Phase 7C – Updated-system-app feasibility

Device facts

Package	Base path	Version	Current state	`/data/app` update technically possible?
`org.droidtv.channels`	`/system/priv-app/channels/channels.apk`	1 / `0.0.0.1`	base system app, not `UPDATED_SYSTEM_APP`	yes in principle, with accepted Platform signer and compatible higher version
`org.droidtv.gel`	`/system/app/gel/gel.apk`	58724408 / `7.2.0.56`	base system app, not updated	yes in principle, same constraints
`org.droidtv.tv.tptvservice`	`/system/app/TPTvService/TPTvService.apk`	31 / `12`	base system app, persistent/core, not updated	Android mechanism yes; operational risk materially higher

The device already has other updated system applications under /data/app, so the Android mechanism is enabled. None of the three targets currently uses it.

Hard acceptance conditions

Same package name.
A PackageManager-compatible signing identity/lineage. Here that means the Philips/Android Platform signer SHA-256 D8:FF:E0:AF:...:90:68.
android.uid.system compatibility; it cannot be dropped or replaced without breaking UID/data/permission semantics.
Accepted version/update policy (normally a higher versionCode; downgrade is not a production plan).
Compatible manifest, SDK, native ABI and provider/service contracts.
Explicit data-schema migration and rollback testing.

The public certificate is available, the private signing key or an OEM signing service is not. Therefore no accepted update can currently be produced.

Expected lifecycle for a correctly signed Channels candidate

This is a documentation-only sequence. No command below was executed.

BEFORE

Record base/current package paths, versions, signer, /data free space and EPG database schema/backup.
Prove a cold-boot recovery route and test on an equivalent lab device.
Verify the candidate's signer, manifest, version and hashes offline.

INSTALL

PackageManager validates the candidate and places the accepted update under /data/app; /system/priv-app/channels/channels.apk remains unchanged.
No AVB/system-image modification is required for this path.
A nonmatching signer/shared UID must be rejected; bypassing this check is not an option.

PROCESS RESTART

PackageManager stops/restarts the package as part of replacement.
The /data/app APK becomes active and ART compiles/caches artifacts in the data-side runtime locations. Stock /system/.../oat/arm files remain the immutable base artifacts.
Providers and clients must tolerate the restart and schema migration.

VALIDATE

Confirm active path/version/signer, process stability, channel guide, Now/Next, favorites, timers/reminders/recordings and EPG retention.
Reboot/standby/cold-boot tests remain mandatory before production approval.

UNINSTALL UPDATE / FALLBACK

Live cmd package help documents uninstall-system-updates [<PACKAGE>] as: “Removes updates to the given system application and falls back to its /system version.” This is the intended rollback mechanism, not an APK delete.
The stock /system APK becomes active again because it was never overwritten.
Data preservation and compatibility are not guaranteed by this observation. A newer update may have migrated DB/preferences beyond the old base's ability to read. Rollback must be tested with real data and an independent backup.
Factory reset would also remove /data/app updates but is destructive and is not a routine rollback.

The live help text is the strongest device-specific fallback evidence. AOSP's PackageManager shell implementation is available at https://android.googlesource.com/platform/frameworks/base/+/698d5999954b3bc7483dedecc2d94a65d69bbd42/services/core/java/com/android/server/pm/PackageManagerShellCommand.java.

Risk ranking

Channels: best first candidate if signing and recovery conditions are met; not persistent/core, clear measured benefit. Current status: NO-GO.
GEL: mechanism feasible but WorkManager schema/migration and telemetry semantics need source-level integration. Current status: NO-GO.
TPTvService: technically updateable but persistent/core boot-start role increases crashloop and recovery risk. Current status: NO-GO.

4.3 KiB Raw Blame History Unescape Escape