PixelIMS: build corregido (APIs ocultas con android.jar completo), docs y diagnostico VoLTE Pixel 6 + NeWWW, APK en dist/

.gitignore

@@ -0,0 +1,16 @@
+# Gradle / Android build artifacts
+.gradle/
+build/
+app/build/
+stub/build/
+local.properties
+*.iml
+.idea/
+captures/
+.externalNativeBuild/
+.cxx/
+
+# Local toolchain (workspace-specific, not part of the project)
+../local-sdk/
+../gradle-9.4.1/
+../gradle-home/

README.md

@@ -1,220 +1,108 @@
-# ⚡ Pixel IMS
+# PixelIMS — VoLTE para Pixel con operadores no certificados
 
-**Enable 5G, VoLTE, VoWiFi and VoNR on Google Pixel devices with unsupported carriers — without root.**
+Fork de [vvb2060/Pixel IMS](https://github.com/vvb2060/Ims) (motor de bypass v3.1) con interfaz de [TurboIMS](https://github.com/Turbo1123/TurboIMS), **compilado, corregido y verificado en un Pixel 6 con la red de Altán Redes (MVNO NeWWW, México)**.
 
-Built specifically for users in Sri Lanka (Dialog, Mobitel) and other regions where Google has not officially certified local carriers for 5G/IMS features. Works on any Pixel running Android 12+.
+Habilita VoLTE, VoWiFi, 5G NR, VoNR, video llamadas, cross-SIM y servicios UT en Google Pixel (Tensor) cuando el operador no está en la lista certificada de Google — **sin root** (vía Shizuku).
 
----
+## Estado verificado
 
-## What This Does
+- ✅ Compila desde fuente (ver [Construir desde fuente](#construir-desde-fuente))
+- ✅ Instala y aplica la configuración en un **Pixel 6 (oriole) con Android 16, parche 2026-04-05**
+- ✅ **VoLTE activo y funcionando** con NeWWW (Red Altán, MCC/MNC 334-140)
+- ⚠️ Tras cada reinicio hay que re-aplicar (ver [Comportamiento tras reinicio](#comportamiento-tras-reinicio))
 
-Google Pixel devices use a carrier whitelist enforced at the modem firmware level. If your carrier (e.g. Dialog Axiata, PLMN 413-02) is not on Google's approved list, your Pixel will refuse to connect to 5G and hide VoLTE settings — even when your carrier's 5G network is physically available.
+## Requisitos
 
-This app overrides the `CarrierConfigManager` configuration at runtime using a privileged Instrumentation bypass, unlocking:
+- Google Pixel 6 o posterior (chip Tensor)
+- Android 12+ (`minSdk 31`)
+- [Shizuku](https://play.google.com/store/apps/details?id=moe.shizuku.privileged.api) 13.1.5+ (Play Store, gratis)
+- Sin root, sin PC obligatorio (solo para la instalación inicial por adb o para arrancar Shizuku por cable)
 
-- **5G NR** — Both NSA (Non-Standalone, 5G anchored to 4G core) and SA (Standalone, full 5G)
+## Instalación
-- **VoLTE** — HD voice calls over 4G
-- **VoWiFi** — Voice calls over WiFi
-- **VoNR** — Voice calls over 5G
-- **Video Calling (VT)**
-- **Cross-SIM Calling**
-- **UT Supplementary Services** — call forwarding, call waiting, etc.
 
----
+1. **Instalar el APK** (ya compilado en `dist/PixelIMS-1.0.apk`):
+   ```bash
+   adb install dist/PixelIMS-1.0.apk
+   ```
+2. **Instalar Shizuku** desde Play Store y arrancarlo:
+   - Sin PC: Developer options → *Depuración inalámbrica* → pairing desde Shizuku, o
+   - Por cable: `adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh`
+3. **Abrir PixelIMS** → conceder permiso de Shizuku → esperar "✅ Ready".
+4. **Pulsar "Apply to All SIMs"** → esperar el diálogo de éxito.
+5. **Activar el toggle**: Ajustes → Red e internet → SIMs → NeWWW → **Llamadas 4G (VoLTE)** → ON.
+6. **Verificar**: `*#*#4636#*#*` → ⋮ → Estado del servicio IMS → "Voice over LTE: Available".
 
