rtk discover reports false positives - doesn't account for hook-rewritten commands

Summary

rtk discover scans Claude Code JSONL session logs to identify commands that could benefit from RTK filtering. However, these logs record commands before the PreToolUse hook rewrites them - so discover never sees the rtk prefix and reports them all as missed.

This makes discover metrics unreliable for anyone using the hook-based setup from rtk init -g.

Repro

1. Install RTK with rtk init -g (hook-based setup)
2. Run a Claude Code session with several Bash commands
3. Verify commands are processed: rtk gain shows them correctly
4. Run rtk discover --since 1 - the same commands show up as missed

Example

$ rtk gain
Total commands:    420

$ rtk discover --since 2
Scanned: 133 sessions (last 2 days), 1134 Bash commands
Already using RTK: 7 commands (0%)

MISSED SAVINGS -- Commands RTK already handles
  git diff    242    ~100.2K tokens
  find        209    ~63.5K tokens
  grep -n     161    ~33.4K tokens
  ...
Total: 719 commands -> ~209.5K tokens saveable

420 commands went through RTK according to gain, but discover only finds 7 because the JSONL stores the pre-rewrite command.

Root cause

Claude Code logs the original tool_input.command to the session JSONL, not the rewritten version from the hook output. discover pattern-matches against these raw entries and never finds an rtk prefix.

Suggestion

Cross-reference discover results with RTK's own execution history, or flag in the output that hook-rewritten commands can't be detected from JSONL alone.

Related

• #888 (discover classification improvements)
• #907 (same symptom reported, no root cause identified)