(Mostly) Bricked R7000

I recently installed ExpressVPN firmware on this formerly perfectly good router.  When I discovered that firmware doesn't support USB-connected drives (Readyshare), I set out to revert to factory F/W by downloading the current release (V1.0.9.18_1.2.27) and installing using the browser interface.

The end result is a router that won't go to the admin page or do any of the other routerly things one should expect using a browser.  I can communicate with it via CLI.  When I try to install F/W using TFTP, I get a connect request failure timeout.  I have performed the 30-30-30 reset several times without seeing a change.

If someone can provide or point me to guidance how to open the case without breaking it, I have numerous USB-TTL serial adapters and would like to give serial reprogramming a try.

TIA.