-## Requirements
+> Nota: la app hace visibles y editables los toggles de VoLTE/VoWiFi en los ajustes del SIM, pero **no los enciende por sí sola** — el paso 5 es manual (y solo una vez).
 
-| Requirement | Details |
+## Comportamiento tras reinicio
-|---|---|
-| Device | Google Pixel 6 or later (Tensor chip) |
-| Android | 12 (API 31) or higher |
-| [Shizuku](https://play.google.com/store/apps/details?id=moe.shizuku.privileged.api) | v13+ — free on Play Store |
-| Root | ❌ Not required |
-| PC | ❌ Not required |
 
----
+- La app **se auto-aplica sola** cada vez que Shizuku entrega su binder (no hay que pulsar Apply de nuevo); los toggles quedan guardados.
+- Pero **Shizuku no sobrevive al reinicio** sin root: la depuración inalámbrica se apaga. Rutina por reinicio (2 toques): activar depuración inalámbrica → abrir Shizuku y Start. La app hace el resto automáticamente.
+- Si el dispositivo reporta "Persistent: Yes" en la app, la config sobrevive reinicios por sí sola (en builds recientes de Android 15/16 normalmente reporta "No").
+- **100% automático solo con root (Magisk)**: Shizuku arranca por root al boot y la app se auto-aplica. Costo: desbloquear bootloader (borra datos), Play Integrity, OTA manuales.
 
-## How the Bypass Works
+## Construir desde fuente
 
-### Background
+El código original **no compila tal cual**: usa ~30 APIs ocultas de Android (`CarrierConfigManager.overrideConfig`, `IActivityManager`, `ITelephony`, `PermissionManager`, etc.) que no existen en el `android.jar` público. Tampoco el upstream (vvb2060/Ims v3.1) compila desde un clon limpio — requiere un `android.jar` completo no versionado en el repo.
 
-Google's carrier whitelist is enforced via `CarrierConfigManager.overrideConfig()`, a privileged Android API that requires the `MODIFY_PHONE_STATE` permission — only granted to system apps. Normal apps and even ADB shell cannot call it directly.
+### Correcciones aplicadas a este fork
 
-In October 2025, Google patched **CVE-2025-48617**, which had allowed calling `overrideConfig()` directly from the ADB shell user via Shizuku. That door was closed.
+1. `settings.gradle.kts` — eliminado el `versionCatalogs { create("libs") }` duplicado (Gradle auto-importa `gradle/libs.versions.toml` como `libs`).
+2. `gradle.properties` — `android.useAndroidX=true` (Shizuku 13.1.5 arrastra `androidx.annotation` transitiva).
+3. `MainActivity.java` — `Shizuku.onRequestPermissionsResult()` no existe en Shizuku 13.1.5; reemplazado por `addRequestPermissionResultListener` / `removeRequestPermissionResultListener`.
+4. **APIs ocultas** — config migrada a AGP 9.2.0 (plugin `com.android.settings`, DSL en `settings.gradle.kts`) con `compileSdk = release(37)`, y un SDK local cuyo `android.jar` se reemplaza por el **framework completo de Robolectric** (`org.robolectric:android-all:17-robolectric-15733970`, SHA-256 `f6a41ad548bb45cccd3b1d4774cb50d57826dd319b6e5accd6b6269876e12d71`), que sí incluye las clases y métodos ocultos.
 
