-- Cache expanded ASN prefixes on the address group. `resolved` holds the concrete
-- CIDRs the expander last produced; `resolved_at` timestamps the last successful
-- expansion. Membership churn here is deliberately separate from rule definition:
-- the compiler folds `resolved` into the rendered set without touching rules.
ALTER TABLE address_groups
    ADD COLUMN resolved    JSONB       NOT NULL DEFAULT '[]'::jsonb,
    ADD COLUMN resolved_at TIMESTAMPTZ;