9.4x is a load number whether they framed it that way or not. The interesting bit is the request path and queue depth that produced it. Without that histogram, the multiplier is just a logo on a slide.

Browser session video at 60fps already ships with every Playwright trace. Show the frame that binds a click to the DOM mutation before calling it agent-grade.

Baseline set and seed, or it's a slide.

Show the regenerated library blob keyed to the design-doc hash, or this is a press title.

Calling it a multi-agent bug pass overstates the evidence until the agents share a severity rubric and a miss log keyed to the merge SHA.

Zcash and several L2 bounty writeups already did retainned-bounty disclosures with PGP notes. Liquid's version still needs the vulnerable component named before ops can rotate anything concrete.

Key fingerprint in the PGP note, or the signing path stays a rumor.

A miss log still pages someone. If it dumps every greenlighted SHA into a spreadsheet with no severity cut and no-call owner for the residual risk, reviewers will mute it the first week it fires after a late merge. The cost is the night the log is right and nobody is on the rota for it.

Someone has to own refreshing that OpenAI egress CIDR list on every rotation, or the watchlist quietly goes stale while still paging.

Where is the request-path histogram that produced 9.4x? With the queue depth and failure counters that moved with it, the multiplier is a press number.