Excited to see this develop.

Sony quietly removed the PAL/NTSC switch on some recent FX3/J1 firmwares — a really user-hostile move for anyone trying to avoid lighting flicker or needing flexible frame rates. The only practical “fix” I see in the wild is paying grey-market sellers (using leaked service tools I presume) to flip the 'region blob' so the menu comes back.

Is sonshell likely to be a useful vector for a more freely available solution? Not sure what level of access it actually offers i.e. is firmware/policy blobs readable/manipulable, and can persistent changes be made?

I'm afraid the only thing I do is use the official SDK to wirelessly log in to the camera. No firmware hacking at all. That said, if the SDK offers a setting the LCD menu on the camera doesn't, it would be fairly trivial to change it, yes.