@@ -24,6 +24,8 @@ Clause-②: no (narrowing)
 
 **Where an envelope is literal data, the remedy names none there.** The refusal used to prescribe an envelope at whatever position it refused a token. Inside an object or list value, and in the legacy `assignment` shapes, the executor reads an envelope as data: the prescribed metadata registered and stored the envelope object. The refusal there now names what evaluates — the whole value built as one CEL map or list literal (mixed values each wrapped in `dyn(…)`), or the assignment moved into the `assignments` map. This holds for every token, not only the date macros. An envelope-shaped object in those positions is still data, unchanged.
 
+**The `has()` guard a refusal names now holds for an absent variable.** For a path that may be absent, the refusal named a guard on its last key, `has(source.id) ? source.id : null`. `has()` evaluates everything but its last selection, so where the variable itself was never bound — an `isInput` variable the caller left out, with no default — that guard failed the run (`Unknown variable: source`). The guard now tests each step off `vars`, which holds only the variables the run has bound: `has(vars.source) && has(vars.source.id) ? vars.source.id : null` answers `null` there, and where a key on the way is absent or `null`. `flow-bare-dollar-reference`'s value-slot hint carries the same guard. The value-slot retirement's earlier entry on this line prints the last-key guard; this entry supersedes it.
+
 ## FROM → TO
 
 | you wrote | write instead | what changes |
@@ -35,6 +37,7 @@ Clause-②: no (narrowing)
 | `'{TODAY() + days}'` | `{ dialect: 'cel', source: 'isoDate(addDays(today(), days))' }` | an absent `days`, or one that is not a number, fails the run where the template silently added 0 |
 | `'Due {TODAY()} by {$User.Id}'` | `{ dialect: 'cel', source: "'Due ' + isoDate(today()) + ' by ' + current_user.id" }` | guard the run user where a flow can run without one |
 | `payload: { due: '{TODAY()}' }` (a string inside an object value) | `payload: { dialect: 'cel', source: "{'due': isoDate(today())}" }` | an envelope written at `payload.due` would be stored as an object |
+| the guard an earlier refusal named, `has(source.id) ? source.id : null` | `has(vars.source) && has(vars.source.id) ? vars.source.id : null` | `null` where `source` was never bound, where the last-key guard failed the run |
 | a text slot's `assignments: { due: '{TODAY() + 7}' }`, then `'Due {{ due }}'` | `assignments: { due: { dialect: 'cel', source: 'isoDate(daysFromNow(7))' } }`, then `'Due {{ due }}'` | the text-slot remedy published earlier on this line computed the date through the value-slot spelling this change refuses |
 
 **The one-line fix: write a date macro as `isoDate(…)` / `isoDatetime(…)` in a CEL envelope, with a whole number of days.**
@@ -47,5 +50,5 @@ Clause-②: no (narrowing)
 
 - **The refusal.** `valueSlotTemplateRefusals` / `flowNodeValueTemplateRefusals` (`@objectstack/spec/automation`) keep no token; the text-slot judge's date-macro remedy (`textSlotTemplateRefusal`) names the CEL envelope. `FlowValueSlotSchema` / `AssignmentValueSchema` say so in their descriptions.
 - **The ledger.** The step-18 D3 entries `flow-value-slot-template-dialect-refused` (amended to refuse the date macros and name their forms) and `flow-text-slot-single-brace-refused` (its date remedy). No key is removed, so there is no tombstone, and there is no D2 conversion.
-- **`@objectstack/lint`.** `flow-double-brace-interpolation`'s hint in a value slot names the CEL envelope for the holes the author meant, where it named `{record.title}`, which the slot refuses; `flow-bare-dollar-reference`'s value-slot hint asks the judge at the string's own position, so a nested or legacy-shape string gets the spelling that evaluates there.
+- **`@objectstack/lint`.** `flow-double-brace-interpolation`'s hint in a value slot names the CEL envelope for the holes the author meant, where it named `{record.title}`, which the slot refuses; `flow-bare-dollar-reference`'s value-slot hint asks the judge at the string's own position, so a nested or legacy-shape string gets the spelling that evaluates there, and carries the judge's step-by-step `has()` guard.
 - **`@objectstack/service-automation`'s README.** Its *Expressions* section names the date macros' CEL forms.
@@ -265,7 +265,7 @@ for some input, so the rewrite is yours to judge.
 
