https://developers.google.com/open-source/licenses/bsd
 
-use std::fmt::{self, Debug};
 use std::iter;
 use std::iter::FusedIterator;
 /// Repeated scalar fields are implemented around the runtime-specific
@@ -13,6 +12,7 @@ use std::iter::FusedIterator;
 /// runtime-specific representation of a repeated scalar (`upb_Array*` on upb,
 /// and `RepeatedField<T>*` on cpp).
 use std::marker::PhantomData;
+use std::fmt::{self, Debug};
 
 use crate::{
     AsMut, AsView, IntoMut, IntoProxied, IntoView, Mut, MutProxied, MutProxy, Proxied, Proxy, View,
@@ -352,7 +352,7 @@ impl<T: ProxiedInRepeated> Repeated<T> {
     pub fn new() -> Self {
         T::repeated_new(Private)
     }
-
+    #[doc(hidden)]
     pub fn from_inner(_private: Private, inner: InnerRepeated) -> Self {
         Self { inner, _phantom: PhantomData }
     }
diff --git a/rust/upb.rs b/rust/upb.rs
index cc4db52bac..f95b0753fd 100644
--- a/rust/upb.rs
+++ b/rust/upb.rs
@@ -12,12 +12,12 @@ use crate::{
     IntoProxied, Map, MapIter, MapMut, MapView, Mut, ProtoBytes, ProtoStr, ProtoString, Proxied,
     ProxiedInMapValue, ProxiedInRepeated, Repeated, RepeatedMut, RepeatedView, View,
 };
+use std::slice;
 use core::fmt::Debug;
 use std::alloc::Layout;
-use std::mem::{size_of, ManuallyDrop, MaybeUninit};
-use std::ptr::{self, NonNull};
-use std::slice;
 use std::sync::OnceLock;
+use std::ptr::{self, NonNull};
+use std::mem::{size_of, ManuallyDrop, MaybeUninit};
 
 #[cfg(bzl)]
 extern crate upb;
@@ -53,9 +53,10 @@ const UPB_SCRATCH_SPACE_BYTES: usize = 65_536;
 /// view, we can allocate a large block and refer to that when dealing
 /// with readonly access.
 #[repr(C, align(8))] // align to UPB_MALLOC_ALIGN = 8
+#[doc(hidden)]
 pub struct ScratchSpace([u8; UPB_SCRATCH_SPACE_BYTES]);
 impl ScratchSpace {
-    pub fn zeroed_block(_private: Private) -> RawMessage {
+    pub fn zeroed_block() -> RawMessage {
         static ZEROED_BLOCK: ScratchSpace = ScratchSpace([0; UPB_SCRATCH_SPACE_BYTES]);
         NonNull::from(&ZEROED_BLOCK).cast()
     }
@@ -74,6 +75,7 @@ impl IntoProxied<ProtoBytes> for SerializedData {
 
 /// The raw contents of every generated message.
 #[derive(Debug)]
+#[doc(hidden)]
 pub struct MessageInner {
     pub msg: RawMessage,
     pub arena: Arena,
@@ -105,6 +107,7 @@ pub struct MessageInner {
 ///   cannot be `Clone` but *can* reborrow itself with `.as_mut()`, which
 ///   converts `&'b mut Mut<'a, T>` to `Mut<'b, T>`.
 #[derive(Clone, Copy, Debug)]
+#[doc(hidden)]
 pub struct MutatorMessageRef<'msg> {
     msg: RawMessage,
     arena: &'msg Arena,
@@ -113,15 +116,11 @@ pub struct MutatorMessageRef<'msg> {
 impl<'msg> MutatorMessageRef<'msg> {
     #[doc(hidden)]
     #[allow(clippy::needless_pass_by_ref_mut)] // Sound construction requires mutable access.
-    pub fn new(_private: Private, msg: &'msg mut MessageInner) -> Self {
+    pub fn new(msg: &'msg mut MessageInner) -> Self {
         MutatorMessageRef { msg: msg.msg, arena: &msg.arena }
     }
 
-    pub fn from_parent(
-        _private: Private,
-        parent_msg: MutatorMessageRef<'msg>,
-        message_field_ptr: RawMessage,
-    ) -> Self {
+    pub fn from_parent(parent_msg: MutatorMessageRef<'msg>, message_field_ptr: RawMessage) -> Self {
         MutatorMessageRef { msg: message_field_ptr, arena: parent_msg.arena }
     }
 
@@ -129,7 +128,7 @@ impl<'msg> MutatorMessageRef<'msg> {
         self.msg
     }
 
-    pub fn arena(&self, _private: Private) -> &Arena {
+    pub fn arena(&self) -> &Arena {
         self.arena
     }
 }
@@ -150,6 +149,7 @@ fn copy_bytes_in_arena<'msg>(arena: &'msg Arena, val: &'msg [u8]) -> &'msg [u8]
 }
 
