diff --git a/data-conformance/tests/variables.rs b/data-conformance/tests/variables.rs
index 5bc2fc4..f43f9b5 100644
--- a/data-conformance/tests/variables.rs
+++ b/data-conformance/tests/variables.rs
@@ -581,7 +581,7 @@ fn data_dataset_apply_reports_unapplicable_rows_instead_of_faking_them() {
     let applies = s.apply_data_set("Alpha").unwrap();
     let sales = applies.iter().find(|a| a.variable == "Sales").unwrap();
     assert!(!sales.applicable);
-    assert!(sales.note.as_deref().unwrap().contains("D-15"));
+    assert!(sales.note.as_deref().unwrap().contains("cannot be applied"));
     let orphan = applies.iter().find(|a| a.variable == "Orphan").unwrap();
     assert!(!orphan.applicable);
     assert!(orphan.note.as_deref().unwrap().contains("no binding"));
diff --git a/data-js/src/core.rs b/data-js/src/core.rs
index f9d0635..4328246 100644
--- a/data-js/src/core.rs
+++ b/data-js/src/core.rs
@@ -1420,9 +1420,8 @@ impl DataSession {
             if !decl.var_trait.is_bindable() {
                 apply.applicable = false;
                 apply.note = Some(
-                    "graph-data variables are carried through the library but have no \
-                     paged.data binding to apply — a chart surface lives in another \
-                     plugin and the isolation contract forbids reaching into it (RFI D-15)"
+                    "graph-data variables are kept in the library but cannot be applied: \
+                     paged.data does not fill charts"
                         .to_string(),
                 );
             } else if !defined.contains(&decl.name) {
diff --git a/data-sources/src/remote.rs b/data-sources/src/remote.rs
index db98761..e802127 100644
--- a/data-sources/src/remote.rs
+++ b/data-sources/src/remote.rs
@@ -45,7 +45,7 @@ pub enum RemoteError {
     UnsupportedScheme(String),
     #[error("remote url has no host")]
     MissingHost,
-    #[error("remote url embeds credentials (user:pass@) — use a credential_ref (D-11)")]
+    #[error("remote url embeds credentials (user:pass@) — use a stored credential instead")]
     EmbeddedCredentials,
     #[error("source is not a remote source")]
     NotRemote,
diff --git a/docs/status.md b/docs/status.md
index 7520e19..4d7897c 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1,7 +1,7 @@
 # Status
 
