## Description
Don't use trunk, because if a vulnerability fix has been merged, this
requires PRs to rebase. Instead, try to find a merge base where possible
and use that as the reference point to ensure no new vulnerabilities are
being introduced by a PR.

## Motivation and Context
Recent OWASP job failures

## Impact
Less false positives from the OWASP job

## Test Plan
Old commit without newer security vulnerability fixes doesn't trigger
OWASP failure anymore: tdcmeehan#12
Previous vulnerability detection continues to work:
tdcmeehan#13

## Contributor checklist

- [ ] Please make sure your submission complies with our [contributing
guide](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md),
in particular [code
style](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md#code-style)
and [commit
standards](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md#commit-standards).
- [ ] PR description addresses the issue accurately and concisely. If
the change is non-trivial, a GitHub Issue is referenced.
- [ ] Documented new properties (with its default value), SQL syntax,
functions, or other functionality.
- [ ] If release notes are required, they follow the [release notes
guidelines](https://github.com/prestodb/presto/wiki/Release-Notes-Guidelines).
- [ ] Adequate tests were added if applicable.
- [ ] CI passed.
- [ ] If adding new dependencies, verified they have an [OpenSSF
Scorecard](https://securityscorecards.dev/#the-checks) score of 5.0 or
higher (or obtained explicit TSC approval for lower scores).

## Release Notes

```
== NO RELEASE NOTE ==
```

New issues:
- #13: Cost model assumes local NVMe, invalid for S3/HDFS (0.3s becomes 5-30s)
- #14: Parquet BF section is 115-line dead end, should be condensed
- #15: Duplicate section numbering (two "Section 6" headers)
- prestodb#16: Superlinear join efficiency claims lack citations
- prestodb#17: CTE materialization cost missing from quantitative cost model
- prestodb#18: Reduced hash table may still exceed VRAM — fallback composition unclear

Updated existing issues: #1,#3 remaining gaps noted, #2 now worse (more
occurrences), #7 partially addressed. 12 open issues total.

https://claude.ai/code/session_01SAXk4AS8yQyQkhRVi6RQie

RPT overhead is higher on remote storage (1-4s vs 0.3s for local NVMe), but
RPT's value scales proportionally — savings also grow with slower storage.
Net speedup ratio (~3.5x with 90% selectivity) is roughly constant across
storage tiers. Add per-tier cost tables, storage-aware RPT skip threshold,
and note that GPU instances have 400-3200 Gbps S3 bandwidth (far higher
than CPU instances).

https://claude.ai/code/session_01SAXk4AS8yQyQkhRVi6RQie

Issue #13: multi-tier storage cost model added to main doc. RPT speedup ratio
is roughly constant across storage tiers (~3.5x). Remaining gap: S3 monetary
cost not modeled.

Issue #14: Section condensed from 115 to 18 lines, detailed analysis moved to
companion doc. Open Question 10 removed as moot.

10 open issues remain.

https://claude.ai/code/session_01SAXk4AS8yQyQkhRVi6RQie