 /// Kernel-specific owned `string` and `bytes` field type.
+#[doc(hidden)]
 pub struct InnerProtoString(OwnedArenaBox<[u8]>);
 
 impl InnerProtoString {
@@ -158,7 +158,7 @@ impl InnerProtoString {
     }
 
     #[doc(hidden)]
-    pub fn into_raw_parts(self, _private: Private) -> (PtrAndLen, Arena) {
+    pub fn into_raw_parts(self) -> (PtrAndLen, Arena) {
         let (data_ptr, arena) = self.0.into_parts();
         (unsafe { data_ptr.as_ref().into() }, arena)
     }
@@ -178,6 +178,7 @@ impl From<&[u8]> for InnerProtoString {
 
 /// The raw type-erased version of an owned `Repeated`.
 #[derive(Debug)]
+#[doc(hidden)]
 pub struct InnerRepeated {
     raw: RawRepeatedField,
     arena: Arena,
@@ -185,7 +186,7 @@ pub struct InnerRepeated {
 
 impl InnerRepeated {
     pub fn as_mut(&mut self) -> InnerRepeatedMut<'_> {
-        InnerRepeatedMut::new(Private, self.raw, &self.arena)
+        InnerRepeatedMut::new(self.raw, &self.arena)
     }
 
     pub fn raw(&self) -> RawRepeatedField {
@@ -198,13 +199,14 @@ impl InnerRepeated {
 
     /// # Safety
     /// - `raw` must be a valid `RawRepeatedField`
-    pub unsafe fn from_raw_parts(_: Private, raw: RawRepeatedField, arena: Arena) -> Self {
+    pub unsafe fn from_raw_parts(raw: RawRepeatedField, arena: Arena) -> Self {
         Self { raw, arena }
     }
 }
 
 /// The raw type-erased pointer version of `RepeatedMut`.
 #[derive(Clone, Copy, Debug)]
+#[doc(hidden)]
 pub struct InnerRepeatedMut<'msg> {
     pub(crate) raw: RawRepeatedField,
     arena: &'msg Arena,
@@ -212,7 +214,7 @@ pub struct InnerRepeatedMut<'msg> {
 
 impl<'msg> InnerRepeatedMut<'msg> {
     #[doc(hidden)]
-    pub fn new(_private: Private, raw: RawRepeatedField, arena: &'msg Arena) -> Self {
+    pub fn new(raw: RawRepeatedField, arena: &'msg Arena) -> Self {
         InnerRepeatedMut { raw, arena }
     }
 }
@@ -415,11 +417,10 @@ pub unsafe fn repeated_message_copy_from<T: ProxiedInRepeated>(
 
 /// Cast a `RepeatedView<SomeEnum>` to `RepeatedView<i32>`.
 pub fn cast_enum_repeated_view<E: Enum + ProxiedInRepeated>(
-    private: Private,
     repeated: RepeatedView<E>,
 ) -> RepeatedView<i32> {
     // SAFETY: Reading an enum array as an i32 array is sound.
-    unsafe { RepeatedView::from_raw(private, repeated.as_raw(Private)) }
+    unsafe { RepeatedView::from_raw(Private, repeated.as_raw(Private)) }
 }
 
 /// Cast a `RepeatedMut<SomeEnum>` to `RepeatedMut<i32>`.
@@ -427,7 +428,6 @@ pub fn cast_enum_repeated_view<E: Enum + ProxiedInRepeated>(
 /// Writing an unknown value is sound because all enums
 /// are representationally open.
 pub fn cast_enum_repeated_mut<E: Enum + ProxiedInRepeated>(
-    private: Private,
     repeated: RepeatedMut<E>,
 ) -> RepeatedMut<i32> {
     // SAFETY:
@@ -435,36 +435,32 @@ pub fn cast_enum_repeated_mut<E: Enum + ProxiedInRepeated>(
     // - No shared mutation is possible through the output.
     unsafe {
         let InnerRepeatedMut { arena, raw, .. } = repeated.inner;
-        RepeatedMut::from_inner(private, InnerRepeatedMut { arena, raw })
+        RepeatedMut::from_inner(Private, InnerRepeatedMut { arena, raw })
     }
 }
 
 /// Cast a `RepeatedMut<SomeEnum>` to `RepeatedMut<i32>` and call
 /// repeated_reserve.
 pub fn reserve_enum_repeated_mut<E: Enum + ProxiedInRepeated>(
-    private: Private,
     repeated: RepeatedMut<E>,
     additional: usize,
 ) {
-    let int_repeated = cast_enum_repeated_mut(private, repeated);
+    let int_repeated = cast_enum_repeated_mut(repeated);
     ProxiedInRepeated::repeated_reserve(int_repeated, additional);
 }
 
-pub fn new_enum_repeated<E: Enum + ProxiedInRepeated>(_: Private) -> Repeated<E> {
+pub fn new_enum_repeated<E: Enum + ProxiedInRepeated>() -> Repeated<E> {
     let arena = Arena::new();
     // SAFETY:
     // - `upb_Array_New` is unsafe but assumed to be sound when called on a valid
     //   arena.
     unsafe {
         let raw = upb_Array_New(arena.raw(), upb::CType::Int32);
-        Repeated::from_inner(Private, InnerRepeated::from_raw_parts(Private, raw, arena))
+        Repeated::from_inner(Private, InnerRepeated::from_raw_parts(raw, arena))
     }
 }
 
