@@ -0,0 +1,20 @@
+---
+'@objectstack/spec': minor
+'@object-ui/app-shell': patch
+---
+
+fix(spec)!: an object that declares one action name twice is refused at every door that parses it, and Studio never writes the pair
+
+Clause-②: no (narrowing)
+Metadata-protocol: narrowed
+
+**BREAKING** for an object whose `actions` array repeats a name.
+
+- **Before.** The object save door accepted two entries of one object's `actions` under one name: `PUT /api/v1/meta/object/X?mode=draft` answered 200, the publish answered 200, and both were served. An action name is the key the action runs under on its object, so which declaration ran was undefined. `defineStack` and `os validate` already refused the pair inside a stack; the save door parses an object alone and did not.
+- **Now.** `ObjectSchema` refuses the pair, so every door that parses an object refuses it: `defineStack`, `os validate`, `os build` and the object save door (422 `INVALID_METADATA`). One issue per repeated name, at `actions[j]` of its second declaration, naming the name and every index: `Object 'X' declares the action 'Y' twice in actions: actions[i] and actions[j]. …`. Inside a stack the pair is now refused by the object parse (`STACK_SCHEMA_INVALID`) rather than by the cross-reference pass's duplicate action-key check, which keeps the pairs that span two collections (a bound standalone action beside an embedded one, two standalone actions).
+- **Not changed.** Distinct names, the same name on two different objects, and a standalone action bound to an object by `objectName` (judged by `defineStack` for one stack and reported by the runtime's bound-action collision warning across packages).
+- **Fix.** Rename all but one of the colliding entries (and every button, flow and caller that runs the renamed one by name), or delete the duplicate.
+- **Stored rows.** A stored object that repeats a name still loads, under a `[metadata_spec_invalid]` diagnostic carrying the refusal, and its next save is refused. `os migrate meta --stored` lists each such object under the TODO id `object-duplicate-action-name-refused`; nothing rewrites it, because which declaration keeps the name only the owner knows.
+- **Studio** (`@object-ui/app-shell`). New already derived a name no listed action held; renaming an action in the editor's Name field to a name another action of the object holds now writes the first free `<name>_N` instead of the duplicate.
+
+<!-- adr-0087: registered object-duplicate-action-name-refused -->
@@ -0,0 +1,92 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #26725 — the object save door refuses an object that declares one action
+ * name twice.
+ *
+ * Measured on `main` @ `c8583f80` before the rule, on a `pnpm dev:crm` boot:
+ * `PUT /api/v1/meta/object/dup_item?mode=draft` with two actions named `dup`
+ * answered 200 and the publish answered 200. The rule lives in the spec parse
+ * (`duplicateActionNames`, the object refinement), and `saveMetaItem` parses
+ * with `ObjectSchema`, so the door answers `422 INVALID_METADATA` at the
+ * second declaration and stores nothing — the refusal `defineStack` and
+ * `os validate` meet, from the same rule.
+ */
+import { describe, expect, it } from 'vitest';
+import { assertEngineDeleteDispatch, assertEngineUpdateDispatch, assertEngineFindOnePredicate, type EngineFindOneQueryInput } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+/** The engine surface the repository write path touches (as the container-issue-descent harness). */
+function makeProtocol() {
+    const rows = new Map<string, Record<string, unknown>>();
+    let nextId = 0;
+    const engine: any = {
+        async findOne(object: string, query?: EngineFindOneQueryInput) {
+            assertEngineFindOnePredicate(object, query); return null; },
+        async find() { return []; },
+        async insert(table: string, data: Record<string, unknown>) {
+            nextId += 1;
+            if (table === 'sys_metadata') rows.set(`${data.type}|${data.name}`, data);
+            return { id: `r_${nextId}` };
+        },
+        async update(_t: string, data: Record<string, unknown>, opts?: Record<string, unknown>) {
+            assertEngineUpdateDispatch(data, opts);
+            return { id: null };
+        },
+        async delete(_t: string, opts?: Record<string, unknown>) {
+            assertEngineDeleteDispatch(opts);
+            return { deleted: 0 };
+        },
+        registry: { registerItem: () => {}, registerObject: () => {} },
+    };
+    const protocol: any = new ObjectStackProtocolImplementation(engine, () => new Map());
+    return { protocol, rows };
+}
+
+async function rejection(promise: Promise<unknown>): Promise<any> {
+    try {
+        await promise;
+    } catch (err) {
+        return err;
+    }
+    throw new Error('expected the save to be rejected, but it resolved');
+}
+
+const act = (name: string, label: string) => ({ name, label, type: 'script', target: 'noop', locations: ['record_header'] });
+
+const itemWith = (actions: unknown[]) => ({
+    name: 'dup_item',
+    label: 'Dup Item',
+    sharingModel: 'private',
+    fields: { title: { name: 'title', type: 'text', label: 'Title' } },
+    actions,
+});
+
+describe('#26725 the save door refuses an object that declares one action name twice', () => {
+    it('two actions named `dup` answer 422 INVALID_METADATA at the second one, and nothing is stored', async () => {
