fix: disable unsafe historical Hermes reconciliation

src/cli.js

@@ -61,7 +61,7 @@ function printHelp() {
       "  npx --yes @ipv9/tokentracker-cli                                         Start local dashboard",
       "  npx --yes @ipv9/tokentracker-cli [--debug] serve [--port 7680] [--open] [--no-open] [--sync]",
       "  npx --yes @ipv9/tokentracker-cli [--debug] init [--yes] [--dry-run] [--no-open]",
-      "  npx --yes @ipv9/tokentracker-cli [--debug] sync [--auto] [--drain] [--from-openclaw] [--compact] [--repair-grok] [--reconcile-hermes]",
+      "  npx --yes @ipv9/tokentracker-cli [--debug] sync [--auto] [--drain] [--from-openclaw] [--compact] [--repair-grok]",
       "  npx --yes @ipv9/tokentracker-cli [--debug] status [--probe-keychain] [--probe-keychain-details]",
       "  npx --yes @ipv9/tokentracker-cli [--debug] diagnostics [--out diagnostics.json]",
       "  npx --yes @ipv9/tokentracker-cli [--debug] doctor [--json] [--out doctor.json]",

src/commands/sync.js

@@ -125,6 +125,11 @@ const CLAUDE_GROUND_TRUTH_REPAIR_KEY = "claudeGroundTruthRepair_2026_05_v4";
 
 async function cmdSync(argv) {
   const opts = parseArgs(argv);
+  if (opts.reconcileHermes) {
+    throw new Error(
+      "Historical Hermes reconciliation is disabled: session_model_usage has cumulative totals but no temporal delta ledger, so rebuilding daily/hourly buckets would misattribute long-running sessions."
+    );
+  }
   const home = os.homedir();
   const { trackerDir } = await resolveTrackerPaths({ home });
 

test/sync-unsafe-hermes-reconciliation.test.js

@@ -0,0 +1,28 @@
+const assert = require("node:assert/strict");
+const fs = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+const { test } = require("node:test");
+
+const { cmdSync } = require("../src/commands/sync");
+
+test("sync --reconcile-hermes fails closed before creating tracker state", async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "tokentracker-unsafe-hermes-reconcile-"));
+  const previousHome = process.env.HOME;
+  try {
+    process.env.HOME = tmp;
+
+    await assert.rejects(
+      () => cmdSync(["--reconcile-hermes"]),
+      /historical Hermes reconciliation is disabled.*temporal/i,
+    );
+    await assert.rejects(
+      () => fs.stat(path.join(tmp, ".tokentracker", "tracker")),
+      { code: "ENOENT" },
+    );
+  } finally {
+    if (previousHome === undefined) delete process.env.HOME;
+    else process.env.HOME = previousHome;
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});