-pub fn free_enum_repeated<E: Enum + ProxiedInRepeated>(
-    _private: Private,
-    _repeated: &mut Repeated<E>,
-) {
+pub fn free_enum_repeated<E: Enum + ProxiedInRepeated>(_repeated: &mut Repeated<E>) {
     // No-op: the memory will be dropped by the arena.
 }
 
@@ -528,13 +524,14 @@ impl<'msg, K: ?Sized, V: ?Sized> MapMut<'msg, K, V> {
 }
 
 #[derive(Debug)]
+#[doc(hidden)]
 pub struct InnerMap {
     pub(crate) raw: RawMap,
     arena: Arena,
 }
 
 impl InnerMap {
-    pub fn new(_private: Private, raw: RawMap, arena: Arena) -> Self {
+    pub fn new(raw: RawMap, arena: Arena) -> Self {
         Self { raw, arena }
     }
 
@@ -544,6 +541,7 @@ impl InnerMap {
 }
 
 #[derive(Clone, Copy, Debug)]
+#[doc(hidden)]
 pub struct InnerMapMut<'msg> {
     pub(crate) raw: RawMap,
     arena: &'msg Arena,
@@ -551,17 +549,17 @@ pub struct InnerMapMut<'msg> {
 
 #[doc(hidden)]
 impl<'msg> InnerMapMut<'msg> {
-    pub fn new(_private: Private, raw: RawMap, arena: &'msg Arena) -> Self {
+    pub fn new(raw: RawMap, arena: &'msg Arena) -> Self {
         InnerMapMut { raw, arena }
     }
 
     #[doc(hidden)]
-    pub fn as_raw(&self, _private: Private) -> RawMap {
+    pub fn as_raw(&self) -> RawMap {
         self.raw
     }
 
     #[doc(hidden)]
-    pub fn raw_arena(&self, _private: Private) -> RawArena {
+    pub fn raw_arena(&self) -> RawArena {
         self.arena.raw()
     }
 }
@@ -638,7 +636,7 @@ impl UpbTypeConversions for ProtoBytes {
         // SAFETY: The arena memory is not freed due to `ManuallyDrop`.
         let parent_arena = ManuallyDrop::new(unsafe { Arena::from_raw(raw_parent_arena) });
 
-        let (view, arena) = val.inner.into_raw_parts(Private);
+        let (view, arena) = val.inner.into_raw_parts();
         parent_arena.fuse(&arena);
 
         upb_MessageValue { str_val: view }
@@ -676,6 +674,7 @@ impl UpbTypeConversions for ProtoString {
     }
 }
 
+#[doc(hidden)]
 pub struct RawMapIter {
     // TODO: Replace this `RawMap` with the const type.
     map: RawMap,
@@ -683,17 +682,14 @@ pub struct RawMapIter {
 }
 
 impl RawMapIter {
-    pub fn new(_private: Private, map: RawMap) -> Self {
+    pub fn new(map: RawMap) -> Self {
         RawMapIter { map, iter: UPB_MAP_BEGIN }
     }
 
     /// # Safety
     /// - `self.map` must be valid, and remain valid while the return value is
     ///   in use.
-    pub unsafe fn next_unchecked(
-        &mut self,
-        _private: Private,
-    ) -> Option<(upb_MessageValue, upb_MessageValue)> {
+    pub unsafe fn next_unchecked(&mut self) -> Option<(upb_MessageValue, upb_MessageValue)> {
         let mut key = MaybeUninit::uninit();
         let mut value = MaybeUninit::uninit();
         // SAFETY: the `map` is valid as promised by the caller
@@ -768,7 +764,7 @@ macro_rules! impl_ProxiedInMapValue_for_non_generated_value_types {
                 fn map_iter(map: View<'_, Map<$key_t, Self>>) -> MapIter<'_, $key_t, Self> {
                     // SAFETY: View<Map<'_,..>> guarantees its RawMap outlives '_.
                     unsafe {
-                        MapIter::from_raw(Private, RawMapIter::new(Private, map.as_raw(Private)))
+                        MapIter::from_raw(Private, RawMapIter::new(map.as_raw(Private)))
                     }
                 }
 
