If you're running per-client Jobber credentials, the thing that bites isn't the writes - it's refresh token rotation.
Jobber issues a new refresh token on every refresh and invalidates the old one. If the new one isn't persisted before the retried call goes out, nothing appears to break: the access token you just got keeps working for the rest of its hour. Then the next refresh fails with invalid_grant and that client is silently disconnected, hours after the actual bug, with nothing in the logs pointing at it.
Two things worth doing. Serialise the refresh per account, so two concurrent requests can't both spend the same single-use token - the second one fails and takes the account with it. And log whether the token actually rotated rather than assuming it did.
The part I'd flag: a refresh succeeding proves nothing. I only convinced myself mine was right by forcing two refreshes an hour apart and confirming the second still worked, because that's the one that has to use the token the first one wrote.
matt_kaleafirm - on guardrails, agreed that reliability is the whole game. The failure mode I'd add to your list is the silent one: not a bad write, but a connection that quietly stops working and nobody notices until a customer asks why nothing synced.