 | you wrote | write instead | what changes |
 |:---|:---|:---|
-| `'{record.owner}'`, `'{x}'` | `{ dialect: 'cel', source: 'record.owner' }` | CEL refuses an **absent** variable or key where the template wrote nothing — guard one that may be absent: `has(record.owner) ? record.owner : null`, `has(vars.x) ? vars.x : null` (writes `null`) |
+| `'{record.owner}'`, `'{x}'` | `{ dialect: 'cel', source: 'record.owner' }` | CEL refuses an **absent** variable or key where the template wrote nothing — guard one that may be absent a step at a time from `vars`, which holds only the variables the run has bound: `has(vars.record) && has(vars.record.owner) ? vars.record.owner : null`, `has(vars.x) ? vars.x : null` (writes `null`). A guard on the last key alone does not hold where the variable is absent: `has(source.id)` fails the run when `source` was never bound (an `isInput` variable the caller left out) |
 | `'{items.0}'` | `source: 'items[0]'` | an empty list fails the run |
 | `'{$error.message}'` | `source: 'vars["$error"].message'` | a `$`-named variable is read through `vars` |
 | `'{round(x * 100) / 100}'` | `source: 'round(x * 100) / 100.0'` | CEL divides two integers as integers: keep a decimal operand on every division |
 
@@ -2720,6 +2720,21 @@ describe('#16405 — an `http` node payload is not a region, and both #1315 rule
         }
       });
 
+      // #19939 pass 3: the `has()` guard the hint carries for "one that may be
+      // absent" must hold where the VARIABLE is absent too: `has(source.id)`
+      // fails the run when `source` was never bound (an `isInput` variable the
+      // caller left out). The judge's guard tests each step off `vars`, and
+      // the hint carries the judge's words — that the guard answers `null`
+      // there is pinned through the engine in `service-automation`'s
+      // `value-slot-template-grammar.test.ts`.
+      it('the `has()` guard it carries tests each step off `vars`, and passes every judge as an envelope', () => {
+        const [f] = bareDollar(valueFlow('create_record', { objectName: 'task', fields: { who: '$source.id' } }));
+        const guard = 'has(vars.source) && has(vars.source.id) ? vars.source.id : null';
+        expect(f!.hint).toContain(`\`${guard}\``);
+        expect(f!.hint).not.toContain('`has(source.id)');
+        expect(refusalsOf(valueFlow('create_record', { objectName: 'task', fields: { who: CEL(guard) } }))).toEqual(NONE);
+      });
+
       it('control: outside the value and text slots the single brace still resolves, and the hint still names it', () => {
         const [f] = lintFlowPatterns(httpFlow({ ticket: '$source.id' })).filter((x) => x.rule === FLOW_BARE_DOLLAR_REF);
         expect(f!.hint).toContain('Wrap it and bind a variable: `{source.id}`');
 
@@ -35,12 +35,15 @@
  *    template — including a head variable named like an identifier CEL claims
  *    for itself (`{list.0}` → `vars["list"][0]`, #22290), or one the flow
  *    scope binds over it (`{vars.0}` → `vars["vars"][0]`), and inside an
- *    EXPRESSION token (`{int * 2}` → `vars["int"] * 2`).
+ *    EXPRESSION token (`{int * 2}` → `vars["int"] * 2`) — and the `has()`
+ *    guard it prints answers `null`, rather than failing the run, where the
+ *    variable itself was never bound (#19939 pass 3).
  */
 
 import { describe, expect, it } from 'vitest';
 import { VALUE_SLOT_TEMPLATE_REFUSAL, valueSlotTemplateRefusals } from '@objectstack/spec/automation';
 import { AutomationEngine } from '../engine.js';
+import { registerLogicNodes } from './logic-nodes.js';
 import { interpolateString } from './template.js';
 
 const VARIABLES = new Map<string, unknown>([
@@ -196,11 +199,62 @@ describe('the remedy a refused path prints reads, through CEL, the value the int
   });
 
   it('the guard is read off the refusal too, so each row above evaluates it where one is printed', () => {
-    expect(printedSpellings('{list.tags}')).toEqual(['vars["list"].tags', 'has(vars.list.tags) ? vars.list.tags : null']);
+    expect(printedSpellings('{list.tags}')).toEqual(['vars["list"].tags', 'has(vars.list) && has(vars.list.tags) ? vars.list.tags : null']);
     expect(printedSpellings('{list}')).toEqual(['vars["list"]', 'has(vars.list) ? vars.list : null']);
     expect(printedSpellings('{null.tags}')).toEqual(['vars["null"].tags']);
   });
 
