pfSense! I appreciate that my slightly off-book configuration caused issues with your upgrade process. But pls to be failing more harmoniously than pretending to work while not applying any firewall rules, leaving everything wide open.
An option to roll back to the previous known-good state wouldn't be a bad idea, either. I mean, it would be lovely to be able to click a button and wait 5 minutes, but I'd settle for *being able to download old versions from somewhere official*. It's a firewall, FFS, the last thing anyone needs is to be downloading install packages from shady Eastern European websites.
In the end, I decided to put the extra work in, did a fresh install of 2.5.0, proved that it wasn't fundamentally broken, and began the tedious process of iteratively restoring parts of my previous settings until I discovered what was causing the problem (unsurprisingly, the traffic shaper, for those playing along at home). This provided a much-needed opportunity to tidy up the interface order so the primary WAN wasn't on OPT5.
I'm sure I was planning to do something yesterday, too. Possibly involving watching NASA littering Mars with robots.
Minor grumble: apuled.ko doesn't work in the new BSD version, so the blinkenlights are no longer blinking.