The recovery mode can be entered with Volume Up + Hang Up/Power key, then to get the recovery menu, press Power + Volume Up. KaiOS 3.1 is now built based on Android 10 instead of 6.0.
In fastboot mode, technically the phone can be flashed with HMD Device Kit, and I can flash most of partitions, except config (for enabling OEM unlock).
I can flash cache-jb.img to this phone, but it still cannot enable developer menu. I wonder if I could use cache injection method to overwrite config partition with OEM unlock enabled flag?