It's been a while since I had to recover my tl-wdr4300 (partially because it's no longer in daily service), but rev 1.7 and your tftp traces show that it should have the push-button tftp recovery, which has always worked reliably for me. Adding a simple, unmanaged, switch between the to-be-recovered router and your client hosting the tftpd is very much recommended, as it reduces the time necessary for link training and avoids ifdown events on your client. An OpenWrt factory image can be used as-is for this recovery (just rename it and serve it under the specified IP from your tftpd, make sure that your client's firewall rules allow these tftp transfers). TP-Link OEM firmware images can only be used for recovering if they don't contain a bootloader in front of the actual firmware (kernel+rootfs), this means they don't include the string 'boot' in their filename and have exactly the same size as OpenWrt's factory images (of not, you must strip off the bootloader). Trying to flash an OEM image with embedded bootloader will brick the device, permanently overwrite the wifi calibration data (non-recoverable) and may affect uboot-env (and the hardware IDs used for verifying uploaded recovery images). Serial console access would come in handy at this point, but chances are high that your device's wireless capabilities have already been permanently shot.