It is a pity thd Hermes source code was not released, as Laurence Reeves did a lot of work debugging the 8049 IPC.
The Hermes code was programmed into a Intel 8749 programmable rom, if the Hermes source code is the same as the Minvera aource, there would many comments on the code, whoch also help.
The original source - a copy of which is on "the distribution" and on Dilwyn's site is documented, and I've also found some old MCS-48 documentation. This has some notes on doing serial receive/transmit with 4x oversampling using the timer on the 8049, which I think is what Hermes also does. There is a comment in the source code example saying that there is some free cycles to do other things on a regular timer interrupt basis such as scan a keyboard, etc - so I am thinking this is a good basis for re engineering it.
The Hermes documentation also tells you what Hermes fixes - although reading the original source to see why it is broken is difficult to say the least.