device researchboot chain map→cve landscape→oem-unlock verdict→temp root recipe→track a — bootloader unlock→track b — the root journey→track c — orbit downloader→uefi platform config→vb protocol + gbl-class attack→