@@ -776,7 +772,7 @@ macro_rules! impl_ProxiedInMapValue_for_non_generated_value_types {
                     iter: &mut MapIter<'a, $key_t, Self>
                 ) -> Option<(View<'a, $key_t>, View<'a, Self>)> {
                     // SAFETY: MapIter<'a, ..> guarantees its RawMapIter outlives 'a.
-                    unsafe { iter.as_raw_mut(Private).next_unchecked(Private) }
+                    unsafe { iter.as_raw_mut(Private).next_unchecked() }
                         // SAFETY: MapIter<K, V> returns key and values message values
                         //         with the variants for K and V active.
                         .map(|(k, v)| unsafe {(
diff --git a/src/google/protobuf/compiler/rust/accessors/map.cc b/src/google/protobuf/compiler/rust/accessors/map.cc
index 2bd16ff79c..149906d068 100644
--- a/src/google/protobuf/compiler/rust/accessors/map.cc
+++ b/src/google/protobuf/compiler/rust/accessors/map.cc
@@ -87,7 +87,7 @@ void Map::InMsgImpl(Context& ctx, const FieldDescriptor& field,
                         $getter_mut_thunk$(self.raw_msg(),
                                            self.arena().raw())
                       };
-                      let inner = $pbr$::InnerMapMut::new($pbi$::Private,
+                      let inner = $pbr$::InnerMapMut::new(
                         raw, self.arena());
                       unsafe { $pb$::MapMut::from_inner($pbi$::Private, inner) }
                     })rs");
@@ -95,7 +95,7 @@ void Map::InMsgImpl(Context& ctx, const FieldDescriptor& field,
                  ctx.Emit({}, R"rs(
                     pub fn $field$_mut(&mut self)
                       -> $pb$::MapMut<'_, $Key$, $Value$> {
-                      let inner = $pbr$::InnerMapMut::new($pbi$::Private,
+                      let inner = $pbr$::InnerMapMut::new(
                         unsafe { $getter_mut_thunk$(self.raw_msg()) });
                       unsafe { $pb$::MapMut::from_inner($pbi$::Private, inner) }
                     })rs");
diff --git a/src/google/protobuf/compiler/rust/accessors/repeated_field.cc b/src/google/protobuf/compiler/rust/accessors/repeated_field.cc
index 04e638e6df..ba45cd8d93 100644
--- a/src/google/protobuf/compiler/rust/accessors/repeated_field.cc
+++ b/src/google/protobuf/compiler/rust/accessors/repeated_field.cc
@@ -76,7 +76,6 @@ void RepeatedField::InMsgImpl(Context& ctx, const FieldDescriptor& field,
                         $pb$::RepeatedMut::from_inner(
                           $pbi$::Private,
                           $pbr$::InnerRepeatedMut::new(
-                            $pbi$::Private,
                             $getter_mut_thunk$(
                               self.raw_msg(),
                               /* optional size pointer */ std::ptr::null(),
@@ -95,7 +94,6 @@ void RepeatedField::InMsgImpl(Context& ctx, const FieldDescriptor& field,
                           $pb$::RepeatedMut::from_inner(
                             $pbi$::Private,
                             $pbr$::InnerRepeatedMut::new(
-                              $pbi$::Private,
                               $getter_mut_thunk$(self.raw_msg()),
                             ),
                           )
diff --git a/src/google/protobuf/compiler/rust/accessors/singular_cord.cc b/src/google/protobuf/compiler/rust/accessors/singular_cord.cc
index 900f5b4de3..cb9d486a82 100644
--- a/src/google/protobuf/compiler/rust/accessors/singular_cord.cc
+++ b/src/google/protobuf/compiler/rust/accessors/singular_cord.cc
@@ -97,7 +97,7 @@ void SingularCord::InMsgImpl(Context& ctx, const FieldDescriptor& field,
                   }
 
                   let owned = unsafe { $owned_getter_thunk$(self.raw_msg()) };
-                  let inner = unsafe { $pbr$::InnerProtoString::from_raw($pbi$::Private, owned) };
+                  let inner = unsafe { $pbr$::InnerProtoString::from_raw(owned) };
 
                   $transform_owned$
                 )rs");
@@ -125,7 +125,7 @@ void SingularCord::InMsgImpl(Context& ctx, const FieldDescriptor& field,
               unsafe {
                 $setter_thunk$(
                   self.as_mutator_message_ref($pbi$::Private).msg(),
-                  s.into_inner($pbi$::Private).into_raw($pbi$::Private)
+                  s.into_inner($pbi$::Private).into_raw()
                 );
               }
             )rs");
@@ -133,11 +133,11 @@ void SingularCord::InMsgImpl(Context& ctx, const FieldDescriptor& field,
             ctx.Emit(R"rs(
               let s = val.into_proxied($pbi$::Private);
               let (view, arena) =
-                s.into_inner($pbi$::Private).into_raw_parts($pbi$::Private);
+                s.into_inner($pbi$::Private).into_raw_parts();
 
               let mm_ref =
                 self.as_mutator_message_ref($pbi$::Private);
-              let parent_arena = mm_ref.arena($pbi$::Private);
+              let parent_arena = mm_ref.arena();
 
               parent_arena.fuse(&arena);
 
diff --git a/src/google/protobuf/compiler/rust/accessors/singular_message.cc b/src/google/protobuf/compiler/rust/accessors/singular_message.cc
index 83f58a85cb..27099d16a6 100644
--- a/src/google/protobuf/compiler/rust/accessors/singular_message.cc
+++ b/src/google/protobuf/compiler/rust/accessors/singular_message.cc
@@ -46,8 +46,7 @@ void SingularMessage::InMsgImpl(Context& ctx, const FieldDescriptor& field,
               //~ Note that a nullptr received from upb manifests as Option::None
               match submsg {
                 //~ TODO:(b/304357029)
-                None => $msg_type$View::new($pbi$::Private,
-                        $pbr$::ScratchSpace::zeroed_block($pbi$::Private)),
+                None => $msg_type$View::new($pbi$::Private, $pbr$::ScratchSpace::zeroed_block()),
                 Some(field) => $msg_type$View::new($pbi$::Private, field),
               }
         )rs");
@@ -118,8 +117,8 @@ void SingularMessage::InMsgImpl(Context& ctx, const FieldDescriptor& field,
                   // parent message's arena.
                   let mut msg = val.into_proxied($pbi$::Private);
                   self.as_mutator_message_ref($pbi$::Private)
-                    .arena($pbi$::Private)
-                    .fuse(msg.as_mutator_message_ref($pbi$::Private).arena($pbi$::Private));
+                    .arena()
+                    .fuse(msg.as_mutator_message_ref($pbi$::Private).arena());
 
