@@ -8,6 +8,25 @@ All notable changes to this project are documented here. Format follows
 
 ### Added
 
+- **"Ask for a profile", an action that hands the choice back to the driver.** "Apply a
+  profile" decides alone, which is right for a rule that knows the answer and wrong for the
+  ones that do not: arriving at a charger, the profile to apply depends on what the driver
+  is about to do, and no condition reads that. The action asks MG4Control to open its own
+  profile picker, and the driver taps. It needs MG4Control like the profile action does, and
+  carries the same "when stopped only" mark — MG4Control refuses to put the picker in front
+  of a moving driver. A refusal is never deferred to the next standstill: a question shown
+  at the next red light would reach a driver who is no longer asking it.
+- **Two Bluetooth conditions that tell a phone in the car from a phone merely near it.**
+  "Phone connected" is a radio fact and answers yes for a phone left in the house while the
+  car is parked outside it, which made arrival rules fire on the driveway. **Phone on
+  board** is true only of a device still connected once the car has driven — a phone that
+  stayed behind has dropped off the link by then. It is unreadable, and so unevaluable,
+  until the car has actually moved; rules that must act at ignition should keep using
+  "phone connected" gated on a vehicle signal. **Hands-free phone** is the one the head
+  unit routes calls through: it answers from the first second and is what separates two
+  phones both in range. The diagnostic screen reports both, and says "the car has not
+  driven yet" rather than blaming the Bluetooth radio.
+
 - **"else if" and "else" cases in a rule.** Cases are tried in the order written and exactly
   one runs: the first whose conditions hold, or the "else" when none did. An unreadable
   condition stops the rule where it stands instead of falling through to the next case or to
 
@@ -226,6 +226,16 @@ regeneration, energy saving), **energy** (battery level, charging, charge limit)
 (seat/steering heating, media volume, brightness), and **driver assistance** (AEB, ELK,
 ACC/TJA, limiter, TSR, overspeed, speed-limit tone, ADAS sound).
 
+Three Bluetooth conditions, and the difference between them is the whole point. **Phone
+connected** is a radio fact: it is true of a phone left indoors while the car is parked in
+front of the house, which is what made arrival rules fire on the driveway. **Phone on
+board** is only true of a device still connected once the car has actually driven, so a
+phone that stayed behind drops out of it — at the cost of being unreadable, and therefore
+unevaluable, until the first few hundred metres. **Hands-free phone** is the one the head
+unit chose to route calls through: available from the first second, and the way to tell two
+phones apart when both are in range. A rule that must act at ignition should use *phone
+connected* together with a vehicle signal (ignition, speed, not in park) instead.
+
 Actions cover **profile** application, **driving**, **comfort**, **climate** (on/off, target
 temperature, A/C, AUTO, recirculation, fan level, front and rear defrosters), **energy**
 (charge limit, allow charging, scheduled charging and its window, battery pre-heating),
 
@@ -8,6 +8,7 @@
      becomes available (via its signature-protected bridge). That is the only capability
      that needs MG4Control. -->
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
     android:sharedUserId="android.uid.system">
 
     <!-- Vehicle access (Android Automotive / SAIC) — same set MG4Control uses. -->
@@ -33,6 +34,12 @@
     <!-- Bluetooth: paired list for the editor, and live connection tracking for rules. -->
     <uses-permission android:name="android.permission.BLUETOOTH" />
     <uses-permission android:name="android.permission.BLUETOOTH_CONNECT" />
+    <!-- Reads which phone the head unit made hands-free, for the "hands-free phone"
+         condition. Granted by the platform signature; without it that one condition
+         reports as unreadable and nothing else changes. -->
+    <uses-permission
+        android:name="android.permission.BLUETOOTH_PRIVILEGED"
+        tools:ignore="ProtectedPermissions" />
     <!-- Requested only when the user chooses "Call a contact". The OEM PBAP client
          publishes the paired phone's downloaded phone book through ContactsContract. -->
     <uses-permission android:name="android.permission.READ_CONTACTS" />
 
