Well, actually you are supposed to know the 8-digit pin code and enter it to the dialog on the client device, and send it to the router to confirm that the device is legit...
The router does not send it. It waits for it 
Typically the OEM PIN is written to the printed label and is stored in the OEM settings. But that is not used. OpenWrt does not read the pin code set in the OEM firmware, as the location and storage style of the code varies so much and as WPS is seen as insecure. (I have programmed my own community builds to read the OEM PIN in R7800 and WNDR3700 , but I am not actively using WPS. See How to read TP-Link factory wireless pin from flash - art - #2 by hnyman )
You need to set wps_pin option, 8 numbers, to the WiFi interface config. Just set it to whatever your like. (And possibly also set wps_label method option to 1)
Otherwise your WPS experiments look good.