How Uber Protects Against Retry Storms