We had a similar debacle in early 2014 with automated updates. The crowdfunded Lockitron used a gear train that required it to back turn in order to unload the mechanism such that a user could turn the lock manually.

A hastily deployed update with insufficient QA would overturn the gear train past the limit of the underlying lock mechanism. At this point the stress would be released in one of three ways; (1) the main worm gear would pop off from the motor shaft, (2) a secondary gear would lose some teeth or, in a few rare cases, (3) the underlying lock would be damaged. We luckily had enough units to quickly ship replacements and rolled up an update that reversed the changes.

As a result, we made an explicit decision not to implement remote OTA firmware update capability for Lockitron Bolt. Instead we require users to be within Bluetooth range of the door so they can immediately verify the device is working as expected after an update. Given we don't want to nag users on a regular basis to update their lock, we opt for very conservative release cycles.

Additionally Lockitron Bolt uses a vastly simplified clutch mechanism that doesn't require any back turn behavior. This means you can always turn the lock manually (by hand or key), even if the device is dead.

Are you going to operate a crank to recharge the battery? I'm not too keen on wiring mains power up to something connected to my door handle.

This is a solved problem: https://en.wikipedia.org/wiki/Isolation_transformer

If the failure mode is potentially "you die", then we're probably better off low tech.