Since your question doesn't appear to be related to openwrt, I doubt you'll get a lot of helpful answers.
A Firmware Recovery Mode it also started before it actually boots the OS.
But, you device appears to have a serial header, depending on what options the boot loader have, it might be a way forward.
Another option could be to create and boot an openwrt initramfs, and dd the image from it.
You might consider creating a custom image, to be flashed. Which also has the advantage to allow firmware upgrades OTA.
Maintaining a fleet of WE826-16 this way.
Thank you for the answer. My guess is that the "Firmware recovery" on the WE826 is some kind of "mtd -r write /tmp/firmnware.bin firmware"
I will actuially try the above command from openwrt in order to see if it is the u-boot "recovery" messing up or the dd if=/dev/mtdxx of=/tmp/art.bin making a bad image
so....
an dd if=/dev/mtd3 of=/tmp/art.bin gives a file size 33,226,752 bin file
a " Save mtdblock contents" of firmware on luci gives a file size of 26,738,688 bin file
test 1
blocksize write incorrect block#=0!
done. 33226752 bytes written
no u-boot on serial! ...thow away the router (again)