-- Per-device reachability, reported by the agent from its FIB. The compiler uses
-- it to scope which routers actually need to enforce an intent: a router only
-- carries a rule if it can route to both the source and destination networks.
-- When absent, the compiler safely over-approximates (enforces everywhere).
ALTER TABLE devices
    ADD COLUMN reachable_prefixes  JSONB       NOT NULL DEFAULT '[]'::jsonb,
    ADD COLUMN routes_reported_at  TIMESTAMPTZ;