feat(platform): complete the Gelios external data loop

services/ontology-core/docs/GELIOS_DOMAIN_ONTOLOGY.md

@@ -2,7 +2,7 @@
 
 Package: `catalog/domain-packages/gelios`
 
-Status: `v1.0.0`, source-evidenced and product-required.
+Status: `v1.1.0`, source-evidenced and product-required.
 
 ## Purpose and boundary
 
@@ -15,8 +15,8 @@ model. Runtime transport, collection cadence and semantic mapping belong to an
 isolated NDC L2 connection instance. External Data Plane persists and delivers
 provider-neutral Data Products. Ontology Core describes meaning only.
 
-The matching contract/data artifact is
-`platform/packages/external-provider-contract/providers/gelios/v1`. Adding a
+The current matching contract/data artifact is
+`platform/packages/external-provider-contract/providers/gelios/v4`. Adding a
 second account creates another connection instance with different opaque
 credential references; it does not create another ontology package, Platform
 service or custom node.
@@ -24,14 +24,15 @@ service or custom node.
 ## Provider authentication boundary
 
 Gelios issues exactly two provider secret artifacts: an access token and a
-refresh token. The current NDC L2 `httpBearerAuth` request binding uses the
-access token. Automatic refresh has not been proven in the deployed runtime, so
-the matching provider package records refresh as `operator_managed`; neither
-token value belongs in Ontology, a workflow graph, MCP, Ops or a trace.
+refresh token. The current rotating credential uses the access token for
+requests and keeps refresh inside native NDC L2 Credentials; neither token
+value belongs in Ontology, a workflow graph, MCP, Ops or a trace.
 
 A credential label such as `read access` is operator metadata, not a Gelios
-token scope. `gelios.units.current.read` is classified as read because the
-approved workflow transport is `GET /api/v1/units`. The label does not create a
+token scope. `gelios.units.current.read` and
+`gelios.monitoring_config.current.read` are classified as read because the
+approved transports are `GET /api/v1/units` and
+`GET /api/v1/users/me/monitoring-config`. The label does not create a
 separate read token or constrain other rights that Gelios may have granted to
 the same access token. The scoped Data Product writer credential later in the
 runtime path is an internal NDC/External Data Plane capability, not a third
@@ -66,7 +67,7 @@ parsed or renumbered. A unit can use a
 expose sensor, fuel, maintenance and custom-field configurations.
 
 Hardware IDs, IMEI, phones, address, decrypt-related fields, raw `params` and
-unclassified sensor payloads are excluded by the v1 field policy. New provider
+unclassified sensor payloads are excluded by the current field policy. New provider
 fields remain dropped until they are evidenced, classified and introduced by a
 new package/ontology revision.
 
@@ -76,12 +77,12 @@ new package/ontology revision.
 `gelios.position_fix` is its time-qualified spatial portion; it is not a pin or
 other renderer object.
 
-The first approved output is exactly:
+The current approved output is exactly:
 
 ```text
-Data Product:       fleet.positions.current.v1
-version:            1.0.0
-ontology revision:  ontology.map.moving_object.v1
+Data Product:       fleet.positions.current.v3
+version:            3.0.0
+ontology revision:  ontology.map.moving_object.v3
 semantic type:      map.moving_object
 delivery:           snapshot+patch
 history:            sampled, latest entity per 60-second bucket, 90 days
@@ -96,21 +97,51 @@ elevation_meters
 geometry
 hdop
 horizontal_accuracy_meters
+movement_state
 object_kind
-operational_status
 position_source
-position_valid
-quality_flags
 satellite_count
+signal_state
 speed_kph
 ```
 
 All attribute names are snake_case. GeoJSON `geometry` is omitted when valid
-coordinates are unavailable, but the unit remains in the product with
-`position_valid=false`, `operational_status=no_position` and appropriate
-`quality_flags`. If the provider has no last-message timestamp, the collection
-receive time becomes the explicit `observedAt` fallback so the credential-visible
-unit is not silently dropped.
+coordinates are unavailable, but the unit remains in the product. Missing
+geometry is not converted into a Gelios monitoring status. If the provider has
+no last-message timestamp, the collection receive time becomes the explicit
+`observedAt` fallback so the credential-visible unit is not silently dropped.
+
+### Official monitoring states
+
+Gelios does not return a ready-made operational-status enum from
+`GET /api/v1/units`. Its monitoring client derives two independent, closed
+value contracts from official source facts and settings:
+
+```text
+signal_state:
+  active   -> На связи / Active units
+  inactive -> Не на связи / Inactive units
+
+movement_state:
+  moving -> В движении / Moving units
+  stopped -> Неподвижные / Stopped units
+```
+
+The official client first marks a unit active while the age of `lastMsg.time`
+is below `monitoring-config.signalActiveDuration`, then keeps it active through
+the positive `signalSomewhatInactiveDuration` window. A missing message is
+inactive. When an account returns empty monitoring durations, the connection
+profile may supply an explicit, versioned positive fallback; its provenance is
+runtime policy and does not create another ontology state. Without a resolved
+positive threshold publication must fail closed. `movement_state=moving` when
+the integer `lastMsg.speed` is greater than `2`; otherwise it is `stopped`.
+The values and Russian labels are the official Gelios monitoring-client
+contract.
+
+There is no `unknown`, `fresh`, `stale`, GPS-quality, position-quality,
+`parked`, `no_position` or aggregate `operational_status` value in this
+contract. `gelios.operational_status` is retained in the catalog only as a
+`tech-debt-noncanonical` marker for retiring old v1/v2 products.
 
 ### Sensors and operational semantics
 
@@ -128,7 +159,7 @@ Gelios is a source domain. The provider-neutral relation is:
 ```text
 gelios.unit + gelios.position_fix
   -> map.moving_object
-  -> fleet.positions.current.v1
+  -> fleet.positions.current.v3
   -> Foundry Data Product binding
   -> map layers, selection and telemetry panel
 ```
@@ -148,7 +179,7 @@ concepts. `gelios.command_dispatch`, `gelios.command_delivery` and
 No collection run, workflow, map click or autonomous agent may create a
 dispatch. A future command path requires explicit human intent, confirmation,
 separate authorization, immutable audit and delivery reconciliation. This
-ontology and the Gelios v1 provider package expose no command transport.
+ontology and the Gelios v4 provider package expose no command transport.
 
 ## Canonical runtime flow
 
@@ -182,6 +213,9 @@ physical storage.
   temporary credential issuance, configuration mutation and downloads remain
   excluded until separately classified.
 - Dynamic provider fields are dropped until evidenced and classified.
+- Gelios monitoring filters use only the exact `signal_state` and
+  `movement_state` value contracts. L2, Data Products and Foundry cannot add
+  fallback state values.
 - Geozones and history require bounded loading, paging/cursors, retention and
   volume controls.
 - Command send and mutation capabilities remain red even when provider access