The router worked. I want to be clear about that up front, because it's the whole tragedy in one sentence. It routed packets, it held a wifi signal across the house, it had done so without complaint for the better part of three years. And on a quiet Saturday I decided it would be better with OpenWrt on it, because the stock firmware hadn't seen an update in eighteen months and I'd convinced myself that mattered more than the fact that nothing was actually wrong.
The flash itself went fine, or appeared to. Stock web UI, firmware upgrade page, point it at the factory image, wait. The progress bar filled, the box rebooted, and then it just sat there with a solid power LED and absolutely nothing else. No DHCP lease. No ping to the default address. No wifi. A small heavy paperweight that had, ten minutes earlier, been my entire home network.
Here is what I'd skimmed past: this model had two hardware revisions that share a model number but not a flash layout, and I'd grabbed the image for the wrong one. The OpenWrt wiki page even says so, in a box, in bold, which I had read in the way you read a terms-of-service agreement. The bootloader was intact, the kernel was not, and the device had no idea what to do about it.
What saved it was the serial console. Most of these boards have an unpopulated header sitting right there next to the SoC, three or four pads for ground, transmit and receive. I soldered on a pin header, wired up a 3.3V USB-to-TTL adapter (and double-checked it was 3.3V and not 5V, because 5V is how you turn a recoverable brick into a real one), and opened a terminal at 115200 baud. The reward for that small act of soldering was a U-Boot prompt: the bootloader was alive and waiting, it just had nothing valid to hand control to.
From there it was a TFTP recovery. Set a static IP on the laptop, run a TFTP server pointing at the correct image this time, interrupt U-Boot's countdown, and walk through its built-in recovery commands to pull the image over the network and write it to flash. A few tense minutes, a deliberate reboot, and the thing came up on OpenWrt as though nothing had happened. Which it nearly hadn't, in the worst sense.
The lesson is the oldest one in the book and I clearly hadn't learned it: don't reflash a router unless something is actually broken, and if you're going to, identify the exact hardware revision before you so much as open the firmware page. The serial header turned this from a binned device into a lost afternoon. If your router doesn't expose one, the calculus before you flash is very different, and "it works fine" becomes a much louder argument for leaving it alone.