+        const { protocol, rows } = makeProtocol();
+
+        const err = await rejection(protocol.saveMetaItem({
+            type: 'object', name: 'dup_item', item: itemWith([act('dup', 'Dup A'), act('dup', 'Dup B')]),
+        }));
+
+        expect(err.code).toBe('INVALID_METADATA');
+        expect(err.status).toBe(422);
+        expect(err.issues).toEqual([expect.objectContaining({ path: 'actions.1', code: 'custom' })]);
+        expect(err.issues[0].message.startsWith(
+            "Object 'dup_item' declares the action 'dup' twice in actions: actions[0] and actions[1].",
+        )).toBe(true);
+        expect(rows.size).toBe(0);
+    });
+
+    it('control: the same object with distinct action names saves', async () => {
+        const { protocol, rows } = makeProtocol();
+
+        const result = await protocol.saveMetaItem({
+            type: 'object', name: 'dup_item', item: itemWith([act('dup', 'Dup A'), act('dup_b', 'Dup B')]),
+        });
+
+        expect(result.success).toBe(true);
+        expect(rows.size).toBe(1);
+    });
+});
@@ -68,6 +68,7 @@ describe('the refused-shape list — registered against the migration chain', ()
       'flow-value-slot-template-dialect-refused',
       'object-external-binding-managed-datasource-refused',
       'visibility-predicate-has-argument-refused',
+      'object-duplicate-action-name-refused',
     ]);
   });
 
@@ -661,3 +662,43 @@ describe('#25281 — a stored page or view whose visibleWhen hands `has()` an ar
     expect(PageSchema.safeParse(hasPage('has(status)')).success).toBe(true);
   });
 });
+
+// ── #26725 ────────────────────────────────────────────────────────────────
+
+const dupAct = (name: string, label: string) => ({ name, label, type: 'script', target: 'noop' });
+const dupRow = (actions: unknown[]) => ({
+  name: 'crm_deal',
+  label: 'Deal',
+  sharingModel: 'private',
+  fields: { title: { type: 'text', label: 'Title' } },
+  actions,
+});
+const dupActionIssue = (row: unknown) => {
+  const parsed = ObjectSchema.safeParse(row);
+  return parsed.success
+    ? undefined
+    : parsed.error.issues.find((i) => i.path[0] === 'actions' && /declares the action/.test(i.message));
+};
+
+describe('#26725 — a stored object that declares one action name twice is listed by object', () => {
+  it('one TODO at the second declaration, naming the name and both indexes; the row is not rewritten', () => {
+    const row = dupRow([dupAct('approve', 'Approve A'), dupAct('approve', 'Approve B')]);
+    const { item, todos } = storedTodos('object', row);
+    expect(item).toEqual(row);
+    expect(todos).toHaveLength(1);
+    const todo = todos[0]!;
+    expect(todo.conversionId).toBe('object-duplicate-action-name-refused');
+    expect(todo.path).toBe('objects[0].actions[1]');
+    expect(todo.reason).toMatch(/^No lossless rewrite: which declaration keeps the name/);
+    expect(todo.reason).toContain("Object 'crm_deal' declares the action 'approve' twice in actions: actions[0] and actions[1].");
+    expect(JSON.parse(todo.from)).toEqual({ name: 'approve', indexes: [0, 1] });
+    // The listing and the parse refuse ONE set: the stored row still fails the parse, at the same site.
+    expect(dupActionIssue(item)?.path).toEqual(['actions', 1]);
+  });
+
+  it('distinct names are not listed — and the parse accepts them', () => {
+    const row = dupRow([dupAct('approve', 'Approve'), dupAct('reject', 'Reject')]);
+    expect(storedTodos('object', row).todos).toEqual([]);
+    expect(dupActionIssue(row)).toBeUndefined();
+  });
+});
@@ -40,7 +40,8 @@
  *   `AutomationEngine.registerFlow` and `objectstack validate` run
  *   ({@link flowNodeValueTemplateRefusals}), and the `external` binding judge
  *   the object refinement and `defineStack` share
- *   ({@link externalBindingDatasourceRefusal}). A site is listed here exactly
+ *   ({@link externalBindingDatasourceRefusal}), and the one-name-per-action
+ *   judge of the object refinement ({@link duplicateActionNames}). A site is listed here exactly
  *   when that door refuses it. One door lives outside this package: the
  *   page/view `visibleWhen` rule in `@objectstack/lint` judges a `has()`
  *   argument on the engine's AST, which this package cannot parse, so its
@@ -59,6 +60,7 @@ import {
   isControlledByParentMasterField,
   type ControlledByParentMasterRefusal,
 } from '../data/controlled-by-parent-master.js';
+import { duplicateActionNames } from '../data/duplicate-action-names.js';
 import { externalBindingDatasourceRefusal } from '../data/external-binding-datasource.js';
 import { ComponentPropsMap } from '../ui/component.zod.js';
 import { ViewDataSchema } from '../ui/view.zod.js';
@@ -478,6 +480,31 @@ const visibilityHasArgument: RefusedStoredShape = {
   },
 };
 
+// ── #26725: an object that declares one action name twice ──
+
+const objectDuplicateActionName: RefusedStoredShape = {
+  id: 'object-duplicate-action-name-refused',
+  toMajor: 18,
+  surface: 'object.actions — two or more entries of one object under the same action name',
+  detect(stack, report) {
+    mapCollection(stack, 'objects', (obj, path) => {
+      for (const duplicate of duplicateActionNames(obj.name, obj.actions)) {
+        report({
+          path: `${path}.actions[${duplicate.indexes[1]}]`,
+          // The name and the sites only: an action body can carry request headers.
