fix: fail closed on DDL the migration risk parser doesn't fully understand

Three classification bugs in DdlStatementParser shared one root cause:
branches assumed rather than verified what the parse tree contained.

- Multi-statement SQL: parse() kept only the first statement and silently
  discarded the rest, so a hidden DROP TABLE riding after a harmless ALTER
  reported SAFE while Postgres executed both. Switch to parseStatements()
  and require exactly one statement, matching the existing multi-clause guard.
- DROP CONSTRAINT shared operation=DROP with DROP COLUMN and was reported as
  DROP_COLUMN (wrong operation, false "VACUUM reclaims it" reason, and locks
  missing the referenced table). Gate DROP_COLUMN on getColumnName() actually
  being set; anything else falls through to UNKNOWN.
- ALTER COLUMN ... DROP NOT NULL fell into the same weak ALTER branch as a
  real type change and was reported as ALTER_COLUMN_TYPE with rewritesTable=
  true, though it is metadata-only. No existing rule models it correctly
  (SET_NOT_NULL's rule is specific to adding the constraint), so it now
  returns UNKNOWN rather than a confident wrong answer.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: notSumit25

backend/src/main/java/com/dbaagent/service/migration/DdlStatementParser.java

@@ -44,12 +44,17 @@ public Optional<DdlFacts> parse(String sql) {
                     null, null, null, null, null, false, notValid, false, null, sql));
         }
 
-        Statement stmt;
+        List<Statement> statements;
         try {
-            stmt = CCJSqlParserUtil.parse(normalized);
+            statements = CCJSqlParserUtil.parseStatements(normalized);
         } catch (Exception e) {
             return Optional.empty();
         }
+        // Postgres executes every statement in the string, not just the first; a single
+        // DdlFacts cannot honestly represent more than one, so refuse rather than judge
+        // the string on its first statement alone.
+        if (statements.size() != 1) return Optional.empty();
+        Statement stmt = statements.get(0);
 
         if (stmt instanceof CreateIndex ci) {
             return Optional.of(new DdlFacts(DdlOperation.CREATE_INDEX,
@@ -72,7 +77,10 @@ private Optional<DdlFacts> fromAlter(Alter alter, String rawSql, boolean notVali
         String table = strip(alter.getTable().getName());
         String op = e.getOperation() == null ? "" : e.getOperation().name().toUpperCase(Locale.ROOT);
 
-        if ("DROP".equals(op)) {
+        // DROP CONSTRAINT arrives with the same operation=DROP and a null column name;
+        // only a genuine DROP COLUMN names a column. A dropped constraint also takes a
+        // lock on the referenced table, which this parser has no data for — fail closed.
+        if ("DROP".equals(op) && e.getColumnName() != null) {
             return Optional.of(new DdlFacts(DdlOperation.DROP_COLUMN, table, strip(e.getColumnName()),
                     null, null, null, null, false, notValid, false, null, rawSql));
         }
@@ -114,6 +122,9 @@ private Optional<DdlFacts> fromAlter(Alter alter, String rawSql, boolean notVali
                         strip(cdt.getColumnName()), null, null, null, null, true,
                         notValid, false, null, rawSql));
             }
+            // "DROP NOT NULL" arrives with colDataType=null, specs=[DROP, NOT, NULL] — it is
+            // metadata-only, not a type change, but no rule models it correctly; fail closed.
+            if (cdt.getColDataType() == null) return Optional.empty();
             return Optional.of(new DdlFacts(DdlOperation.ALTER_COLUMN_TYPE, table,
                     strip(cdt.getColumnName()), null, type, null, null, false,
                     notValid, false, null, rawSql));

backend/src/test/java/com/dbaagent/service/migration/DdlStatementParserTest.java

@@ -120,4 +120,47 @@ void renameColumn_capturesNewNameOnly() {
         assertThat(f.newColumnName()).isEqualTo("b");
         assertThat(f.column()).isNull();
     }
+
+    // The parser used to keep only the first of several statements, so a hidden DROP TABLE
+    // riding along after a harmless ALTER reported SAFE. Must fail closed instead.
+    @Test
+    void multiStatementSql_returnsEmptySoCallerFailsClosed() {
+        assertThat(parser.parse("ALTER TABLE t ADD COLUMN a text; DROP TABLE users;")).isEmpty();
+    }
+
+    @Test
+    void singleStatementWithTrailingSemicolon_stillParses() {
+        var f = parser.parse("ALTER TABLE orders ADD COLUMN a text;").orElseThrow();
+        assertThat(f.operation()).isEqualTo(DdlOperation.ADD_COLUMN);
+    }
+
+    // DROP CONSTRAINT shares operation=DROP with DROP COLUMN but names no column; it used to
+    // be misclassified as DROP_COLUMN with a false "metadata-only, VACUUM reclaims it" reason
+    // and locks that omitted the referenced table. Must fail closed instead.
+    @Test
+    void dropConstraint_returnsEmptySoCallerFailsClosed() {
+        assertThat(parser.parse("ALTER TABLE pc_child DROP CONSTRAINT fk")).isEmpty();
+    }
+
+    @Test
+    void dropConstraintCascade_returnsEmptySoCallerFailsClosed() {
+        assertThat(parser.parse("ALTER TABLE pc_child DROP CONSTRAINT fk CASCADE")).isEmpty();
+    }
+
+    // The DROP CONSTRAINT fix must not break the ordinary DROP COLUMN path it shares an
+    // operation code with.
+    @Test
+    void dropColumnStillClassifiesCorrectly_afterDropConstraintFix() {
+        var f = parser.parse("ALTER TABLE orders DROP COLUMN c").orElseThrow();
+        assertThat(f.operation()).isEqualTo(DdlOperation.DROP_COLUMN);
+        assertThat(f.column()).isEqualTo("c");
+    }
+
+    // DROP NOT NULL used to fall into the same weak ALTER branch as ALTER COLUMN TYPE and
+    // was misreported as a table-rewriting type change. It is metadata-only, but no existing
+    // rule models that correctly, so it must report UNKNOWN rather than a wrong DANGER.
+    @Test
+    void dropNotNull_returnsEmptySoCallerFailsClosed() {
+        assertThat(parser.parse("ALTER TABLE orders ALTER COLUMN a DROP NOT NULL")).isEmpty();
+    }
 }