You should consider making pfSense more robust and less fragile.
Bricking the user's router as a result of an unsuccessful upgrade should not be an option.
The config update should be the last step that only executes after a successful, complete upgrade.
If the config is corrupt, the device should not brick as it does. There should either be an option to reset to factory, which does not work in my case and immediately outputs the same error and menu. Instead, on each successful boot after a config file update (archive bit), a backup copy of it should be taken and restored if the config is found to be broken.
Seeing how pfSense struggles to update (which also takes forever) and then bricks itself, I have no choice then to wipe out the lab and cross it off the list of solutions to our router replacement, which is a damn shame because otherwise pfSense is perfect.