Feature: `rtk gain --misses` to surface unrewritten high-volume commands

Summary

rtk gain exposes --failures (commands that fell back to raw exec after rtk parse error), but there's no way to discover commands that never reached rtk in the first place — i.e. shell invocations the registry didn't know how to rewrite. These are the highest-leverage candidates for new registry rules.

Proposing rtk gain --misses (or rtk gain --uncovered) that surfaces a frequency-ranked list of commands seen in the user's session history that did NOT trigger a rewrite.

Use case

I just shipped a user-side analog as a Claude Code PostToolUse hook (rtk-miss-detector.sh):

#!/usr/bin/env bash
INPUT=$(cat)
CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
[ -z "$CMD" ] && exit 0
case "${CMD}" in rtk\ *|*\ \|\ rtk\ *) exit 0 ;; esac
STDOUT=$(echo "$INPUT" | jq -r '.tool_response.stdout // empty')
if [ ${#STDOUT} -ge 5120 ]; then
  jq -nc --arg cmd "$CMD" --argjson b ${#STDOUT} \
    '{ts: now|todate, cmd: $cmd, bytes: $b}' >> ~/.claude/rtk-misses.log
fi

This works but is duplicative — rtk already has the tracking infrastructure in place (history_days = 90 in config.toml, rtk gain --history). All that's needed is a query that filters: commands NOT prefixed with "rtk ", grouped by argv[0], ranked by frequency × output size.

Proposed output

$ rtk gain --misses --top 10

Top unrewritten commands by impact (last 30d)
─────────────────────────────────────────────────
  #  Command       Calls   Avg out   Total bytes   Rule candidate?
─────────────────────────────────────────────────
 1.  awk            487      4.2KB     2.0MB        — (custom rule)
 2.  lsof            89     12.1KB     1.1MB        rtk lsof
 3.  ss              52      8.4KB     436KB        rtk net
 4.  journalctl      31     22.0KB     682KB        rtk log (extend?)
 5.  history          5      9.1KB      45KB        — (one-shot)

Why this matters

• Closes the discovery loop. Today, registry expansion is reactive (someone notices wc is missing and files an issue — see #1682). --misses makes it proactive: rtk tells the user "you ran lsof -i 89 times this month, here's the bytes you could have saved."
• Drives the right kind of contribution. A user with this output can file a much higher-quality issue ("here's a command that costs me ~12KB per call, please add a wrapper") than one fishing for ideas.
• Pairs with existing rtk gain --failures. Same surface, complementary axis: --failures = "rtk tried and failed", --misses = "rtk never got the chance".

Implementation note

The data is already collected (tracking.enabled = true by default). This should be a SELECT on the existing history store, not new instrumentation.

Happy to dogfood a branch.

---

Context: rtk 0.34.1, 10,363 tracked commands locally, 9.5M tokens saved. Filing alongside #1682 (registry gap) and a comment on #1375 (overhead).