 What `paged.data` ships and what it does not, read from the code on `main` (2026-10-06;
-package version 0.1.0-canary.13, built against core v0.71.1 and plugin-api/plugin-sdk
+package version 0.1.0-canary.14, built against core v0.71.1 and plugin-api/plugin-sdk
 0.2.45-canary.0). The 2026-10-05 round of work is on `main`; its outcome is summarised at the end of
 [`design/analysis-2026-10-05.md`](design/analysis-2026-10-05.md). How
 the parts fit is in [`architecture.md`](architecture.md); the analysis behind the current round
diff --git a/packages/data-bundle/manifest.json b/packages/data-bundle/manifest.json
index e0c3ea0..8b24922 100644
--- a/packages/data-bundle/manifest.json
+++ b/packages/data-bundle/manifest.json
@@ -1,7 +1,7 @@
 {
   "id": "media.paged.data",
   "name": "paged.data",
-  "version": "0.1.0-canary.13",
+  "version": "0.1.0-canary.14",
   "apiVersion": "^0.2",
   "publisher": "paged.media",
   "capabilities": {
@@ -260,14 +260,14 @@
               "type": {
                 "kind": "text"
               },
-              "summary": "Property bindings: the selector of the objects it writes (ADR 131)."
+              "summary": "Property bindings: the selector of the objects it writes."
             },
             {
               "path": "path",
               "type": {
                 "kind": "text"
               },
-              "summary": "Property bindings: the property path it writes (ADR 132)."
+              "summary": "Property bindings: the property path it writes."
             },
             {
               "path": "coerce",
diff --git a/packages/data-bundle/package.json b/packages/data-bundle/package.json
index 525457c..f29c0ee 100644
--- a/packages/data-bundle/package.json
+++ b/packages/data-bundle/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@paged-media/data",
   "private": false,
-  "version": "0.1.0-canary.13",
+  "version": "0.1.0-canary.14",
   "license": "AGPL-3.0-only OR LicenseRef-PMEL",
   "type": "module",
   "main": "./src/index.ts",
diff --git a/packages/data-bundle/src/__tests__/remote.test.ts b/packages/data-bundle/src/__tests__/remote.test.ts
index ad828c5..cfb1cf2 100644
--- a/packages/data-bundle/src/__tests__/remote.test.ts
+++ b/packages/data-bundle/src/__tests__/remote.test.ts
@@ -195,7 +195,7 @@ describe("remote descriptors — credentialRef strings only (data.security.crede
   it("rejects URLs with embedded credentials", () => {
     const session = createSession(fakeHost([]), 0);
     const err = session.addRemoteSource("bad", "https://user:secret@api.test/x.csv", "csv");
-    expect(err).toContain("credentialRef");
+    expect(err).toContain("stored credential");
     expect(session.getState().remote).toHaveLength(0);
     expect(validateRemoteUrl("https://user:secret@api.test/x.csv")).toContain("credentials");
   });
diff --git a/packages/data-bundle/src/__tests__/variables.test.ts b/packages/data-bundle/src/__tests__/variables.test.ts
index bffb06d..d5517ff 100644
--- a/packages/data-bundle/src/__tests__/variables.test.ts
+++ b/packages/data-bundle/src/__tests__/variables.test.ts
@@ -447,6 +447,6 @@ describe("data_dataset_apply session lane (§9.9)", () => {
     (engine as { data_set_payload_bytes?: () => number }).data_set_payload_bytes = () => 60_000;
     const s = await sessionWith(fake.host, engine);
     await s.captureEveryRecord("q1", { nameColumn: "name" });
-    expect(s.getState().message).toContain("D-08");
+    expect(s.getState().message).toContain("a document can store");
   });
 });
diff --git a/packages/data-bundle/src/remote.ts b/packages/data-bundle/src/remote.ts
index bd642a9..1758ac3 100644
--- a/packages/data-bundle/src/remote.ts
+++ b/packages/data-bundle/src/remote.ts
@@ -68,7 +68,7 @@ export function validateRemoteUrl(url: string): string | null {
     return `remote url must be http(s), got ${parsed.protocol}//`;
   }
   if (parsed.username !== "" || parsed.password !== "") {
-    return "remote url embeds credentials (user:pass@) — use a credentialRef (D-11)";
+    return "remote url embeds credentials (user:pass@) — use a stored credential instead";
   }
   if (parsed.hostname === "") {
     return "remote url has no host";
diff --git a/packages/data-bundle/src/session.ts b/packages/data-bundle/src/session.ts
index 1aa2f87..1bc473f 100644
--- a/packages/data-bundle/src/session.ts
+++ b/packages/data-bundle/src/session.ts
@@ -481,7 +481,7 @@ export interface DataMergeExport {
 }
 
 export const NO_NEW_DOCUMENT_DOOR =
-  "this host cannot open a second document (no documents door, D-26) — merge into the current document instead";
+  "this editor version cannot open a second document — merge into the current document instead";
 
 /** The session API the panels + commands drive. */
 export interface DataSourceSession extends ReviewSession, PropertyMethods {
@@ -2309,7 +2309,7 @@ export function createSession(rawHost: BundleHost, today: number): DataSourceSes
         credentialRef: options?.credentialRef,
         consent: "required",
         status: "inert",
-        message: "Inert — origin consent required before any fetch (D-03).",
+        message: "Inert — allow this origin before anything is fetched.",
         contentKey: null,
       });
       markDirty();
@@ -2711,8 +2711,8 @@ export function createSession(rawHost: BundleHost, today: number): DataSourceSes
         state.message =
           `Captured ${names.length} data set(s) from "${queryId}".` +
           (bytes > CAP * 0.8
-            ? ` WARNING: the variable payload is ${bytes} bytes of the ${CAP}-byte ` +
-              "document-metadata cap (D-08) — delete data sets or capture fewer records."
+            ? ` WARNING: the captured data sets take ${bytes} of the ${CAP} bytes a ` +
+              "document can store for them — delete data sets or capture fewer records."
             : "");
         return names;
       } catch (err) {