@@ -0,0 +1,19 @@
+---
+'@objectstack/service-analytics': patch
+---
+
+fix(service-analytics)!: the draft preview refuses one column asked raw beside its own time bucket, as the live faces do
+
+Clause-②: no (narrowing) — the draft preview (`queryDataset` with `previewDrafts: true`) now refuses `INVALID_QUERY` / 400 a selection that asks one column for two values under one name (a dimension `X` beside a `timeDimensions` entry `OBJECT.X` with a granularity, or two buckets of one column), with the message, `path`, `param`, `object` and `fields` the native and ObjectQL strategies already answer; it served both columns. Nothing is widened: no export, answer member, error code or status is added, and the code was already on the wire.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type of the package root changes: a selection both live faces already refuse is now refused by the draft preview too, with their refusal. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** accept-set narrowing on the `queryDataset` draft preview (`@objectstack/service-analytics`).
+
+- **Before.** Measured on real SQLite: `dimensions: ['closed_at']` with `timeDimensions: [{ dimension: 'OBJECT.closed_at', granularity: 'month' }]` was refused by both live strategies with the engine's duplicate-column refusal (`groupBy.1.field names the column 'closed_at', which groupBy.0 already names`), while the draft preview answered one row per raw timestamp carrying both columns. The same held for a month and a year bucket of one column.
+- **Now.** The preview judges the keys the ObjectQL strategy would hand the engine for the selection, at the same positions, and refuses with the engine's refusal for them, so all three faces answer one `INVALID_QUERY` / 400 with one message.
+- **Unchanged.** A raw dimension beside a bucket of a different column, a dimension that is also its own time dimension (one bucket), and two dimensions over one column with no bucket (#28744) are still served on every face. The live refusal does not move.
+- **Who sees it.** An author previewing a draft dataset with such a selection: the preview now says what publish would say, instead of a table publish refuses.
+
+**The remedy.** Ask for the column once: as the bucketed time dimension, or as the raw dimension.
@@ -26,6 +26,10 @@
  *   value, keyed by both names, as native and the preview do, on its direct
  *   path and beside a cross-object dimension. Before, it answered
  *   `INVALID_QUERY` for the same duplicate groupBy column.
+ * - #28765. A selection that asks one column raw beside its own bucket (or for
+ *   two buckets of it) under one name is refused by the draft preview with the
+ *   live faces' refusal: `INVALID_QUERY` / 400, the same message, path, param,
+ *   object and fields. Before, the preview served both columns.
  */
 
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
@@ -368,4 +372,61 @@ describe('[#28690–#28692] time-dimension buckets, column-spelled filter member
       });
     });
   });
+  describe('#28765 — the draft preview refuses one column asked twice under one name, as the live faces do', () => {
+    /** Every face refuses `selection`, and the preview's refusal is the ObjectQL face's, field for field. */
+    const refusedAsLive = async (selection: Selection, path: string) => {
+      const refusals: Array<Record<string, unknown>> = [];
+      for (const face of FACES) {
+        const err = (await ask(face, UNBACKED, selection).then(
+          () => { throw new Error(`${face}: expected a refusal, but the query resolved`); },
+          (e: unknown) => e,
+        )) as Error & Record<string, unknown>;
+        expect(err.code, `${face}: ${err.message}`).toBe('INVALID_QUERY');
+        expect(err.status, face).toBe(400);
+        expect(err.path, face).toBe(path);
+        refusals.push({
+          message: err.message, code: err.code, status: err.status, httpStatus: err.httpStatus,
+          object: err.object, param: err.param, path: err.path, fields: err.fields,
+        });
+      }
+      expect(refusals[2], 'preview vs ObjectQL').toEqual(refusals[1]);
+      expect(refusals[2], 'preview vs native').toEqual(refusals[0]);
+    };
+
+    it('refuses a column raw beside its own month bucket, where the preview served both', async () => {
+      await refusedAsLive(
+        { dimensions: ['closed_at'], measures: ['total'], timeDimensions: [{ dimension: `${OBJECT}.closed_at`, granularity: 'month' }] },
