The router was working. That should have been the end of the story. It routed packets, it held a wireless link across the house, and it had done so without complaint for the better part of two years. So naturally I decided it needed OpenWrt.
The stock firmware was fine. I just wanted the things stock firmware doesn't give you: SQM for the bufferbloat, a sane SSH server, and the ability to actually see what the box was doing instead of trusting a vendor web UI that lied about the WAN speed. All reasonable. None of it worth what followed.
the flash that didn't take
I picked the wrong image. The device had two hardware revisions that shared a model number and differed in their flash layout, and I grabbed the one for the revision I didn't own. The web flasher accepted it, wrote it, rebooted, and then nothing. No DHCP, no ping, no LEDs doing anything hopeful. Just a power light and the quiet certainty that I'd turned a working router into a paperweight.
This is the bit where, two years ago, I'd have shrugged and bought a new one. But I'd read enough recovery write-ups to know that "bricked" usually means "the bootloader is fine and userspace is gone". The bootloader almost always survives a bad flash. The trick is talking to it.
serial, the only honest interface
I opened the case, found the unpopulated four-pin header next to the SoC, and went looking for the pinout. Three of the four pads were what I needed: ground, TX, RX. I soldered on a header, hung my 3.3V USB-to-TTL adapter off it, and connected at 115200 8N1.
screen /dev/ttyUSB0 115200
And there it was. The bootloader, U-Boot, printing its banner and then dropping into a boot loop because the kernel it wanted didn't exist. I mashed a key during the countdown, got a prompt, and suddenly the box was talking to me again.
From there it was textbook. Set the bootloader's IP, point it at a TFTP server on my laptop, and have it pull the correct image into RAM and write it to flash:
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
tftpboot 0x80000000 openwrt-correct-revision.bin
A few minutes of erase-and-write, a reboot, and the router came up exactly as I'd wanted it in the first place, SQM and all.
what I actually learned
The lesson isn't "don't flash routers". I flash routers. The lesson is that the difference between a fun afternoon and a trip to the shop was a fifty-pence header and a serial adapter I already owned. Serial is the interface that doesn't lie to you. When everything else is dark, it's still there, printing the truth at 115200 baud.
I'd still tell you the router was fine before I touched it. It was. But it's better now, and I can prove it.