+          from: JSON.stringify({ name: duplicate.name, indexes: duplicate.indexes }),
+          reason: 'No lossless rewrite: which declaration keeps the name, and what the others are renamed to '
+            + '(with every button, flow and caller that runs them by name), only the owner knows. Left as stored, '
+            + 'the object registers under `[metadata_spec_invalid]` and its next save is refused with 422 '
+            + 'INVALID_METADATA. '
+            + duplicate.message,
+        });
+      }
+      return obj;
+    });
+  },
+};
+
 /**
  * Every refused stored shape, in report order. A new entry is a reviewed edit:
  * `refused-shapes.test.ts` pins each one.
@@ -488,6 +515,7 @@ export const REFUSED_STORED_SHAPES: readonly RefusedStoredShape[] = [
   flowValueSlotTemplateToken,
   externalBindingOnManagedDatasource,
   visibilityHasArgument,
+  objectDuplicateActionName,
 ];
 
 /**
 
@@ -0,0 +1,76 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#26725] The ONE predicate behind "an object declares each action name once".
+ *
+ * An action's `name` is its identifier on its object: the runtime registers and
+ * dispatches it under `<object>:<name>`, and the action endpoint addresses it
+ * as `/api/v1/actions/<object>/<name>`. Two entries of one object's `actions`
+ * under one name are two declarations under one key, so which one runs is
+ * undefined. `defineStack`'s cross-reference pass already refused that pair
+ * for a stack, but the object save door parses an object alone, so it saved
+ * and published the pair.
+ *
+ * Read by two doors, one judgement:
+ *
+ * - `ObjectSchema`'s refinement (`object.zod.ts`), so every door that parses an
+ *   object refuses the pair: `defineStack`, `os validate`, the object save door
+ *   (422 `INVALID_METADATA`) and the stored-row diagnostics;
+ * - the v18 stored-row listing (`conversions/refused-shapes.ts`), so
+ *   `os migrate meta --stored` names each stored object this refuses.
+ *
+ * Scope is ONE object's own `actions` array. A standalone action bound to the
+ * object by `objectName` is a second item, judged where both are visible:
+ * `defineStack`'s duplicate action-key check for one stack, and the runtime's
+ * bound-action collision report for two packages.
+ */
+
+/** One action name that an object's `actions` array declares more than once. */
+export interface DuplicateActionName {
+  /** The repeated action name. */
+  readonly name: string;
+  /** Every index of `actions` that declares it, ascending. */
+  readonly indexes: readonly number[];
+  /** The refusal's message, naming the action, every index and the fix. */
+  readonly message: string;
+}
+
+/** `actions[0] and actions[1]`, `actions[0], actions[2] and actions[5]`. */
+function joinIndexes(indexes: readonly number[]): string {
+  const sites = indexes.map((i) => `actions[${i}]`);
+  if (sites.length <= 1) return sites.join('');
+  return `${sites.slice(0, -1).join(', ')} and ${sites[sites.length - 1]}`;
+}
+
+/**
+ * Every action name that `actions` declares more than once, in the order each
+ * name first appears. An empty list means nothing to refuse. Read on a parsed
+ * object or a stored body alike: a non-array, a non-object entry and an entry
+ * with no string `name` are left to the schema's own issues.