+  // The guard is for "one that may be absent" — the VARIABLE as well as a key.
+  // A variable the run never bound (an `isInput` one the caller left out, with
+  // no default: `seedDeclaredVariables` sets nothing for it) is absent from the
+  // scope, and `has()` evaluates everything but its last selection, so a guard
+  // on the last key alone, `has(source.id)`, fails the run there. The printed
+  // guard tests each step off `vars`, which holds only the bound variables.
+  it.each([
+    ['{source.id}', 'source', { id: 'r1' }, 'r1'],
+    ['{record.owner.name}', 'record', { owner: { name: 'Ada' } }, 'Ada'],
+    ['{list.tags}', 'list', { tags: 'T' }, 'T'],
+    ['{x}', 'x', 7, 7],
+  ])('the printed guard of %s answers `null` where the variable, or a key on the way, is absent', (token, root, bound, value) => {
+    const guard = printedSpellings(token)[1]!;
+    expect(guard, token).toMatch(/^has\(vars\./);
+    const evaluate = (variables: Map<string, unknown>) =>
+      engine.evaluateValueEnvelope({ dialect: 'cel', source: guard }, variables, token);
+    expect(evaluate(new Map()), `${guard} — ${root} unbound`).toBeNull();
+    expect(evaluate(new Map([[root, null]])), `${guard} — ${root} null`).toBeNull();
+    if (typeof bound === 'object') expect(evaluate(new Map([[root, {}]])), `${guard} — a key absent`).toBeNull();
+    const variables = new Map<string, unknown>([[root, bound]]);
+    expect(interpolateString(token, variables, CONTEXT)).toEqual(value);
+    expect(evaluate(variables), `${guard} — bound`).toEqual(value);
+  });
+
+  it('through a run: an `isInput` variable the caller left out — the printed guard writes `null`, a guard on the last key fails the run', async () => {
+    const guard = printedSpellings('{source.id}')[1]!;
+    expect(guard).toBe('has(vars.source) && has(vars.source.id) ? vars.source.id : null');
+    const run = async (source: string) => {
+      const flowEngine = new AutomationEngine(quiet);
+      registerLogicNodes(flowEngine, { logger: quiet, getService: () => undefined } as never);
+      flowEngine.registerFlow('guarded', {
+        name: 'guarded', label: 'Guarded', type: 'autolaunched',
+        variables: [{ name: 'source', type: 'object', isInput: true }, { name: 'who', type: 'text', isOutput: true }],
+        nodes: [
+          { id: 'start', type: 'start', label: 'Start' },
+          { id: 'assign', type: 'assignment', label: 'Assign', config: { assignments: { who: { dialect: 'cel', source } } } },
+          { id: 'end', type: 'end', label: 'End' },
+        ],
+        edges: [{ id: 'e1', source: 'start', target: 'assign' }, { id: 'e2', source: 'assign', target: 'end' }],
+      } as never);
+      return flowEngine.execute('guarded', { params: {} } as never);
+    };
+    const guarded = await run(guard);
+    expect(guarded.success, guarded.error).toBe(true);
+    expect(guarded.output).toEqual({ who: null });
+    // Control: the guard the refusal printed before — `has()` on the last key alone.
+    const lastKeyOnly = await run('has(source.id) ? source.id : null');
+    expect(lastKeyOnly.success).toBe(false);
+    expect(lastKeyOnly.error).toContain('Unknown variable: source');
+  });
+
   it('a later keyword segment, and an index in the middle of a path', () => {
     const variables = new Map<string, unknown>([['record', { in: 'x', tags: { null: 'y' } }], ['rows', [{ name: 'r0' }]]]);
     expectReadingsAgree('{record.in}', variables, 'x');
 
