architecture KB freshness gate: state kb_snapshot_id primary