-### The v3.1 Bypass (Instrumentation trick)
+### Pasos reproducibles
-
-This app uses the approach from **vvb2060's Pixel IMS v3.1**. Instead of calling `overrideConfig()` from the shell user directly, we route through Android's `Instrumentation` framework:
-
-1. `ShizukuProvider` receives the Shizuku binder when Shizuku starts
-2. It calls `IActivityManager.startInstrumentation()` with flag `INSTR_FLAG_NO_RESTART`, passing our own PID as a security argument
-3. The system launches `PrivilegedProcess` (which extends `Instrumentation`) as a runner
-4. Inside `PrivilegedProcess`, we call `startDelegateShellPermissionIdentity()` to elevate our UID
-5. We call `overrideConfig()` — the system sees it coming from the Instrumentation context, not directly from shell, bypassing the October 2025 restriction
-6. We release delegation and exit
-
-The PID check (`arguments.getInt("pid") == Process.myPid()`) is a security gate ensuring `PrivilegedProcess` only runs when launched by our own provider.
-
-### Key Innovations from vvb2060 v3.1
-
-**`canPersistent()` — Runtime patch-level detection**
-
-Before calling `overrideConfig()`, the app probes private methods in `com.android.phone`'s `CarrierConfigLoader` class at runtime to determine whether persistent overrides are safe:
-
-- No `isSystemApp()` method → old build → persistent = ✅ safe
-- Has `isSystemApp()` but no `isSdkSandboxUidInternal()` → intermediate → persistent = ✅ safe  
-- Has both → latest patch → persistent = ❌ blocked, uses session-only
-
-**`showVoLTE()` — IMS Provisioning layer**
-
-Some carriers block VoLTE at a second layer: IMS provisioning. Even after `CarrierConfigManager` is overridden, the `KEY_VOIMS_OPT_IN_STATUS` provisioning flag can still be set to disabled. This app fixes that by calling `ITelephony.setImsProvisioningInt()` directly. TurboIMS never touched this layer.
-
-**Version fingerprinting**
-
-The app stamps `vvb2060_config_version = VERSION_CODE` into the carrier config bundle. On Shizuku connect, it reads this key back to skip re-applying if the config is already current.
-
-**SDK Sandbox support (Android 14+)**
-
-On locked-bootloader devices on Android 14+, the app may run in an isolated SDK sandbox process. A separate Binder callback path handles this case.
-
----
-
-## Setup Instructions
-
-### Step 1 — Enable Wireless Debugging
-
-1. Go to **Settings → About Phone**
-2. Tap **Build Number** 7 times to enable Developer Options
-3. Go to **Settings → System → Developer Options**
-4. Enable **Wireless Debugging**
-
-### Step 2 — Set Up Shizuku
-
-1. Install [Shizuku](https://play.google.com/store/apps/details?id=moe.shizuku.privileged.api) from the Play Store
-2. Open Shizuku
-3. Tap **"Pair using Wireless Debugging"**
-4. Follow the pairing dialog (no PC needed)
-5. Shizuku status should show **"Running"**
-
-### Step 3 — Install and Run Pixel IMS
-
-1. Install `PixelIMS.apk`
-2. Open the app
-3. When prompted, grant Shizuku permission
-4. Shizuku status in the app should show **✅ Ready**
-5. (Optional) Toggle off any features you don't need
-6. Tap **"Apply to All SIMs"**
-7. When the success dialog appears, tap **"Open Network Settings"**
-8. Enable 5G and VoLTE toggles in your SIM settings
-
-### Step 4 — After Each Reboot
-
-Check the **Config** status in the app. If it shows **⬜ Not yet applied**:
-- Open Shizuku, tap Start (Wireless Debugging)
-- Open Pixel IMS and tap Apply again
-
-If **Persistent mode: Yes** is shown, the config survives reboots automatically.
-
----
-
-## Building from Source
-
-### Prerequisites
-
-- Android Studio Hedgehog or newer
-- JDK 17
-- Android SDK 35
-
-### Build
 
 ```bash
-git clone https://github.com/YOUR_USERNAME/PixelIMS.git
+# 1. Prerrequisitos: JDK 17+ y Gradle 9.4.1
-cd PixelIMS
+#    https://services.gradle.org/distributions/gradle-9.4.1-bin.zip
-./gradlew assembleRelease
+
+# 2. SDK Android (platform-tools, platform android-37.0, build-tools 37.0.0, licencias aceptadas)
+
+# 3. Crear un SDK local con el android.jar completo:
+mkdir -p local-sdk/platforms local-sdk/build-tools
+cp -r $ANDROID_HOME/platforms/android-37.0 local-sdk/platforms/
+curl -o android-all-37.jar \
+  https://repo1.maven.org/maven2/org/robolectric/android-all/17-robolectric-15733970/android-all-17-robolectric-15733970.jar
+cp android-all-37.jar local-sdk/platforms/android-37.0/android.jar   # ← reemplazo clave
+ln -s $ANDROID_HOME/build-tools/37.0.0 local-sdk/build-tools/37.0.0
+ln -s $ANDROID_HOME/licenses local-sdk/licenses
+# y ajustar sdk.dir en local.properties
+
+# 4. Compilar:
+gradle assembleRelease
+# APK en app/build/outputs/apk/release/app-release.apk (firmado con debug key)
 ```
 
