What baseline guards make SSE handlers resilient under cancellation and retries?