@@ -24,4 +24,12 @@ interface IProfileControl {
      * "detail" String optional.
      */
     Bundle applyProfile(String profileId);
+
+    /**
+     * Shows MG4Control's profile picker overlay and leaves the choice to the driver.
+     * Same result keys as applyProfile. Refused while the car moves or when its speed is
+     * unreadable — the picker exists to apply a profile — and UNSUPPORTED when MG4Control
+     * holds no profile to offer.
+     */
+    Bundle showProfilePicker();
 }
@@ -80,6 +80,10 @@ object Diagnostics {
         NO_NAVIGATION_APP,
         /** No location permission, or no fix recent enough to place the car. */
         NO_LOCATION,
+        /** The car has not moved yet, so no device can be called "on board". */
+        NOT_DRIVEN_YET,
+        /** The platform would not say which phone the head unit made hands-free. */
+        NO_HANDSFREE_INFO,
     }
 
     /**
@@ -177,18 +181,27 @@ object Diagnostics {
      * them would point whoever reads the report at the wrong subsystem.
      */
     private fun unavailableReason(type: ConditionType, snapshot: Snapshot): Reason = when {
+        // Order matters: with the radio off nothing is knowable, and saying "the car has
+        // not moved yet" would send the reader looking for a drive instead of a switch.
+        !snapshot.btAvailable && type in BLUETOOTH_CONDITIONS -> Reason.BLUETOOTH_OFF
+        type == ConditionType.BT_DEVICE_ONBOARD -> Reason.NOT_DRIVEN_YET
+        type == ConditionType.BT_DEVICE_HANDSFREE -> Reason.NO_HANDSFREE_INFO
         type in BLUETOOTH_CONDITIONS -> Reason.BLUETOOTH_OFF
         type == ConditionType.LOCATION_WITHIN -> Reason.NO_LOCATION
         !snapshot.bridgeAvailable -> Reason.LAYER_NOT_READY
         else -> Reason.NOT_READABLE
     }
 
-    private val BLUETOOTH_CONDITIONS =
-        setOf(ConditionType.BT_DEVICE_CONNECTED, ConditionType.ANY_BT_CONNECTED)
+    private val BLUETOOTH_CONDITIONS = setOf(
+        ConditionType.BT_DEVICE_CONNECTED,
+        ConditionType.ANY_BT_CONNECTED,
+        ConditionType.BT_DEVICE_ONBOARD,
+        ConditionType.BT_DEVICE_HANDSFREE
+    )
 
     /** The first check [com.mg4.tasker.vehicle.DirectExecutor] would fail on, in its own order. */
     private fun blockingReason(type: ActionType, caps: Capabilities): Reason = when (type) {
-        ActionType.APPLY_PROFILE -> when {
+        ActionType.APPLY_PROFILE, ActionType.SHOW_PROFILE_PICKER -> when {
             !caps.mg4ControlInstalled -> Reason.NO_MG4CONTROL
             !caps.profileBridgeReachable -> Reason.MG4CONTROL_UNREACHABLE
             else -> gateReason(type, caps)
@@ -252,7 +265,9 @@ object Diagnostics {
         type = type,
         op = CompareOp.EQ,
         text = when (type) {
-            ConditionType.BT_DEVICE_CONNECTED -> PROBE_MAC
+            ConditionType.BT_DEVICE_CONNECTED,
+            ConditionType.BT_DEVICE_ONBOARD,
+            ConditionType.BT_DEVICE_HANDSFREE -> PROBE_MAC
             ConditionType.LOCATION_WITHIN -> PROBE_POINT
             ConditionType.DATE -> java.time.LocalDate.now().toString()
             else -> ""
@@ -273,6 +288,11 @@ object Diagnostics {
         ConditionType.DATE -> snapshot.localDate
         ConditionType.ANY_BT_CONNECTED -> snapshot.btMacs.isNotEmpty()
         ConditionType.BT_DEVICE_CONNECTED -> snapshot.btMacs.sorted().joinToString(", ")
+        // Null never reaches here — an unavailable condition reports its reason instead —
+        // but the empty set does, and "connected, none of them travelling" is exactly the
+        // state a user misreads.
+        ConditionType.BT_DEVICE_ONBOARD -> snapshot.btOnboardMacs?.sorted()?.joinToString(", ")
+        ConditionType.BT_DEVICE_HANDSFREE -> snapshot.btHandsFreeMacs?.sorted()?.joinToString(", ")
         // Where the car thinks it is, which is the only way to tell a radius that is too
         // small from a fix that is simply wrong.
         ConditionType.LOCATION_WITHIN ->
 
