How should stale-session retry guards avoid regex-based misclassification?