vatsal-agr · Nov 9, 2026
diff --git a/docs/devices/sony-k-55xr35m2.md b/docs/devices/sony-k-55xr35m2.md
@@ -0,0 +1,120 @@
+# Sony K-55XR35M2 (BRAVIA 3, `BRAVIA CT1`): one session, not a list
+
+One session on 2026-11-09. This is not an `examples/` entry and not a list to apply.
+The packages below were disabled with `pm disable-user --user 0`, survived one reboot,
+and have not been lived with for days. The physical remote's app, Input and Settings
+buttons were not pressed, and a cast from a phone was not tried.
+
+Android calls this set `BRAVIA CT1`. The retail name on the set is K-55XR35M2, sold as
+BRAVIA 3. It is not the [BRAVIA 9 II](../../examples/sony-bravia-9-ii/debloat.txt)
+(`BRAVIA_AE3`, `UKN4`) and not the [BRAVIA 8](sony-bravia-4k-ae2-eu-remote-keys.md)
+(`BRAVIA_AE2`, `UKN4`). Copying either list onto this chassis would aim Live TV at a
+package this firmware does not use.
+
+## Identify the firmware
+
+| Field | Observed value |
+|---|---|
+| Retail model | Sony K-55XR35M2 (BRAVIA 3) |
+| Manufacturer | `Sony` |
+| Android model | `BRAVIA CT1` |
+| Device / product | `BRAVIA_CT1` / `BRAVIA_CT1_BR23_M_A` |
+| Chassis | `bravia3_gr6tp` (`vendor.mtk.hbbtv.chassisname`) |
+| HbbTV family | `com.sony.LE.G200` |
+| SoC | MediaTek MT9690 (`ro.boot.vendor.cf.hardware`, `ro.hardware.vulkan`) |
+| CPU ABI | `armeabi-v7a` only |
+| Android / API | 14 / 34, `ro.product.first_api_level=34` |
+| Build | `UKN5.250921.001`, incremental `614020073`, `user/release-keys` |
+| Security patch | 2026-04-05 |
+| `ro.adb.secure` | `1` |
+
+The serial number, Android ID, MAC addresses and the network name are left out.
+
+## Stock Home
+
+Stock Home was `com.google.android.apps.tv.launcherx`. `com.google.android.tungsten.setupwraith`
+also claimed HOME, at a higher priority than `launcherx`, through its `RecoveryActivity`.
+`cmd package set-home-activity` printed `Success` and changed nothing while `launcherx` was
+still enabled.
+
+The saved network in use was owned by `android.uid.system`, checked more than once, so
+disabling `setupwraith` did not delete it. That is the opposite of the BRAVIA 9 II note,
+where a network saved during the first-run wizard belongs to `setupwraith` and Android
+deletes it when that package is disabled. Read `dumpsys wifi` for `cname=` on the set in
+front of you. This unit's answer is not a reason to skip that check.
+
+Order that stuck: disable `setupwraith` while `launcherx` still owned Home, then disable
+`launcherx`, then `set-home-activity`. `resolve-activity` for HOME and the focused app
+were both `com.gathin.tvhome/.MainActivity`. After a reboot the screen was Android's
+`FallbackHome` for a few seconds, then the new launcher. It did not open Live TV, so
+`boot_to_live_tv` was left unset. No key helper was turned on.
+
+`launcher/build-and-install.sh` is what should do this handover. On this firmware it does
+not, until `launcherx` is no longer enabled.
+
+## Live TV and inputs
+
+Live TV is `com.mediatek.tv.oneworld.tvcenter`. It is not `com.sony.dtv.tvlin` (BRAVIA 9 II)
+and not `com.sony.dtv.tvx` (older Sony lists). HDMI is `com.mediatek.external`. The input
+menu is `com.sony.dtv.smartui`. The DVB tuner left enabled was
+`com.mediatek.dtv.tvinput.dvbtuner`.
+
+Those packages were identified and kept. Picture, audio and a tuned channel were not
+checked in this session.
+
+## What was disabled
+
+Twenty-three packages, all with `pm disable-user --user 0`, none uninstalled. After the
+reboot the disabled set was the same 27 packages as before it: these 23, plus four that
+were already disabled when the session started
+(`com.mediatek.dtv.tvinput.isdbtuner`, `com.mediatek.dtv.tvinput.atsctuner`,
+`com.mediatek.opapp`, `com.sony.dtv.b2b.vendorprotocol`). The firmware did not turn any
+of them back on. Nothing here was re-enabled and retested, because nothing had been
+lived with yet.
+
+Telemetry and promos:
+
+- `tv.samba.ssm`, `tv.samba.ssm.ui`, `com.sony.dtv.sambacontrol`
+- `com.google.android.feedback`, `com.android.tv.feedbackconsent`, `com.android.adservices.api`
+- `com.sony.dtv.promos`, `com.sony.dtv.sonyselect`, `com.sony.dtv.sonytab`
+- `android.autoinstalls.config.google.gtvpai`
+
+Retail demo and help:
+
+- `com.mediatek.tv.retaildemo`, `com.sony.dtv.demosupport`, `com.sony.dtv.multiscreendemo`
+- `com.sony.dtv.smarthelp`, `com.sony.dtv.helpguidecontents`
+
+Home, so the new launcher could take it:
+
+- `com.google.android.tungsten.setupwraith`
+- `com.google.android.apps.tv.launcherx`
+
+Off because this owner does not use them, not because the chassis requires it:
+`com.crunchyroll.crunchyroid`, `com.sonypicturescore`, `com.google.android.play.games`,
+`com.sonyliv`, `com.graymatrix.did` (ZEE5), `com.playstation.remoteplay.tv`.
