This proposal outlines a concrete plan to enable 5G Standalone (SA) and Carrier Aggregation (CA) for major Chinese carriers (China Mobile, China Unicom, China Telecom) on Pixel 6/7/8/9 devices running GrapheneOS. The issue stems from missing CarrierConfig overlays and restrictive default modem policies for unknown carrier IDs.
Below are the specific XML configurations and a proposed implementation strategy to resolve the "missing CA combinations" bottleneck.
Part 1: The Root Cause (Technical Context)
Pixel devices with Tensor (Exynos Modem) suffer from poor connectivity in China due to two layers of locks:

OS Layer: CarrierConfig defaults disable 5G SA and do not define bandwidth thresholds for CA (LTE+/5G+).
Modem Layer: The Exynos modem firmware (cfg.db) uses a generic regional_fallback profile for CN carriers (MCC 460), which lacks definitions for local CA combinations (e.g., n41+n78, n1+n78).
To fix this without root, we need to push specific CarrierConfig overrides into the GrapheneOS build.
Part 2: The Solution (CarrierConfig XML Overlays)
I propose adding/updating the following configuration files in packages/apps/CarrierConfig/assets/. These keys force the OS to request SA capabilities and define CA bandwidth thresholds.
Target 1: China Mobile (CMCC)
Carrier ID: 1435
File: carrier_config_carrierid_1435_China-Mobile.xml
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<carrier_config>
<int-array name="carrier_nr_availabilities_int_array" num="2">
<item value="1" /> <item value="2" /> </int-array>

<boolean name="carrier_volte_available_bool" value="true" />
<boolean name="carrier_wfc_ims_available_bool" value="true" />

<boolean name="lte_ca_enabled_bool" value="true" />
<int name="lte_plus_threshold_bandwidth_khz_int" value="20000" />

<int name="nr_advanced_threshold_bandwidth_khz_int" value="20000" />
<int-array name="additional_nr_advanced_bands_int_array" num="2">
<item value="41" />
<item value="79" />
</int-array>
</carrier_config>

Target 2: China Unicom (CU)
Carrier ID: 1436
File: carrier_config_carrierid_1436_China-Unicom.xml
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<carrier_config>
<int-array name="carrier_nr_availabilities_int_array" num="2">
<item value="1" />
<item value="2" />
</int-array>
<boolean name="carrier_volte_available_bool" value="true" />
<boolean name="carrier_wfc_ims_available_bool" value="true" />

<int-array name="additional_nr_advanced_bands_int_array" num="1">
    <item value="78" />
</int-array>

<string name="5g_icon_display_grace_period_string">connected_mmwave,any,30</string>
<string name="5g_icon_configuration_string">connected_mmwave:5G_Plus,connected:5G,not_restricted_rrc_idle:5G</string>

</carrier_config>

Target 3: China Telecom (CT)
Carrier ID: 2236 (and legacy 203)
File: carrier_config_carrierid_2236_China-Telecom.xml
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<carrier_config>
<int-array name="carrier_nr_availabilities_int_array" num="2">
<item value="1" />
<item value="2" />
</int-array>
<boolean name="carrier_volte_available_bool" value="true" />

<int-array name="additional_nr_advanced_bands_int_array" num="1">
    <item value="78" />
</int-array>

</carrier_config>

Part 3: Addressing the "Modem Brain-Split" (Advanced)
While the XMLs above enable the OS switches, the Exynos Modem may still block CA requests because the regional_fallback profile in cfg.db restricts combo sets.
Proposed Implementation for GrapheneOS:
Ideally, we need a mechanism to map these unsupported Carrier IDs to a "known good" profile that allows all combos (similar to the "Telia Denmark Hack" used by the root community).
Suggested Logic for CarrierConfigLoader or TelephonyProvider:
If sim_mcc == 460 (China), inject/override the modem profile to ID 23820 (Telia) or generic_open_profile.

Note to devs: This specific override allows the modem to initialize n41-n78 and n1-n78 aggregation, which are physically supported by the hardware but software-locked by the default fallback profile.

Call to Action
I am willing to provide NSG (Network Signal Guru) logs and modem traces from a Pixel 8 Pro in China to verify these changes.

Can these XMLs be merged into the upstream CarrierConfig repo?
Is there interest in exploring a "Modem Profile Override" feature in Settings -> Network for advanced users?