                   unsafe {
                     $set_allocated_thunk$(self.as_mutator_message_ref($pbi$::Private).msg(),
diff --git a/src/google/protobuf/compiler/rust/accessors/singular_string.cc b/src/google/protobuf/compiler/rust/accessors/singular_string.cc
index 99f8b9ff56..980ffbc9c8 100644
--- a/src/google/protobuf/compiler/rust/accessors/singular_string.cc
+++ b/src/google/protobuf/compiler/rust/accessors/singular_string.cc
@@ -74,7 +74,7 @@ void SingularString::InMsgImpl(Context& ctx, const FieldDescriptor& field,
                 unsafe {
                   $setter_thunk$(
                     self.as_mutator_message_ref($pbi$::Private).msg(),
-                    s.into_inner($pbi$::Private).into_raw($pbi$::Private)
+                    s.into_inner($pbi$::Private).into_raw()
                   );
                 }
               )rs");
@@ -82,11 +82,11 @@ void SingularString::InMsgImpl(Context& ctx, const FieldDescriptor& field,
                ctx.Emit(R"rs(
                 let s = val.into_proxied($pbi$::Private);
                 let (view, arena) =
-                  s.into_inner($pbi$::Private).into_raw_parts($pbi$::Private);
+                  s.into_inner($pbi$::Private).into_raw_parts();
 
                 let mm_ref =
                   self.as_mutator_message_ref($pbi$::Private);
-                let parent_arena = mm_ref.arena($pbi$::Private);
+                let parent_arena = mm_ref.arena();
 
                 parent_arena.fuse(&arena);
 
diff --git a/src/google/protobuf/compiler/rust/enum.cc b/src/google/protobuf/compiler/rust/enum.cc
index 55f30a380e..c840d6c3a8 100644
--- a/src/google/protobuf/compiler/rust/enum.cc
+++ b/src/google/protobuf/compiler/rust/enum.cc
@@ -77,7 +77,7 @@ void EnumProxiedInMapValue(Context& ctx, const EnumDescriptor& desc) {
             unsafe {
                 $pb$::Map::from_inner(
                     $pbi$::Private,
-                    $pbr$::InnerMap::new($pbi$::Private, $pbr$::$map_new_thunk$())
+                    $pbr$::InnerMap::new($pbr$::$map_new_thunk$())
                 )
             }
         }
@@ -136,7 +136,6 @@ void EnumProxiedInMapValue(Context& ctx, const EnumDescriptor& desc) {
             // - The thunk does not increment the iterator.
             unsafe {
                 iter.as_raw_mut($pbi$::Private).next_unchecked::<$key_t$, Self, _, _>(
-                    $pbi$::Private,
                     $pbr$::$map_iter_get_thunk$,
                     $pbr$::MapNodeSizeInfo(0),  // Ignored
                     |ffi_key| $from_ffi_key_expr$,
@@ -164,7 +163,7 @@ void EnumProxiedInMapValue(Context& ctx, const EnumDescriptor& desc) {
               };
               $pb$::Map::from_inner(
                   $pbi$::Private,
-                  $pbr$::InnerMap::new($pbi$::Private, raw, arena))
+                  $pbr$::InnerMap::new(raw, arena))
           }
 
           unsafe fn map_free(_private: $pbi$::Private, _map: &mut $pb$::Map<$key_t$, Self>) {
@@ -184,7 +183,7 @@ void EnumProxiedInMapValue(Context& ctx, const EnumDescriptor& desc) {
           }
 
           fn map_insert(mut map: $pb$::Mut<'_, $pb$::Map<$key_t$, Self>>, key: $pb$::View<'_, $key_t$>, value: impl $pb$::IntoProxied<Self>) -> bool {
-              let arena = map.inner($pbi$::Private).raw_arena($pbi$::Private);
+              let arena = map.inner($pbi$::Private).raw_arena();
               unsafe {
                   $pbr$::upb_Map_InsertAndReturnIfInserted(
                       map.as_raw($pbi$::Private),
@@ -221,7 +220,7 @@ void EnumProxiedInMapValue(Context& ctx, const EnumDescriptor& desc) {
           fn map_iter(map: $pb$::View<'_, $pb$::Map<$key_t$, Self>>) -> $pb$::MapIter<'_, $key_t$, Self> {
               // SAFETY: View<Map<'_,..>> guarantees its RawMap outlives '_.
               unsafe {
-                  $pb$::MapIter::from_raw($pbi$::Private, $pbr$::RawMapIter::new($pbi$::Private, map.as_raw($pbi$::Private)))
+                  $pb$::MapIter::from_raw($pbi$::Private, $pbr$::RawMapIter::new(map.as_raw($pbi$::Private)))
               }
           }
 