@@ -59,8 +59,16 @@ object ConditionEvaluator {
         // irrelevant here — Bluetooth is context, not a vehicle signal.
         if (!s.btAvailable) return ConditionOutcome.UNAVAILABLE
         if (c.text.isBlank()) return ConditionOutcome.UNAVAILABLE
-        val connected = s.btMacs.any { it.equals(c.text, ignoreCase = true) }
-        return match(connected == c.flag)
+        // Three questions, not one. "Connected" is a radio fact and answers yes for a phone
+        // left in a house the car is parked beside; the other two are about which phone is
+        // actually travelling. A null set is "not knowable yet", never "no".
+        val macs = when (c.type) {
+            ConditionType.BT_DEVICE_ONBOARD -> s.btOnboardMacs ?: return ConditionOutcome.UNAVAILABLE
+            ConditionType.BT_DEVICE_HANDSFREE -> s.btHandsFreeMacs ?: return ConditionOutcome.UNAVAILABLE
+            else -> s.btMacs
+        }
+        val present = macs.any { it.equals(c.text, ignoreCase = true) }
+        return match(present == c.flag)
     }
 
     /**
 
@@ -20,6 +20,22 @@ data class Snapshot(
      * phone is paired to the head unit.
      */
     val btAvailable: Boolean = true,
+    /**
+     * MAC addresses of devices that were still connected once the car had moved — the ones
+     * that are in it rather than merely in range of it.
+     *
+     * null until the car has driven: the answer does not exist yet, and the conditions
+     * built on it are then unavailable. An empty set is a real answer, "nobody's phone
+     * came along", and does make those conditions false.
+     */
+    val btOnboardMacs: Set<String>? = null,
+    /**
+     * MAC addresses the head unit made active for hands-free, null when unreadable.
+     *
+     * Same distinction once more: empty means the head unit chose no phone, null means the
+     * platform would not say.
+     */
+    val btHandsFreeMacs: Set<String>? = null,
     /** Minutes since midnight, local time. */
     val minutesOfDay: Int = 0,
     /** Current day, java.util.Calendar.MONDAY…SUNDAY values. */
 
@@ -6,6 +6,8 @@ import android.content.BroadcastReceiver
 import android.content.Context
 import android.content.Intent
 import android.content.IntentFilter
+import android.os.Handler
+import android.os.HandlerThread
 import android.os.IBinder
 import androidx.core.content.ContextCompat
 import com.mg4.hardware.AppLogger
@@ -15,6 +17,7 @@ import com.mg4.hardware.VehicleWriteGate
 import com.mg4.tasker.model.RuleTrigger
 import com.mg4.tasker.store.AppState
 import com.mg4.tasker.util.Notifier
+import com.mg4.tasker.vehicle.BtOnboard
 import com.mg4.tasker.vehicle.BtTracker
 import com.mg4.tasker.vehicle.DeferredWrites
 import com.mg4.tasker.vehicle.ProfileBridge
@@ -36,6 +39,14 @@ class TaskerVehicleService : Service() {
 
     companion object {
         private const val TAG = "MG4Tasker.Vehicle"
+        /**
+         * How often the moving car is asked which phones are still with it.
+         *
+         * Two binder reads (speed, connected devices) — cheap enough at this pace that the
+         * drive is sampled several times before the first junction, and rare enough that a
+         * long motorway leg costs nothing measurable.
+         */
+        private const val ONBOARD_SAMPLE_MS = 15_000L
         private const val HARDKEY_ACTION = "com.saic.keyevent.hardkey.report"
         private const val SYSTEMUI_HARDKEY_ACTION = "com.android.systemui.ACTION_HARD_KEY_EVENT"
         const val HARDKEY_PERMISSION = "com.mg4.tasker.permission.RECEIVE_HARDKEY"
@@ -65,6 +76,19 @@ class TaskerVehicleService : Service() {
     @Volatile
     private var lastTrigger: RuleTrigger? = null
 