-The signed APK will be at `app/build/outputs/apk/release/app-release.apk`.
+¿Por qué un SDK local? `javac` prioriza el `android.jar` del SDK sobre cualquier jar del classpath, así que un módulo de stubs no puede añadir métodos ocultos a clases existentes — la única vía es sustituir el propio `android.jar` por uno completo (el de Robolectric contiene TODO el framework).
 
----
+## Diagnóstico VoLTE en Pixel 6 + NeWWW (Altán 334-140)
 
-## Project Structure
+El detalle completo de la investigación con evidencia de logcat/dumpsys está en **[docs/diagnostico-volte-newww.md](docs/diagnostico-volte-newww.md)**. Resumen de la cadena:
 
-```
+1. La config de operador se aplica con `persistent=true` y el aprovisionamiento IMS queda `PROVISIONING_VALUE_ENABLED`.
-PixelIMS/
+2. El APN `ims` ya viene provisionado en la SIM de NeWWW.
-├── app/
+3. La red concede voz sobre LTE: `availableServices=[VOICE,SMS,VIDEO]`, `mVoiceRegState=IN_SERVICE`.
-│   └── src/main/
+4. El toggle "Llamadas 4G" aparece en Ajustes → SIMs tras aplicar la config — hay que encenderlo.
-│       ├── AndroidManifest.xml
+5. El ImsService del módem Shannon (`com.shannon.imsservice`) corre con normalidad.
-│       └── java/io/github/pixelims/
-│           ├── PrivilegedProcess.java   ← Core bypass engine (vvb2060 v3.1 logic)
-│           ├── ShizukuProvider.java     ← Shizuku integration + canPersistent + showVoLTE
-│           ├── MainActivity.java        ← UI (TurboIMS style + status improvements)
-│           ├── SplashActivity.java      ← Splash screen
-│           └── LocaleHelper.java        ← EN/ZH language switching
-├── stub/
-│   └── src/main/java/                  ← Hidden API stubs for compilation
-│       ├── android/app/
-│       │   ├── IActivityManager.java
-│       │   ├── ActivityManager.java        ← Hidden INSTR_FLAG constants
-│       │   ├── UiAutomationConnection.java
-│       │   └── ...
-│       ├── android/os/
-│       │   └── ServiceManager.java
-│       └── com/android/internal/telephony/
-│           └── ITelephony.java
-└── README.md
-```
 
----
+## VozApp (plan B oficial de Altán)
 
