The router worked fine. I want to be clear about that up front, because it makes everything that follows my own fault. It was a perfectly serviceable little box doing perfectly serviceable routing, and I decided on a Tuesday evening that what it really needed was a fresh OpenWrt build with a couple of packages the stock image didn't carry.
The flash went through. The reboot did not. Power light on, no wifi, no DHCP, no ping to the LAN address. I'd checked the device on the wiki, I'd checked it twice, and I'd still managed to pick a build that was wrong for the exact hardware revision. There's a revision printed on the underside in four-point text that I'd cheerfully ignored.
This is the moment you learn whether you bricked it or merely upset it. With most of these boxes you haven't actually killed anything, you've just installed firmware that won't boot, and there is almost always a way back in if you're prepared to open the case.
Inside, there were the four little pads you always find: a UART header the manufacturer used at the factory and never populated. Ground, transmit, receive, and a power pin you leave well alone. I soldered on a header, hung a USB-to-serial adapter off it at 3.3V, and opened a terminal at 115200 baud.
screen /dev/ttyUSB0 115200
And there was the bootloader, talking. That's the whole game, really. Once you have a serial console you have hands on the device below the level of the broken firmware, and from the bootloader you can usually pull a known-good image over TFTP. I set a static IP on the laptop, ran a TFTP server pointing at the correct build (the one I should have flashed the first time), and let the bootloader fetch and write it.
It came up. Wifi, DHCP, the lot. Total damage: one evening, a slightly singed thumb, and a header soldered to a board that will never be the same colour again.
The lesson isn't "don't flash routers". I'll flash the next one too. The lesson is that the serial console is the difference between a fun evening and a trip to buy a replacement, and it costs about four solder joints to have it ready before you need it. Read the revision number first, though. It's printed right there.