+    /**
+     * Off the main thread: sampling reads the car and the Bluetooth stack over binder, and
+     * this service runs in the same process as the UI.
+     */
+    private val onboardThread = HandlerThread("mg4-tasker-onboard")
+    private lateinit var onboardHandler: Handler
+    private val onboardSampler = object : Runnable {
+        override fun run() {
+            BtOnboard.sample(this@TaskerVehicleService)
+            onboardHandler.postDelayed(this, ONBOARD_SAMPLE_MS)
+        }
+    }
+
     override fun onBind(intent: Intent?): IBinder? = null
 
     override fun onCreate() {
@@ -97,9 +121,17 @@ class TaskerVehicleService : Service() {
         // The gate resets to standstill-only on every process start; hand it back the
         // threshold the user chose before any rule can be evaluated.
         AppState.applyWriteThreshold(this)
+        onboardThread.start()
+        onboardHandler = Handler(onboardThread.looper)
         registerBtReceiver()
         registerHardkeyReceiver()
         registerIgnitionListener()
+        // START_STICKY means this service can be recreated mid-drive. Waiting for the next
+        // IGNITION_ON would then leave the whole drive unsampled, and every "phone on board"
+        // rule unevaluable until the car had been switched off and on again.
+        if (MG4Hardware.getCurrentIgnitionState() == MG4Hardware.CarIgnitionItem.RUN) {
+            startOnboardSampling()
+        }
         warnIfMG4ControlPresent()
         isRunning = true
     }
@@ -112,6 +144,17 @@ class TaskerVehicleService : Service() {
         ignitionListener?.let { MG4Hardware.unregisterVehicleConditionListener(it) }
         btReceiver?.let { runCatching { unregisterReceiver(it) } }
         hardkeyReceiver?.let { runCatching { unregisterReceiver(it) } }
+        onboardHandler.removeCallbacks(onboardSampler)
+        onboardThread.quitSafely()
+    }
+
+    private fun startOnboardSampling() {
+        onboardHandler.removeCallbacks(onboardSampler)
+        onboardHandler.post(onboardSampler)
+    }
+
+    private fun stopOnboardSampling() {
+        onboardHandler.removeCallbacks(onboardSampler)
     }
 
     /**
@@ -136,6 +179,15 @@ class TaskerVehicleService : Service() {
                 // The drive is over: writes held back for a red light that never came do not
                 // belong to the next one.
                 if (trigger == RuleTrigger.IGNITION_OFF) DeferredWrites.clear()
+                // The onboard set is cleared when the next drive starts, not when this one
+                // ends: the IGNITION_OFF rules are precisely the ones that want to know
+                // whose phone made the trip, and they evaluate on a thread of their own.
+                if (trigger == RuleTrigger.IGNITION_ON) {
+                    BtOnboard.reset()
+                    startOnboardSampling()
+                } else {
+                    stopOnboardSampling()
+                }
                 if (AppState.isAutomationEnabled(this)) {
                     AppLogger.i(TAG, "Ignition $state → evaluating ${trigger.name} rules")
                     thread(name = "mg4-tasker-cycle") { RuleCycle.run(this, trigger.name) }
 
@@ -19,6 +19,7 @@ import com.mg4.tasker.model.Action
 import com.mg4.tasker.model.Branch
 import com.mg4.tasker.model.Condition
 import com.mg4.tasker.model.MatchMode
+import com.mg4.hardware.catalog.ActionGroup
 import com.mg4.hardware.catalog.ActionType
 import com.mg4.hardware.catalog.ValueKind
 import com.mg4.tasker.util.BtDevices
@@ -170,7 +171,7 @@ class BranchEditorActivity : AppCompatActivity() {
         }
         binding.addActionButton.setOnClickListener {
             CatalogPicker.pickAction(this, firmware) { type ->
-                if (type == ActionType.APPLY_PROFILE && mg4ControlDetected) {
+                if (type.group == ActionGroup.PROFILE && mg4ControlDetected) {
                     actionAwaitingProfileWarning = type
                     profileWarning.launch(ProfileAutomationWarningActivity.intent(this))
                 } else {