I've been working through a similar problem and I've made it a step further than you, @jlighty. I am using c6 v2(US) version though.
I have tftp server setup at 192.168.0.66 - through tcpdump I can see that during the boot process, with reset button depressed, the router sends a tftp RRQ packet to tftp server:
192.168.0.86.1721 > 192.168.0.66.69: [no cksum] 45 RRQ "ArcherA6v2_tp_recovery.bin" octet timeout 5
- based on this request, I have renamed the factory squashfs snapshot .bin file to "ArcherA6v2_tp_recovery.bin" (note A6, not C6)
At this point, I can see that the bin file is being downloaded to the router (tcpdump shows tftp data & ack packets back and forth between router and tftp server), after the file is downloaded to the router though, it just boots back to the stock TP-Link firmware. It seems the downloaded file is being rejected by the router for some reason. I have tried the factory image, the upgrade image, as well as the initramfs image (all renamed to ArcherA6v2_tp_recovery.bin) and I get the same behavior with each. The router refuses to boot the tftp image and boots the stock firmware.
I opened the router and there are no obvious serial connections - I was going to try my hand at soldering on a JTAG connector but it appears to be beyond my skill.
I am happy to experiment on this router if anyone has any additional suggestions or hints.
I hope this helps others (I see that most references to Archer C6 are for the EU version, so hopefully the above info on the filename the router is looking for at recovery time helps you all.)