test(parsers): the hermes fixture the allowlist was standing in for

[pitimon]

Summary

Closes the last DoD item on #104 — the hermes fixture the allowlist was standing in for.

The allowlist entry said a fixture "needs a real schema, not a JSONL line". It does, so this builds one. node:sqlite ships with Node 22+, already the floor here, and readHermesSessions falls back to it when the sqlite3 CLI is absent.

Allowlist 21 → 20, with max_size lowered in the same commit as the ratchet requires.

What the fixture actually covers

Schema taken from the parser's own query (rollout.js:3216), not guessed. started_at/ended_at are epoch seconds, and the bucket comes from ended_at ?? started_at.

Three sessions across two databases, because the profile walk is what is unique to this parser:

• hermes/state.db — a finished session with every column filled, plus one with cache and reasoning at zero, which still has to satisfy the column sum rather than be excused from it
• hermes/profiles/work/state.db — a second database that must be picked up
• hermes/profiles/empty/ — a profile directory with no database, which must be skipped rather than throw

Verified by reading the emitted rows, not the exit code: 3 sessions → 2 buckets grouped by model, 4290+820+15000+300+120 = 20530 and 500+60+0+0+40 = 600, and claude-opus-5 present proves the profile database was read.

A flake this run surfaced, fixed in the second commit

I introduced it in #117 and had not seen it until now.

Giving the notify handler an isolated HOME was the right fix — it stopped the child resolving the developer's real ~/.tokentracker. But the handler deliberately spawns a detached background sync, and that sync now writes inside the test's own temp directory. The write can land after execFile's callback fires, so the fs.rm in finally races it and fails with ENOTEMPTY.

Cleanup retries rather than waiting on a process the handler detaches on purpose. Verified by running the file 5 times: 19 pass, 0 fail, every run — a single green run proves nothing about a race.

Process error worth recording

The hermes commit landed on a red gate. I ran ci:local and chained the commit after echo "exit=$?", which always succeeds, so the && never gated on the failing suite. Fixed by capturing the exit code into a variable and testing it. The failure was the flake above, now fixed, and the branch is green — but the guard failed open and that is worth naming.

Test plan

• ci:local exit 0 — 933 root tests, 262 dashboard
• test/init-uninstall.test.js run 5× consecutively: 19 pass, 0 fail each time
• Conformance harness: 10 pass, hermes included
• Emitted rows inspected by hand for both databases and the column sums

Remaining on #104

20 parsers still on the allowlist, each with a recorded reason. The ratchet is what makes those get written as anyone touches them.