I ought to do a write up, but If you open it up the UART pads are available to get a U-Boot console. U-boot is in HAB mode, with a custom signed debian buster kernel. This was my first time dealing wit u-boot, but it was otherwise pretty open and was able to write to ENV and FS from the u-boot console, which let me stop the Freewrite app from starting, boot into root shell, turn on SSH, etc. So you can get into userspace and replace the UI and whole app. When I dropped this project I had it booting shell onto the e-ink, with a command to drop back into the Freewrite app if I wanted.

Then they released the new app, which looked like it was also just in userspace (not a kernel or fw update) so I wanted to start over with the update, but never got back to it.