+
+Left enabled on purpose: Netflix, Prime Video, YouTube, YouTube Music, JioHotstar,
+Spotify, voice, the Chromecast and AirPlay packages, screen mirroring, and Sony's
+firmware updater. Playback of each was not rechecked after the disables.
+
+## Debugging
+
+Wireless debugging listens on its own TLS port (`adb mdns services` lists
+`_adb-tls-connect._tcp`). That port changes. `adb tcpip 5555` is what opened the plain
+port for the tools. `adb_enabled` was already `0` while port 5555 still answered,
+because wireless debugging was on and `service.adb.tcp.port` was `5555`.
+
+Turning wireless debugging off made both that TLS port and 5555 refuse a connection.
+The shell dropped as they closed, so the saved authorization was not revoked from here,
+and the set was not rebooted after that close. An earlier reboot, with wireless
+debugging still on, had left 5555 closed until `adb tcpip 5555` was run again, and the
+TLS port came back. This note does not claim either port stays closed across a boot
+once debugging has been switched off.
+
+## What this session did not check
+
+The remote's Netflix, Prime Video, YouTube, Input and Settings buttons, held volume,
+HDMI picture, the tuner, and a cast from a phone. On the BRAVIA 8 those app buttons and
+Settings are delivered only to `launcherx`, so with that package disabled they may do
+nothing here too. That was not measured on this set. A key helper was not enabled,
+because on other Sony builds it costs the held-volume repeat.
diff --git a/examples/README.md b/examples/README.md
@@ -557,6 +557,7 @@ Notes for models that have no tested list yet live in [`docs/devices/`](../docs/
 - [Skyworth 55G6](../docs/devices/skyworth-9r52-g6.md) (`9R52_G6`, Realtek RTD299x, Coocaa 6.20, Android 5.1.1 / API 22, `LMY47V`): `pm disable-user` is refused and `pm uninstall --user 0` is reverted by the root daemon `coocaa_guard`, so the 21-package list is built on `pm hide` (survives a reboot, `pm unhide` rolls back); hiding `com.tianci.movieplatform` hangs the boot at the logo behind a `KeyguardScrim` until `pm unhide` plus a reboot; HOME is owned by `com.tianci.system` through `persist.service.homepage.*`, rewritten from the read-only pcfg file at every boot; adbd on this build serves a single TCP transport, so a launcher holding a local ADB session can starve the computer's connection. Third-party Home handover works through an accessibility relay and skips the 15 s boot ad; cold boot verified 3/3 on 2026-10-31 (the firmware ad still appears in some cold boots), and the power key reboots this set rather than suspending it.
 - [TCL 40S65A](../docs/devices/tcl-40s65a.md) (Android TV 9 `PPR2.180905.006.A1`): the launcher installs, takes Home and keeps it (Netflix and YouTube play); after a while in an app, BACK sometimes lands on HDMI 2 - an onn. stick in standby there, "No signal" - instead of the launcher, and HOME returns immediately; the report names no packages, so no list yet.
 - [XGIMI H1](../docs/devices/xgimi-h1.md) (MStar `guava`, GMUI V1.5.3, Android 5.1.1 `LMY47V` userdebug): `pm disable-user` is refused and `pm hide` works from the shell; what each XGIMI/MStar preload declares (an ad/statistics receiver, phone-remote and file-push servers with APK installers, two casting receivers, a 2017 Google stack) and which ports they open; init runs Samba as root with guest access, which hiding FileManager does not stop; owner report, no list the repo tools can apply.
+- [Sony K-55XR35M2 (BRAVIA 3)](../docs/devices/sony-k-55xr35m2.md), `BRAVIA CT1` / `BRAVIA_CT1`, MediaTek MT9690, Google TV 14 `UKN5.250921.001`: not the BRAVIA 9 II or BRAVIA 8 lists; Live TV is `com.mediatek.tv.oneworld.tvcenter`, not `tvlin`; the saved Wi-Fi in use was owned by `android.uid.system`, so disabling setupwraith did not drop it; `set-home-activity` was a no-op until `launcherx` was disabled; 23 packages, reboot-checked the same day; the physical remote and a phone cast were not confirmed; no several-day debloat list.
 
 - [SkyworthDigital HP4416-TVplus / TVPLUS BOX](../docs/devices/skyworth-hp4416-tvplus.md) (`HP44H`, Android TV 14, `UKG3.260404.001.C02.00.085_20260723`): factory Home behavior and owner-requested TR369 package isolation, reboot and playback checks, and independent TR069/logging services that remain active; short report, no tested debloat list.
 - [Sharp AQUOS 4T-C70CN1 (`AQUOS-TVJ19`)](../docs/devices/sharp-aquos-4t-c70cn1.md), Japan, `tcmeruj` / MediaTek `mt5893`, Android TV 10 `55200Q QTG3.210505.001`: the tuner is Sharp's `jp.co.sharp.av.android.aquostvapp`, and the launcher's default `com.mediatek.wwtv.tvcenter` is not installed on this firmware at all, so the Inputs menu carries no Live TV row until `live_tv_package` names it (the pill would still show for the HDMI ports, so the failure is quiet); identity from a `getprop` capture, with the Inputs list, the remote's keys and the disabled set left unverified because the set was in standby; no debloat list.