-## Comparison: vvb2060 v3.1 vs TurboIMS v3.0 vs Pixel IMS v1.0
+- **`com.altanredes.altanvoip`** — la app de llamadas VoIP del propio operador (Altán Redes) para equipos sin VoLTE nativo. **No está en Play Store**; se distribuye por los centros de ayuda de los MVNOs (BAIT, VIVA MX) y espejos de APK.
+- Espejo verificado en esta investigación: APKCombo, `VozApp_2.1.0.apk`, SHA-256 `75dd0dde4f6184568ea2337c5cf397c6a1b0e28a65bf555588f401cdc4af24ed`, firmada por **Neusoft Mobile Solutions Oy** (plataforma "Silta").
+- ⚠️ **Crash conocido en Android 16**: `ForegroundServiceStartNotAllowedException` en `com.unikie.vm.application.engine.services.AppStatusService` al arrancar un servicio en foreground desde segundo plano. Es un bug de la app (plataforma Unikie), no del teléfono.
+- Con VoLTE nativo funcionando (el objetivo de este proyecto), VozApp queda solo como respaldo.
 
-| Feature | vvb2060 v3.1 | TurboIMS v3.0 | **Pixel IMS v1.0** |
+## Créditos y licencia
-|---|:---:|:---:|:---:|
-| Oct 2025 patch bypass | ✅ | ❌ Broken | ✅ |
-| User interface | ❌ Headless | ✅ | ✅ |
-| Per-feature toggles | ❌ | ✅ | ✅ |
-| Per-SIM selection | ❌ | ✅ | ✅ |
-| Language switching (EN/ZH) | ❌ | ✅ | ✅ |
-| `showVoLTE()` IMS provisioning | ✅ | ❌ | ✅ |
-| `canPersistent()` detection | ✅ | ❌ | ✅ |
-| `needOverride()` fingerprint | ✅ | ❌ | ✅ |
-| Config status shown in UI | ❌ | ❌ | ✅ **New** |
-| Persistent mode shown in UI | ❌ | ❌ | ✅ **New** |
-| Auto-apply on Shizuku connect | ✅ | ❌ | ✅ |
-| SDK Sandbox support (Android 14+) | ✅ | ❌ | ✅ |
-| 5G NR signal thresholds | ✅ | ✅ | ✅ |
-| `KEY_SHOW_IMS_REGISTRATION_STATUS` | ✅ | ❌ | ✅ |
-| Default SIM target | All (forced) | SIM 1 | All SIMs |
-| Min Android version | API 34 | API 33 | **API 31** |
-| Java version | 21 | 17 | 17 |
 
----
+- [vvb2060/Ims](https://github.com/vvb2060/Ims) — motor de bypass v3.1 (Instrumentation trick, `canPersistent()`, `showVoLTE()`)
+- [Turbo1123/TurboIMS](https://github.com/Turbo1123/TurboIMS) — UI, toggles por feature y por SIM
+- [VinujaHerath/PixelIMS](https://github.com/VinujaHerath/PixelIMS) — fork base de este repo
+- [RikkaApps/Shizuku](https://github.com/RikkaApps/Shizuku) y [LSPosed/LSPass](https://github.com/LSPosed/LSPass)
 
-## Troubleshooting
+El repositorio original no declara licencia. Este proyecto reutiliza ese código con fines de interoperabilidad personal; úsalo bajo tu propio riesgo.
 
-**Shizuku shows "Not Running" after reboot**  
+## Aviso
-Wireless Debugging turns off on reboot. Go to Settings → Developer Options → Wireless Debugging → turn it on, then re-open Shizuku and tap Start.
 