@@ -73,10 +73,18 @@ describe('a value-slot string in the retired `{…}` dialect is refused, with th
     expect(message).toContain('the guarded form writes `null`');
   });
 
-  it('a dotted path: the same path in CEL, guarded on its last key', () => {
+  // A guard on the last key alone does not hold where the VARIABLE is absent:
+  // `has(source.id)` fails the run when `source` was never bound (`Unknown
+  // variable`). So the guard tests each step off `vars`, which holds only the
+  // bound variables. That it answers `null` there is pinned through the
+  // engine in `service-automation`'s `value-slot-template-grammar.test.ts`.
+  it('a dotted path: the same path in CEL, guarded a step at a time from `vars`', () => {
     const message = refusalOf('{record.assignee}');
     expect(message).toContain("{ dialect: 'cel', source: 'record.assignee' }");
-    expect(message).toContain('`has(record.assignee) ? record.assignee : null`');
+    expect(message).toContain('`has(vars.record) && has(vars.record.assignee) ? vars.record.assignee : null`');
+    expect(message).toContain('a step at a time from `vars`, which holds only the variables the run has bound');
+    expect(message).not.toContain('`has(record.assignee)');
+    expect(refusalOf('{a.b.c}')).toContain('`has(vars.a) && has(vars.a.b) && has(vars.a.b.c) ? vars.a.b.c : null`');
   });
 
   it('a numeric segment indexes the list: `userList.0` becomes `userList[0]`', () => {
@@ -147,8 +155,8 @@ describe('a head CEL claims is read through `vars`, the route a `$`-named head t
 
   it('a bare claimed variable keeps its guard, selected off `vars`; a keyword cannot be selected, so it gets none', () => {
     expect(refusalOf('{list}')).toContain('`has(vars.list) ? vars.list : null`');
-    expect(refusalOf('{list.tags}')).toContain('`has(vars.list.tags) ? vars.list.tags : null`');
-    expect(refusalOf('{for.tags}')).toContain('`has(vars.for.tags) ? vars.for.tags : null`');
+    expect(refusalOf('{list.tags}')).toContain('`has(vars.list) && has(vars.list.tags) ? vars.list.tags : null`');
+    expect(refusalOf('{for.tags}')).toContain('`has(vars.for) && has(vars.for.tags) ? vars.for.tags : null`');
     expect(refusalOf('{null}')).not.toContain('the guarded form');
     expect(refusalOf('{in.tags}')).not.toContain('the guarded form');
   });
@@ -174,7 +182,9 @@ describe('a head CEL claims is read through `vars`, the route a `$`-named head t
       expect(CEL_CLAIMED_IDENTIFIERS.has(ordinary)).toBe(false);
       expect(celPath(`${ordinary}.0.key`)).toBe(`${ordinary}[0].key`);
     }
-    expect(refusalOf('{record.assignee}')).toContain('`has(record.assignee) ? record.assignee : null`');
+    // The path is read bare; its guard, like every head's, tests each step off `vars`.
+    expect(refusalOf('{record.assignee}')).toContain("source: 'record.assignee' }");
+    expect(refusalOf('{record.assignee}')).toContain('`has(vars.record) && has(vars.record.assignee) ? vars.record.assignee : null`');
     expect(celPath('$error.message')).toBe('vars["$error"].message');
   });
 });
@@ -197,7 +207,7 @@ describe('a head the flow CEL scope claims is read through `vars`', () => {
     expect(celPath(`${name}.0`)).toBe(`vars["${name}"][0]`);
     expect(celPath(`${name}.tags`)).toBe(`vars["${name}"].tags`);
     expect(refusalOf(`{${name}.0}`)).toContain(`source: 'vars["${name}"][0]' }`);
-    expect(refusalOf(`{${name}.tags}`)).toContain(`\`has(vars.${name}.tags) ? vars.${name}.tags : null\``);
+    expect(refusalOf(`{${name}.tags}`)).toContain(`\`has(vars.${name}) && has(vars.${name}.tags) ? vars.${name}.tags : null\``);
   });
 });
 