+ */
+export function duplicateActionNames(objectName: unknown, actions: unknown): DuplicateActionName[] {
+  if (!Array.isArray(actions)) return [];
+  const indexesByName = new Map<string, number[]>();
+  actions.forEach((action, index) => {
+    const name = action !== null && typeof action === 'object' ? (action as { name?: unknown }).name : undefined;
+    if (typeof name !== 'string' || name === '') return;
+    const list = indexesByName.get(name);
+    if (list) list.push(index);
+    else indexesByName.set(name, [index]);
+  });
+  const owner = typeof objectName === 'string' && objectName.length > 0 ? `Object '${objectName}'` : 'This object';
+  const out: DuplicateActionName[] = [];
+  for (const [name, indexes] of indexesByName) {
+    if (indexes.length < 2) continue;
+    out.push({
+      name,
+      indexes,
+      message:
+        `${owner} declares the action '${name}' ${indexes.length === 2 ? 'twice' : `${indexes.length} times`} `
+        + `in actions: ${joinIndexes(indexes)}. An action name identifies the action on its object (it is the `
+        + 'key the action runs under), so only one of these declarations could run. Rename all but one of them, '
+        + 'or remove the duplicate.',
+    });
+  }
+  return out;
+}
@@ -0,0 +1,79 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #26725 — an object's `actions` array declares each action name once.
+ *
+ * Measured on `main` @ `c8583f80` before this rule, on a `pnpm dev:crm` boot:
+ * `PUT /api/v1/meta/object/dup_item?mode=draft` with two actions named `dup`
+ * answered 200, the publish answered 200, and the served object listed both
+ * (`dup/Dup A`, `dup/Dup B`). `defineStack` already refused the pair for a
+ * stack; the object parse now refuses it for every door that parses an object.
+ *
+ * Each refusal fixture differs from an accepted twin by one name.
+ */
+import { describe, expect, it } from 'vitest';
+import { ObjectSchema } from './object.zod';
+import { duplicateActionNames } from './duplicate-action-names';
+
+const act = (name: string, label = name) => ({ name, label, type: 'script' as const, target: 'noop' });
+
+const objectWith = (actions: unknown[]) => ({
+  name: 'probe_item',
+  label: 'Probe Item',
+  fields: { title: { type: 'text' as const, label: 'Title' } },
+  actions,
+});
+
+const issuesAtActions = (row: unknown) => {
+  const parsed = ObjectSchema.safeParse(row);
+  return parsed.success ? [] : parsed.error.issues.filter((i) => i.path[0] === 'actions');
+};
+
+describe('#26725 the object parse refuses two actions under one name', () => {
+  it('refuses a pair, at the second declaration, naming the name and both indexes', () => {
+    const issues = issuesAtActions(objectWith([act('dup', 'Dup A'), act('dup', 'Dup B')]));
+    expect(issues).toHaveLength(1);
+    expect(issues[0]!.code).toBe('custom');
+    expect(issues[0]!.path).toEqual(['actions', 1]);
+    expect(issues[0]!.message.startsWith(
+      "Object 'probe_item' declares the action 'dup' twice in actions: actions[0] and actions[1].",
+    )).toBe(true);
+  });
+
+  it('control: the same object with distinct names parses', () => {
+    expect(ObjectSchema.safeParse(objectWith([act('dup', 'Dup A'), act('dup_b', 'Dup B')])).success).toBe(true);
+  });
+
+  it('counts three declarations as one issue listing every index, at the second one', () => {
+    const issues = issuesAtActions(objectWith([act('first_one'), act('dup'), act('second_one'), act('dup'), act('dup')]));
+    expect(issues).toHaveLength(1);
+    expect(issues[0]!.path).toEqual(['actions', 3]);
+    expect(issues[0]!.message.startsWith(
+      "Object 'probe_item' declares the action 'dup' 3 times in actions: actions[1], actions[3] and actions[4].",
+    )).toBe(true);
+  });
+
+  it('reports one issue per repeated name', () => {
+    const issues = issuesAtActions(objectWith([act('dup_x'), act('dup_y'), act('dup_x'), act('dup_y')]));
+    expect(issues.map((i) => i.path)).toEqual([['actions', 2], ['actions', 3]]);
+  });
+
+  it('refuses a byte-identical twin too: two entries are two declarations under one key', () => {
+    const twin = act('same');
+    expect(issuesAtActions(objectWith([twin, { ...twin }]))).toHaveLength(1);
+  });
+});
+
+describe('#26725 duplicateActionNames reads a stored body as the parse does', () => {
+  it('leaves a non-array, a non-object entry and a nameless entry to the schema', () => {
+    expect(duplicateActionNames('o', undefined)).toEqual([]);
+    expect(duplicateActionNames('o', { dup: {} })).toEqual([]);
+    expect(duplicateActionNames('o', [null, 'dup', { label: 'x' }, { label: 'y' }, { name: '' }, { name: '' }])).toEqual([]);
+  });
+
+  it('names the object when it has a name, and says "This object" when it has none', () => {
+    expect(duplicateActionNames(undefined, [act('d'), act('d')])[0]!.message.startsWith(
+      "This object declares the action 'd' twice",
+    )).toBe(true);
+  });
+});