-**Config shows "Not yet applied" after tapping Apply**  
+Esta app sobrescribe la configuración del operador a nivel de framework (no toca particiones; se revierte desinstalando). Técnicamente contradice las políticas del operador. Los autores no se hacen responsables del uso que se le dé.
-Wait 5 seconds and pull down to refresh. The Instrumentation runner takes a moment to complete. If it still shows Not Applied, force-stop the app and try again.
-
-**5G toggle doesn't appear in SIM settings**  
-Your carrier plan may not include 5G even after the config is unlocked. Confirm with Dialog that your plan supports 5G. Also ensure you're in a Dialog 5G coverage area (Colombo, Kandy, Galle metro areas as of May 2026).
-
-**SecurityException in logcat**  
-The October 2025 or newer patch may have closed the Instrumentation bypass. Check the GitHub issues page — a new bypass method may be available.
-
----
-
-## Credits
-
-- **[vvb2060](https://github.com/vvb2060/Ims)** — Original Pixel IMS, v3.1 bypass engine, `canPersistent()`, `showVoLTE()`, SDK sandbox support
-- **[Turbo1123](https://github.com/Turbo1123/TurboIMS)** — TurboIMS v3.0 UI, per-feature toggles, per-SIM selection, language switching
-- **[Rikka](https://github.com/RikkaApps/Shizuku)** — Shizuku framework
-- **[LSPosed](https://github.com/LSPosed/LSPosed)** — LSPass hidden API bypass library
-
----
-
-## Disclaimer
-
-This app overrides carrier configuration at the framework level. It does not modify system partitions and is reversible by uninstalling the app. However, overriding carrier config technically violates carrier policies. Use at your own risk. The authors are not responsible for any issues arising from use of this software.

app/build.gradle.kts

@@ -3,52 +3,43 @@ plugins {
 }
 
 android {
+    enableKotlin = false
     namespace = "io.github.pixelims"
-    compileSdk = 35
-
     defaultConfig {
         applicationId = "io.github.pixelims"
-        minSdk = 31
-        targetSdk = 35
         versionCode = 1
         versionName = "1.0"
     }
-
     buildTypes {
         release {
             isMinifyEnabled = true
             isShrinkResources = true
+            vcsInfo.include = false
             proguardFiles("proguard-rules.pro")
             signingConfig = signingConfigs["debug"]
         }
     }
-
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17
     }
-
     buildFeatures {
         buildConfig = true
     }
-
     packaging {
         resources {
             excludes += "**"
         }
     }
-
     lint {
         checkReleaseBuilds = false
     }
-
     dependenciesInfo {
         includeInApk = false
     }
 }
 
 dependencies {
-    compileOnly(project(":stub"))
     implementation(libs.shizuku.provider)
     implementation(libs.shizuku.api)
     implementation(libs.hiddenapibypass)

app/src/main/java/io/github/pixelims/MainActivity.java

@@ -70,6 +70,9 @@ public class MainActivity extends Activity {
     private final Shizuku.OnBinderDeadListener binderDead = () ->
             runOnUiThread(this::updateShizukuStatus);
 
+    private final Shizuku.OnRequestPermissionResultListener permissionResultListener =
+            (requestCode, grantResult) -> runOnUiThread(this::updateShizukuStatus);
+
     @Override
     protected void onCreate(Bundle savedInstanceState) {
         String language = LocaleHelper.getLanguage(this);
@@ -89,6 +92,7 @@ public class MainActivity extends Activity {
 
         Shizuku.addBinderReceivedListener(binderReceived);
         Shizuku.addBinderDeadListener(binderDead);
+        Shizuku.addRequestPermissionResultListener(permissionResultListener);
     }
 
     @Override
@@ -103,6 +107,7 @@ public class MainActivity extends Activity {
         super.onDestroy();
         Shizuku.removeBinderReceivedListener(binderReceived);
         Shizuku.removeBinderDeadListener(binderDead);
+        Shizuku.removeRequestPermissionResultListener(permissionResultListener);
     }
 
     private void initViews() {
@@ -221,11 +226,7 @@ public class MainActivity extends Activity {
     @Override
     public void onRequestPermissionsResult(int requestCode,
                                             String[] permissions, int[] grantResults) {
-        // Shizuku routes its permission result through onRequestPermissionsResult.
+        // Shizuku delivers its result through OnRequestPermissionResultListener, not here.
-        // Refresh status whenever any permission result arrives.
-        if (Shizuku.onRequestPermissionsResult(requestCode, permissions, grantResults)) {
-            updateShizukuStatus();
-        }
         super.onRequestPermissionsResult(requestCode, permissions, grantResults);
     }
 

build.gradle.kts

@@ -1 +1 @@
-// Top-level build file
+// Root build file — plugin management and SDK configuration live in settings.gradle.kts (AGP 9 settings DSL).

