From 6921682bcd09f725012cf2fe2e74fa26377db8a4 Mon Sep 17 00:00:00 2001
From: devmrko <devmrko@gmail.com>
Date: Tue, 7 Jul 2026 17:06:49 +0900
Subject: [PATCH] [Developer] report NULLified KB columns in MCP results

---
 .../vpdbackoffice/service/OrdsProbeService.java           | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java b/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java
index 5d7d17a..96f6641 100644
--- a/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java
+++ b/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java
@@ -634,17 +634,19 @@ public class OrdsProbeService {
 
     List<String> masked = new ArrayList<>();
     for (ProtectedColumn column : sensitiveColumns) {
-      boolean present = false;
       boolean allNull = true;
       for (Map<String, Object> row : rows) {
         for (Map.Entry<String, Object> entry : row.entrySet()) {
           if (entry.getKey().equalsIgnoreCase(column.columnName())) {
-            present = true;
             allNull = allNull && entry.getValue() == null;
           }
         }
       }
-      if (present && allNull) {
+      // APEX_JSON omits a ref-cursor column whose value is NULL.  The KB
+      // object handlers always select every registered protected column, so
+      // a sensitive column missing from every JSON row is also a NULL result
+      // and must be reported as masked to the MCP/UI caller.
+      if (allNull) {
         masked.add(column.columnName().toLowerCase(Locale.ROOT) + " [" + column.policyLabel() + "]");
       }
     }