rtk learn: parallel-tool-call cancellations misclassified as CLI errors, swamping output

Problem

rtk learn -w on a 30-day window (795 sessions, this is a Claude Code project) produced a 5,060-line / 251 KB .claude/rules/cli-corrections.md. The vast majority of "corrections" are not corrections at all — they are user-initiated cancellations of fan-out parallel tool calls, which Claude Code surfaces as:

<tool_use_error>Cancelled: parallel tool call Bash(...) errored</tool_use_error>

When the user Ctrl-Cs one branch of an N-way parallel call, RTK reads the next adjacent command as "the working alternative" and emits a rule of the form Use X not Y. Both X and Y are usually fine — the user just stopped one branch.

Repro

A typical entry from the generated file:

[7x] git show <sha> --no-stat -p -- backend/app/features/memory/data/memory_repository.py
   →  git show <sha> --no-stat -p -- backend/app/features/memory/data/schema.py
   Error: <tool_use_error>Cancelled: parallel tool call Bash(git show <sha> --no-stat -p -- ...)

There is no error in either command. The user fired both git show calls in parallel for two different files and cancelled the slower one. RTK now believes "don't use the memory_repository.py path, use schema.py instead."

Impact

• Output is dominated by these false positives — manual triage is impractical at 5K lines.
• Loading the file into every session would blow the context budget for negligible signal.
• Real corrections (e.g. uv run ruff check → uv run pyrefly check for typecheck) are buried under hundreds of fake ones.
• File is unusable as-is for any project that uses parallel tool calls heavily (i.e., most modern Claude Code projects).

Suggested fixes

1. Filter tool_use_error: Cancelled from the input set entirely. It's a user signal, not a CLI failure. The error text is consistent and easy to match.
2. Treat "parallel tool call errored" specifically as cancellation — the sibling commands in the same parallel group are co-equal, not before/after.
3. Consider filtering by exit code semantics: only treat exits caused by the callee (non-zero from the tool) as corrections, not exits caused by the caller (Claude / user cancel).
4. Raising --min-confidence / --min-occurrences defaults won't fix this — the cancellations are highly repetitive and would clear any threshold.

Related

• #654 (generalizable patterns) — adjacent but different concern.
• #651 (sanitize sensitive data) — also relevant; the file leaked internal pod names, AWS account IDs, spreadsheet IDs.

Versions: rtk 0.38.0 / Claude Code (current).