docs/diagnostico-volte-newww.md

@@ -0,0 +1,107 @@
+# Diagnóstico VoLTE — Pixel 6 (oriole) + NeWWW (Altán Redes, MCC/MNC 334-140)
+
+Fecha: 2026-09-22 · Dispositivo: Google Pixel 6 · Android 16 (CP1A.260405.005), parche de seguridad 2026-04-05 · SIM: NeWWW (334140)
+
+## Síntoma inicial
+
+VoLTE no disponible para la SIM de NeWWW (Red Altán) en un Pixel 6: la app PixelIMS parecía cerrarse al aplicar y las llamadas por voz no funcionaban por la red.
+
+## Cadena de evidencia (logcat + dumpsys, vía adb)
+
+### 1. La configuración de operador SÍ se aplica
+
+```
+I PixelIMS: Applying to all 1 SIM(s)
+I PixelIMS: ✓ Config applied for subId=4 persistent=true
+```
+
+El bypass (Instrumentation + delegación de shell vía Shizuku) funciona en Android 16 con parche 2026-04: la config se aplica con `persistent=true` y queda firmada con la versión de la app (`Config is current, no override needed` en arranques posteriores).
+
+### 2. Aprovisionamiento IMS activo
+
+```
+I PixelIMS: IMS Voice Opt-In already enabled.
+```
+
+La flag `KEY_VOIMS_OPT_IN_STATUS` está en `PROVISIONING_VALUE_ENABLED` (la capa de aprovisionamiento no bloquea).
+
+### 3. APN IMS presente en la SIM
+
+```
+Row: 11 name=NeWWW, apn=internet.newww.com, type=default, sub_id=4
+Row: 12 name=NeWWW, apn=ims, type=ims, sub_id=4
+```
+
+El APN `ims` ya viene provisionado — no hubo que agregarlo manualmente.
+
+### 4. La red concede voz sobre LTE
+
+```
+notifyServiceStateForSubscriber: subId=4 ...
+  mVoiceRegState=0(IN_SERVICE)
+  domain=CS transportType=WWAN registrationState=HOME accessNetworkTechnology=LTE
+  availableServices=[VOICE,SMS,VIDEO]  rRplmn=334140
+```
+
+La red de Altán da servicio de voz por LTE a este equipo — el bloqueo no era de red ni de lista blanca del operador.
+
+### 5. El toggle de usuario estaba apagado
+
+El módem Shannon reportaba el toggle de usuario apagado pese a la config aplicada:
+
+```
+ShannonQNS-0-HC: ... USER0. VoLTE supported: true enabled: false ...
+ImsManager [0]: updateVoiceCellFeatureValue: available = true, enabled = false,
+                 provisioned = true, voLteFeatureOn = false
+```
+
+La override hace el toggle **visible y editable**, pero no lo enciende. Solución: Ajustes → Red e internet → SIMs → NeWWW → **"Llamadas 4G (VoLTE)"** → ON (una sola vez). Confirmado en el dump de UI:
+
+```xml
+<node text="VoLTE" ... summary="Usar servicios de LTE para mejorar las llamadas de voz (recomendado)"/>
+<node resource-id="com.android.settings:id/switchWidget" class="android.widget.Switch" checked="true"/>
+```
+
+Nota: el estado del toggle NO vive en `Settings.Global` (`volte_vt_enabled*` no existía y escribir esas claves no cambió el estado del módem). El cambio efectivo se hace desde la UI de Ajustes, que lo empuja al módem vía el proceso de telefonía.
+
+### 6. El ImsService del módem corre con normalidad
+
+```
+cmd phone ims get-ims-service -d → com.shannon.imsservice
+ps -A: com.shannon.imsservice (2528), .ShannonImsService (3344)
+ServiceRecord com.shannon.imsservice/.ShannonImsService  (bound por com.android.phone)
+```
+
+El stack IMS del módem Exynos 5123 está vivo y enlazado — no requería intervención.
+
+## Sobre el "la app se cierra"
+
+PixelIMS no crashea (no hay FATAL en `logcat -b crash` de `io.github.pixelims`). Lo que se observa:
+
+1. Al pulsar Apply, la Instrumentation lanza `PrivilegedProcess`; en Android 14+ corre en un **proceso de SDK sandbox** (`io.github.pixelims_sdk_sandbox_instr`) que aplica la config por callback de binder y el sistema lo mata al terminar ("finished instr") — comportamiento normal.
+2. La UI principal se va a segundo plano durante ~3 s y el fork la relanza sola (START MainActivity con `LAUNCH_MULTIPLE` en logcat). La percepción de "cierre" es ese parpadeo.
+3. Dentro del sandbox, `createPackageContext(...)` no puede leer `/data/user/0/io.github.pixelims/shared_prefs` (warnings en logcat) y el código cae al fallback con los toggles por defecto — por eso conviene aplicar con "All SIMs" y valores por defecto.
+
+### Crash real detectado (otro componente): VozApp en Android 16
+
+```
+FATAL EXCEPTION: main  Process: com.altanredes.altanvoip
+ForegroundServiceStartNotAllowedException: Service.startForeground() not allowed due to
+  mAllowStartForeground false: com.unikie.vm.application.engine.services.AppStatusService
+```
+
+La app VoIP oficial de Altán crashea al arrancar un servicio en foreground desde segundo plano (restricción de Android 14+). Bug del proveedor (Unikie), no del dispositivo. Con VoLTE nativo funcionando, VozApp no es necesaria.
+
+## Conclusiones
+
+| Componente | Estado |
+|---|---|
+| Bypass de config (Instrumentation + Shizuku) | ✅ Funciona en Android 16 (2026-04) |
+| Aprovisionamiento IMS | ✅ Habilitado |
+| APN ims | ✅ Presente en la SIM |
+| Voz sobre LTE en la red (Altán 334-140) | ✅ Concedida `[VOICE,SMS,VIDEO]` |
+| Toggle "Llamadas 4G" | ⚠️ Manual: visible tras aplicar, hay que encenderlo |
+| ImsService Shannon | ✅ Corriendo |
+| **VoLTE** | ✅ **Funcionando** |
+
+Lección principal: con el bypass aplicado, el eslabón que faltaba era **el toggle de usuario en Ajustes del SIM**, no la config del operador ni la red.