 
@@ -107,7 +107,6 @@ import {
   TEMPLATE_TOKEN,
   celDateMacro,
   celExpression,
-  celHeadReadsThroughVars,
   celPath,
   isRunUserIdToken,
   runUserPathNeverResolved,
@@ -151,23 +150,33 @@ function spanOf(source: string): string {
 type Write = (source: string) => string;
 
 /**
- * A `has()` guard for a path of keys — the absent-key remedy. `has()` takes a
- * field selection over names alone: an index anywhere in its argument
- * (`has(a[0].b)`, `has(vars["$x"].y)`) is refused when it runs, so a path with
- * a numeric segment, a `$`-named head or a keyword segment gets no guard. A
- * bare variable, and a path whose head CEL or the flow scope claims
- * ({@link celHeadReadsThroughVars}), is selected off `vars`
- * (`has(vars.list.tags)`, `has(vars.vars.tags)`).
+ * A `has()` guard for a path of keys — the absent-variable and absent-key
+ * remedy. `has()` takes a field selection over names alone: an index anywhere
+ * in its argument (`has(a[0].b)`, `has(vars["$x"].y)`) is refused when it
+ * runs, so a path with a numeric segment, a `$`-named head or a keyword
+ * segment gets no guard.
+ *
+ * The guard tests one step at a time, from `vars`, which holds only the
+ * variables the run has bound: `has(vars.source) && has(vars.source.id) ?
+ * vars.source.id : null`. `has()` evaluates everything but its last selection,
+ * so `has(source.id)` fails the run (`Unknown variable`) when `source` was
+ * never bound — an `isInput` variable the caller left out, with no default —
+ * and `has(vars.source.id)` fails it too (`No such key`). The chain answers
+ * `null` there, and where a key on the way is absent, `null`, or not a map
+ * (`&&` stops at the first `false`). A path whose head CEL or the flow scope
+ * claims (`celHeadReadsThroughVars` in the token module) is selected off
+ * `vars` like any other (`has(vars.list) && has(vars.list.tags)`).
  */
 function guardOf(path: string): string | undefined {
   const segments = path.split('.');
   if (segments[0]!.startsWith('$') || segments.some((s) => /^\d+$/.test(s) || CEL_KEYWORDS.has(s))) return undefined;
-  const read = segments.length === 1 || celHeadReadsThroughVars(segments[0]!) ? `vars.${path}` : path;
-  return `has(${read}) ? ${read} : null`;
+  const steps = segments.map((_, at) => `vars.${segments.slice(0, at + 1).join('.')}`);
+  return `${steps.map((step) => `has(${step})`).join(' && ')} ? ${steps[steps.length - 1]} : null`;
 }
 
 const ABSENT_SENTENCE =
-  'CEL refuses an absent variable or key where the template wrote nothing, so guard one that may be absent with `has()`';
+  'CEL refuses an absent variable or key where the template wrote nothing, so guard one that may be absent with '
+  + '`has()`, a step at a time from `vars`, which holds only the variables the run has bound';
 
 /**
  * The remedy for `{$User.Id}` as a whole value: `current_user.id`, and for a
 
@@ -56,8 +56,10 @@ export const entry: SemanticMigration = {
   acceptanceCriteria:
     'Run objectstack validate: it reports each refused value as expression-invalid at the node and the value\'s '
     + 'path, with the CEL spelling of its tokens. Rewrite each as that envelope; where a variable or key may be '
-    + 'absent, guard it (has(record.owner) ? record.owner : null, has(vars.x) ? vars.x : null for a variable) or '
-    + 'route around the node. For the run user, find which flows can run without one (a schedule, a record change '
+    + 'absent, guard it a step at a time from vars, which holds only the variables the run has bound '
+    + '(has(vars.x) ? vars.x : null, has(vars.source) && has(vars.source.id) ? vars.source.id : null; a guard on '
+    + 'the last key alone, has(source.id), fails the run when source itself was never bound) or route around the '
+    + 'node. For the run user, find which flows can run without one (a schedule, a record change '
     + 'a system write can make): there, guard current_user.id, or skip the node with a start condition or a '
     + 'decision on current_user != null where an update_record must leave the stored value alone. For a date '
     + 'macro with a variable offset, check the variable is always set to a number where the flow runs; write a '