@@ -229,7 +228,7 @@ void EnumProxiedInMapValue(Context& ctx, const EnumDescriptor& desc) {
               iter: &mut $pb$::MapIter<'a, $key_t$, Self>
           ) -> Option<($pb$::View<'a, $key_t$>, $pb$::View<'a, Self>)> {
               // SAFETY: MapIter<'a, ..> guarantees its RawMapIter outlives 'a.
-              unsafe { iter.as_raw_mut($pbi$::Private).next_unchecked($pbi$::Private) }
+              unsafe { iter.as_raw_mut($pbi$::Private).next_unchecked() }
                   // SAFETY: MapIter<K, V> returns key and values message values
                   //         with the variants for K and V active.
                   .map(|(k, v)| unsafe {(
@@ -410,23 +409,23 @@ void GenerateEnumDefinition(Context& ctx, const EnumDescriptor& desc) {
 
       unsafe impl $pb$::ProxiedInRepeated for $name$ {
         fn repeated_new(_private: $pbi$::Private) -> $pb$::Repeated<Self> {
-          $pbr$::new_enum_repeated($pbi$::Private)
+          $pbr$::new_enum_repeated()
         }
 
-        unsafe fn repeated_free(_private: $pbi$::Private, _f: &mut $pb$::Repeated<Self>) {
-          $pbr$::free_enum_repeated($pbi$::Private, _f)
+        unsafe fn repeated_free(_private: $pbi$::Private, f: &mut $pb$::Repeated<Self>) {
+          $pbr$::free_enum_repeated(f)
         }
 
         fn repeated_len(r: $pb$::View<$pb$::Repeated<Self>>) -> usize {
-          $pbr$::cast_enum_repeated_view($pbi$::Private, r).len()
+          $pbr$::cast_enum_repeated_view(r).len()
         }
 
         fn repeated_push(r: $pb$::Mut<$pb$::Repeated<Self>>, val: impl $pb$::IntoProxied<$name$>) {
-          $pbr$::cast_enum_repeated_mut($pbi$::Private, r).push(val.into_proxied($pbi$::Private))
+          $pbr$::cast_enum_repeated_mut(r).push(val.into_proxied($pbi$::Private))
         }
 
         fn repeated_clear(r: $pb$::Mut<$pb$::Repeated<Self>>) {
-          $pbr$::cast_enum_repeated_mut($pbi$::Private, r).clear()
+          $pbr$::cast_enum_repeated_mut(r).clear()
         }
 
         unsafe fn repeated_get_unchecked(
@@ -435,7 +434,7 @@ void GenerateEnumDefinition(Context& ctx, const EnumDescriptor& desc) {
         ) -> $pb$::View<$name$> {
           // SAFETY: In-bounds as promised by the caller.
           unsafe {
-            $pbr$::cast_enum_repeated_view($pbi$::Private, r)
+            $pbr$::cast_enum_repeated_view(r)
               .get_unchecked(index)
               .try_into()
               .unwrap_unchecked()
@@ -449,7 +448,7 @@ void GenerateEnumDefinition(Context& ctx, const EnumDescriptor& desc) {
         ) {
           // SAFETY: In-bounds as promised by the caller.
           unsafe {
-            $pbr$::cast_enum_repeated_mut($pbi$::Private, r)
+            $pbr$::cast_enum_repeated_mut(r)
               .set_unchecked(index, val.into_proxied($pbi$::Private))
           }
         }
@@ -458,8 +457,8 @@ void GenerateEnumDefinition(Context& ctx, const EnumDescriptor& desc) {
             src: $pb$::View<$pb$::Repeated<Self>>,
             dest: $pb$::Mut<$pb$::Repeated<Self>>,
         ) {
-          $pbr$::cast_enum_repeated_mut($pbi$::Private, dest)
-            .copy_from($pbr$::cast_enum_repeated_view($pbi$::Private, src))
+          $pbr$::cast_enum_repeated_mut(dest)
+            .copy_from($pbr$::cast_enum_repeated_view(src))
         }
 
         fn repeated_reserve(
@@ -468,7 +467,7 @@ void GenerateEnumDefinition(Context& ctx, const EnumDescriptor& desc) {
         ) {
             // SAFETY:
             // - `f.as_raw()` is valid.
-            $pbr$::reserve_enum_repeated_mut($pbi$::Private, r, additional);
+            $pbr$::reserve_enum_repeated_mut(r, additional);
         }
       }
 
diff --git a/src/google/protobuf/compiler/rust/message.cc b/src/google/protobuf/compiler/rust/message.cc
index a7d119b4ba..8c84cf98c3 100644
--- a/src/google/protobuf/compiler/rust/message.cc
+++ b/src/google/protobuf/compiler/rust/message.cc
@@ -58,7 +58,7 @@ void MessageSerialize(Context& ctx, const Descriptor& msg) {
   switch (ctx.opts().kernel) {
     case Kernel::kCpp:
       ctx.Emit({}, R"rs(
-        let mut serialized_data = $pbr$::SerializedData::new($pbi$::Private);
+        let mut serialized_data = $pbr$::SerializedData::new();
         let success = unsafe {
           $pbr$::proto2_rust_Message_serialize(self.raw_msg(), &mut serialized_data)
         };
@@ -165,7 +165,7 @@ void MessageDebug(Context& ctx, const Descriptor& msg) {
     case Kernel::kCpp:
       ctx.Emit({},
                R"rs(
-        $pbr$::debug_string($pbi$::Private, self.raw_msg(), f)
+        $pbr$::debug_string(self.raw_msg(), f)
       )rs");
       return;
 
