If availability is critical you might consider redundancy with CARP/pfsync.
It's not critical enough to be worth dealing that. Going down for like 15 minutes is fine, but most of a day is not.
In a perfect world we're looking for an update mechanism similar in speed and ease to other OSs where you can run a one liner on the live system which automatically downloads and installs a few files and reboots. I'm trying to get as close to that as possible without having to create and maintain a whole home-grown custom procedure.
It looks like the M:tier thing is pretty close, my only concern is how long it'll last before the maintainers lose interest and the project gets abandoned.
