The key was finding a line in the flash filesystem's autoexec that dropped into maintenance mode if it finds a certain file on the ramdisk. However, the flash is read-only. So how do we get the file to the ramdisk after a reboot? And there's the fun twist-- as long as power is maintained, the ramdisk *persists across reboots*! Not at all what we'd expect from a modern system but completely sensible for the time. So touch the file, reboot, and there we go.