@@ -387,8 +387,7 @@ void MessageProxiedInRepeated(Context& ctx, const Descriptor& msg) {
             // - The thunk returns an unaliased and valid `RepeatedPtrField*`
             unsafe {
               $pb$::Repeated::from_inner($pbi$::Private,
-                $pbr$::InnerRepeated::from_raw($pbi$::Private,
-                  $repeated_new_thunk$()
+                $pbr$::InnerRepeated::from_raw($repeated_new_thunk$()
                 )
               )
             }
@@ -481,11 +480,12 @@ void MessageProxiedInRepeated(Context& ctx, const Descriptor& msg) {
           fn repeated_new(_private: $pbi$::Private) -> $pb$::Repeated<Self> {
             let arena = $pbr$::Arena::new();
             unsafe {
-              $pb$::Repeated::from_inner($pbi$::Private, $pbr$::InnerRepeated::from_raw_parts(
+              $pb$::Repeated::from_inner(
                   $pbi$::Private,
-                  $pbr$::upb_Array_New(arena.raw(), $pbr$::CType::Message),
-                  arena,
-              ))
+                  $pbr$::InnerRepeated::from_raw_parts(
+                      $pbr$::upb_Array_New(arena.raw(), $pbr$::CType::Message),
+                      arena,
+                  ))
             }
           }
 
@@ -605,7 +605,7 @@ void MessageProxiedInMapValue(Context& ctx, const Descriptor& msg) {
                     unsafe {
                         $pb$::Map::from_inner(
                             $pbi$::Private,
-                            $pbr$::InnerMap::new($pbi$::Private, $pbr$::proto2_rust_map_new())
+                            $pbr$::InnerMap::new($pbr$::proto2_rust_map_new())
                         )
                     }
                 }
@@ -686,7 +686,6 @@ void MessageProxiedInMapValue(Context& ctx, const Descriptor& msg) {
                     // - The thunk does not increment the iterator.
                     unsafe {
                         iter.as_raw_mut($pbi$::Private).next_unchecked::<$key_t$, Self, _, _>(
-                            $pbi$::Private,
                             $pbr$::$map_iter_get$,
                             $map_size_info_thunk$($key_t$::SIZE_INFO_INDEX),
                             |ffi_key| $from_ffi_key_expr$,
@@ -718,9 +717,10 @@ void MessageProxiedInMapValue(Context& ctx, const Descriptor& msg) {
                   raw_parent_arena: $pbr$::RawArena,
                   mut val: Self) -> $pbr$::upb_MessageValue {
                   // SAFETY: The arena memory is not freed due to `ManuallyDrop`.
-                  let parent_arena = core::mem::ManuallyDrop::new(unsafe { $pbr$::Arena::from_raw(raw_parent_arena) });
+                  let parent_arena = core::mem::ManuallyDrop::new(
+                      unsafe { $pbr$::Arena::from_raw(raw_parent_arena) });
 
-                  parent_arena.fuse(val.as_mutator_message_ref($pbi$::Private).arena($pbi$::Private));
+                  parent_arena.fuse(val.as_mutator_message_ref($pbi$::Private).arena());
                   $pbr$::upb_MessageValue { msg_val: Some(val.raw_msg()) }
                 }
 
@@ -749,7 +749,7 @@ void MessageProxiedInMapValue(Context& ctx, const Descriptor& msg) {
 
                     $pb$::Map::from_inner(
                         $pbi$::Private,
-                        $pbr$::InnerMap::new($pbi$::Private, raw, arena))
+                        $pbr$::InnerMap::new(raw, arena))
                 }
 
                 unsafe fn map_free(_private: $pbi$::Private, _map: &mut $pb$::Map<$key_t$, Self>) {
@@ -769,7 +769,7 @@ void MessageProxiedInMapValue(Context& ctx, const Descriptor& msg) {
                 }
 
                 fn map_insert(mut map: $pb$::Mut<'_, $pb$::Map<$key_t$, Self>>, key: $pb$::View<'_, $key_t$>, value: impl $pb$::IntoProxied<Self>) -> bool {
-                    let arena = map.inner($pbi$::Private).raw_arena($pbi$::Private);
+                    let arena = map.inner($pbi$::Private).raw_arena();
                     unsafe {
                         $pbr$::upb_Map_InsertAndReturnIfInserted(
                             map.as_raw($pbi$::Private),
@@ -805,7 +805,7 @@ void MessageProxiedInMapValue(Context& ctx, const Descriptor& msg) {
                 fn map_iter(map: $pb$::View<'_, $pb$::Map<$key_t$, Self>>) -> $pb$::MapIter<'_, $key_t$, Self> {
                     // SAFETY: View<Map<'_,..>> guarantees its RawMap outlives '_.
                     unsafe {
-                        $pb$::MapIter::from_raw($pbi$::Private, $pbr$::RawMapIter::new($pbi$::Private, map.as_raw($pbi$::Private)))
+                        $pb$::MapIter::from_raw($pbi$::Private, $pbr$::RawMapIter::new(map.as_raw($pbi$::Private)))
                     }
                 }
 
