feat(cli): scoped maple delete (service, namespace, env) for the loca…

…l store (#1203)

* feat(cli): scoped `maple delete` for the local store

Deleting from traces left about 20 derived tables holding the rows, so
`maple reset` was the only clean option. `maple delete --service <name>
[--env <env>] [--before <time>]` removes one service's telemetry from the
raw tables and every derived table and rollup.

Every schema table is classified in TABLE_DELETE_PLAN (filter, rebuild
from surviving source rows, or excluded) and validated against the
schema manifest; a test fails when a table is added unclassified. The
delete runs server-side behind the maintenance token inside the
admission gate, is journaled so a partial run resumes, and marks the
store changed so the next checkpoint refresh runs. Local-only.

* feat(cli): maple delete --namespace

Shared local Maples run throwaway environments as service.namespaces,
often with the same service names in each. `--namespace` deletes one
namespace's telemetry alone or together with `--service`.

Tables now declare which of service, namespace and env they filter
exactly; a request naming one a table lacks recomputes the affected
hours scoped to the dimensions it does key on, through its own views in
dependency order (so cascades like service_operations_minutely into
_hourly are wiped and redone) or, for the service map tables, by
re-running the hourly rollup for sealed hours. The validator checks the
plan for every flag combination.

* fix(cli): send the maintenance token only to the store's own server

maple delete read the token beside whatever dataDir /local/status
claimed, so any server at the resolved URL could collect another store's
token. It now requires a loopback target and a live server that the
store's own discovery file names (same pid, dataDir and port).

* fix(cli): report an out-of-range delete flag as invalid, not as a missing selector

fix(cli): realign remote mode with the current v2 API (#759)

Remote mode had drifted from the v2 contract in three ways.

Two commands printed different columns depending on which backend
answered, contradicting the rule that an operation returns the same
shape in both modes. `maple metrics` passed the v2 resource straight
through (`name`, `service_name`, `data_point_count`) where local mode
returns the warehouse's `ListMetricsOutput` (`metricName`,
`serviceName`, `dataPointCount`); `maple timeseries` and `maple
breakdown` emitted `timestamp`/`group`/`avgDurationMs` against local's
`bucket`/`groupName`/`avgDuration`. Both now map onto local mode's row
shape. Neither was typechecked — the local side goes through the
untyped executor — so a test now pins the column names.

`maple error <fingerprint-hash>` refused remotely on the grounds that
v2 had no way in from a fingerprint hash. `/v2/error_issues` has taken
a `fingerprint_hash` filter since 0432f69, so the command now runs
remotely: fingerprint to issue, issue detail for the timeseries and
sample traces, then a per-trace fetch for the span count, services and
root span name the sample does not carry. It reads triage issues, not
raw error events, so a fingerprint no sweep has turned into an issue
fails with that reason rather than showing an empty page.

Trace search had a latent silent drop: the span-name guard let a
`--root-only` call through to a filter that never included `span_name`.
No such flag exists, so the branch was unreachable, but the refusal was
also wrong about why — v2 matches a span name exactly and returns root
summaries, where `--span-name` means a substring match over spans.

The remaining refusals were re-checked against the live contract and
still hold: attribute discovery, sorting trace search by duration, a
combined operation ranking, window comparison, raw SQL and `--offset`.
Their wording, and the local-mode and migration docs, cited an
`erris_…` issue id; the prefix is `iss_`, and the real blocker for
`maple errors` is that one issue per fingerprint cannot say how many
services an error spans.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

otel-collector-maple 0.2.0

Adds the dockerstatsreceiver and the baked Docker agent config at
/etc/otel/docker-config.yaml, including transform/compose which promotes
compose.project/service from datapoint to resource attributes.

maple-otel 0.3.0

First publish under the mapletechlabs namespace. appVersion 0.1.5 -> 0.2.0.

maple-k8s-infra 0.6.0

First publish under the mapletechlabs namespace. Collector image pin rolled
0.1.5 -> 0.2.0.

feat(web): rebuild the session flow view on React Flow with category …

…icons (#621)

The flow tab drew its own scaled div canvas with per-lane SVG connectors;
it now hands the same hand-computed lane layout to @xyflow/react — the
split investigations/flow already uses — so pan, zoom and edge drawing
come from the shared canvas instead of a bespoke scroller. Nodes declare
their dimensions and handle spots up front, so edges draw on the first
frame (and under jsdom, which never runs a ResizeObserver pass).

The category dots become glyphs from the shared icon set — robot for
agent, sparkle for inference, gear for tool, a red cross for a failure —
in the node cards and the legend both, so the kind of work reads by
shape rather than by hue alone.

v0.0.20

fix(cli): recovery advice after an unclean shutdown now names a command that
works — no more pointing at a checkpoint that was never taken.

v0.0.18

fix(traces): the trace view now corrects for clock skew between services, so a
child span recorded outside its parent is drawn nested inside it (Jaeger-style
centring) with a 'clock skew adjusted' badge, instead of floating past the
parent on an over-wide axis.

v0.0.17

fix(local): pin the embedded chDB engine to UTC. On hosts outside UTC every
time window was skewed by the UTC offset, so recent traces were invisible and
stale ones looked current. Repairs existing stores too.