The router worked. I want to be clear about that before I tell you what I did to it. It routed, it had been up for the better part of a year, nobody in the house had complained. There was no problem. There was only an idle Saturday and a vendor firmware I found slightly annoying, which between them are more dangerous than any actual fault.
So I decided to put OpenWrt on it. Not because I needed anything OpenWrt offered. Because it was there, and because I wanted to. These are not good reasons, and I knew it at the time, and I did it anyway.
The flash went fine right up until it didn't. I had the correct image, or what I believed was the correct image, for the hardware revision. There is a lesson buried in "what I believed" that I would discover shortly. I uploaded it through the vendor's upgrade page, watched the progress bar, and then watched the router stop responding to absolutely everything. No web interface, no ping, no DHCP. A small black box with a power light and nothing else to say for itself.
I had flashed an image for the wrong hardware revision. The board looked identical to its sibling, the model number on the sticker was the same, but the flash chip and the radio underneath were not, and the bootloader had loaded something it could not run.
This is the bit I am quietly pleased about, because it is the only competent thing in the whole story. Most of these boards have a serial console, usually three or four unpopulated pads near the flash chip: ground, transmit, receive, and a voltage pad you leave well alone. I soldered a header on, clipped a 3.3V USB-to-TTL adapter to it, ground to ground, their TX to my RX and vice versa, and opened a terminal at 115200 baud:
picocom -b 115200 /dev/ttyUSB0
Power on, and the bootloader started talking. It was alive after all, just unable to boot the rubbish I had given it. The bootloader had a small recovery menu over serial, and a TFTP loader. I set up a TFTP server on my laptop, dropped the correct image for the correct revision on it, and told the bootloader to fetch and write it. A minute later the router came back up, healthy and contrite, and went back to doing the exact job it had been doing perfectly well before I interfered.
So what did I gain? Genuinely, nothing the router needed. What I gained was the reminder that "it works, but I could make it better" is the opening line of most of my self-inflicted outages, and that a serial console is the difference between a brick and an inconvenience. Solder the header before you flash, not after, when the board is dead and your hands are shaking slightly. The fifteen minutes with an iron up front is cheap insurance against an afternoon of regret.