When to call `add_rewrite_rule` for safety

The easiest solution to this is to hook your add calls on to the last action which gets fired before the rules are rebuilt during the flush process.

The first part of the flushing process is to delete the rewrite_rules option. When this happening the following actions will fire:

do_action( 'delete_option', $option );
do_action( "delete_option_$option", $option );
do_action( 'deleted_option', $option );

Note: If there is no rewrite_rules option in the db then these actions are not fired so you will also need to ensure to register your rules when someone calls get_option(‘rewrite_rules’) and it is going to return an empty string – there are similar filters in get_option you can use for this.