gradle.properties

@@ -1,3 +1,6 @@
 org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
-android.useAndroidX=false
+org.gradle.configureondemand=true
+org.gradle.configuration-cache=true
+org.gradle.configuration-cache.parallel=true
+android.useAndroidX=true
 android.nonTransitiveRClass=true

settings.gradle.kts

@@ -11,9 +11,10 @@ pluginManagement {
         gradlePluginPortal()
     }
     plugins {
-        val agp = "8.7.0"
+        val agp = "9.2.0"
         id("com.android.application") version agp
         id("com.android.library") version agp
+        id("com.android.settings") version agp
     }
 }
 
@@ -29,15 +30,27 @@ dependencyResolutionManagement {
         }
         mavenCentral()
     }
-    versionCatalogs {
+}
-        create("libs") {
+
-            from(files("gradle/libs.versions.toml"))
+plugins {
+    id("com.android.settings")
+}
+
+android {
+    compileSdk {
+        version = release(37)
     }
+    minSdk {
+        version = release(31)
     }
+    targetSdk {
+        version = release(35)
+    }
+    buildToolsVersion = "37.0.0"
 }
 
 enableFeaturePreview("TYPESAFE_PROJECT_ACCESSORS")
+enableFeaturePreview("STABLE_CONFIGURATION_CACHE")
 
 rootProject.name = "PixelIMS"
 include(":app")
-include(":stub")