@@ -813,7 +813,7 @@ void MessageProxiedInMapValue(Context& ctx, const Descriptor& msg) {
                     iter: &mut $pb$::MapIter<'a, $key_t$, Self>
                 ) -> Option<($pb$::View<'a, $key_t$>, $pb$::View<'a, Self>)> {
                     // SAFETY: MapIter<'a, ..> guarantees its RawMapIter outlives 'a.
-                    unsafe { iter.as_raw_mut($pbi$::Private).next_unchecked($pbi$::Private) }
+                    unsafe { iter.as_raw_mut($pbi$::Private).next_unchecked() }
                         // SAFETY: MapIter<K, V> returns key and values message values
                         //         with the variants for K and V active.
                         .map(|(k, v)| unsafe {(
@@ -917,7 +917,7 @@ void GenerateRs(Context& ctx, const Descriptor& msg) {
           if (ctx.is_upb()) {
             ctx.Emit({}, R"rs(
                   fn arena(&self) -> &$pbr$::Arena {
-                    self.inner.arena($pbi$::Private)
+                    self.inner.arena()
                   }
                   )rs");
           }
@@ -950,15 +950,13 @@ void GenerateRs(Context& ctx, const Descriptor& msg) {
        {"unwrap_upb",
         [&] {
           if (ctx.is_upb()) {
-            ctx.Emit(
-                ".unwrap_or_else(||$pbr$::ScratchSpace::zeroed_block($pbi$::"
-                "Private))");
+            ctx.Emit(".unwrap_or_else(||$pbr$::ScratchSpace::zeroed_block())");
           }
         }},
        {"upb_arena",
         [&] {
           if (ctx.is_upb()) {
-            ctx.Emit(", inner.msg_ref().arena($pbi$::Private).raw()");
+            ctx.Emit(", inner.msg_ref().arena().raw()");
           }
         }}},
       R"rs(
@@ -1148,20 +1146,20 @@ void GenerateRs(Context& ctx, const Descriptor& msg) {
                      msg: $pbr$::RawMessage)
             -> Self {
             Self {
-              inner: $pbr$::MutatorMessageRef::from_parent(
-                       $pbi$::Private, parent, msg)
+              inner: $pbr$::MutatorMessageRef::from_parent(parent, msg)
             }
           }
 
           #[doc(hidden)]
           pub fn new(_private: $pbi$::Private, msg: &'msg mut $pbr$::MessageInner) -> Self {
-            Self{ inner: $pbr$::MutatorMessageRef::new(_private, msg) }
+            Self{ inner: $pbr$::MutatorMessageRef::new(msg) }
           }
 
           fn raw_msg(&self) -> $pbr$::RawMessage {
             self.inner.msg()
           }
 
+          #[doc(hidden)]
           pub fn as_mutator_message_ref(&mut self, _private: $pbi$::Private)
             -> $pbr$::MutatorMessageRef<'msg> {
             self.inner
@@ -1225,8 +1223,9 @@ void GenerateRs(Context& ctx, const Descriptor& msg) {
             self.inner.msg
           }
 
+          #[doc(hidden)]
           pub fn as_mutator_message_ref(&mut self, _private: $pbi$::Private) -> $pbr$::MutatorMessageRef {
-            $pbr$::MutatorMessageRef::new($pbi$::Private, &mut self.inner)
+            $pbr$::MutatorMessageRef::new(&mut self.inner)
           }
 
           $raw_arena_getter_for_message$
@@ -1296,7 +1295,6 @@ void GenerateRs(Context& ctx, const Descriptor& msg) {
             msg: &'a mut *mut std::ffi::c_void) -> Self {
           Self {
             inner: $pbr$::MutatorMessageRef::wrap_raw(
-                $pbi$::Private,
                 $pbr$::RawMessage::new(*msg as *mut _).unwrap())
           }
         }
@@ -1331,7 +1329,6 @@ void GenerateRs(Context& ctx, const Descriptor& msg) {
             msg: &'a mut *mut std::ffi::c_void) -> Self {
           Self {
             inner: $pbr$::MutatorMessageRef::wrap_raw(
-                $pbi$::Private,
                 $pbr$::RawMessage::new(*msg as *mut _).unwrap())
           }
         }
@@ -1339,7 +1336,6 @@ void GenerateRs(Context& ctx, const Descriptor& msg) {
             msg: *mut std::ffi::c_void) -> Self {
           Self {
             inner: $pbr$::MutatorMessageRef::wrap_raw(
-                $pbi$::Private,
                 $pbr$::RawMessage::new(msg as *mut _).unwrap())
           }
         }