+        'groupBy.1.field',
+      );
+    });
+
+    it('refuses it after another dimension, naming the later position', async () => {
+      await refusedAsLive(
+        { dimensions: ['region', 'closed_at'], measures: ['total'], timeDimensions: [{ dimension: `${OBJECT}.closed_at`, granularity: 'month' }] },
+        'groupBy.2.field',
+      );
+    });
+
+    it('refuses two buckets of one column', async () => {
+      await refusedAsLive(
+        {
+          measures: ['total'],
+          timeDimensions: [
+            { dimension: 'closed_at', granularity: 'month' },
+            { dimension: `${OBJECT}.closed_at`, granularity: 'year' },
+          ],
+        },
+        'groupBy.1.field',
+      );
+    });
+
+    it('still serves a dimension that is also its own time dimension, as one bucket', async () => {
+      await answeredAlike(
+        FACES,
+        UNBACKED,
+        { dimensions: ['closed_at'], measures: ['total'], timeDimensions: [{ dimension: 'closed_at', granularity: 'month' }] },
+        { rows: [{ closed_at: '2026-03', total: 100 }, { closed_at: '2026-04', total: 80 }], fields: ['closed_at:time', 'total:number'] },
+      );
+    });
+  });
 });
@@ -116,6 +116,7 @@ import {
   type DimensionLabelDeps,
 } from './dimension-labels.js';
 import { evaluateAnalyticsQueryOverRows } from './preview-evaluator.js';
+import { assertPreviewGroupColumnsDistinct } from './preview-group-column-door.js';
 // [#25778] The one lookup of a dataset duration measure by name.
 import { durationMeasureIn } from './duration-measure-sql.js';
 import { scopedMeasureFilter } from './scoped-measure-key.js';
@@ -2890,6 +2891,11 @@ export class AnalyticsService implements IAnalyticsService {
             // under one `null` key (and a filter on one matched no row) where
             // the live strategies join it. See {@link assertPreviewJoinsNothing}.
             this.assertPreviewJoinsNothing(q, cube);
+            // [#28765] …and a selection asking one column for two values
+            // under one name (raw beside its own bucket, or two buckets of
+            // it), with the refusal the engine gives both live faces for the
+            // same keys, where the evaluator served both columns.
+            assertPreviewGroupColumnsDistinct(q, cube);
             return evaluateAnalyticsQueryOverRows(
               q,
               previewEvaluationCube(q, cube),
 
@@ -0,0 +1,77 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#28765] The draft preview's copy of the engine's duplicate-group-column
+ * refusal.
+ *
+ * Both live faces hand `engine.aggregate` the `groupBy` the ObjectQL strategy
+ * builds (the native strategy delegates a bucketed time dimension to it), and
+ * the engine refuses one naming a column twice: `@objectstack/objectql`'s
+ * `assertAggregatedColumnsAreDistinct` (`aggregate-query-shape-door.ts`),
+ * `INVALID_QUERY` / 400. The strategy already names a key once when several
+ * dimensions read it (#28744), so what still reaches that refusal is a
+ * selection asking one column for two values under one name: the column raw
+ * beside its own bucket, or two buckets of it.
+ *
+ * The preview evaluates drafted rows in memory and hands no engine anything,
+ * so it served both columns. It now judges the strategy's own keys
+ * (`aggregateGroupKeys`, the function the strategy's direct path builds them
+ * with, so the positions are the engine's) on the object the strategy names
+ * (`aggregateObjectOf`), and refuses the same way.
+ *
+ * Why a copy and not the engine's function: `@objectstack/objectql` is a dev
+ * dependency of this package, never a runtime one, and its root does not
+ * export the door. The message, code, status and keys here are the engine's,
+ * byte for byte, and `preview-time-filter-fk-parity.test.ts` compares the
+ * preview's refusal with both live faces' field by field, so a change to the
+ * engine's wording reds that test. Only the `groupBy` half is copied: the
+ * strategy's keys carry no `alias`, and a measure alias colliding with a group
+ * column is a different question.
+ */
+
+import { StandardErrorCode } from '@objectstack/spec/api';
+import type { AnalyticsQuery } from '@objectstack/spec/contracts';
+import type { Cube } from '@objectstack/spec/data';
+import { aggregateGroupKeys, aggregateObjectOf, type AggregateGroupKey } from './strategies/objectql-strategy.js';
+
+type GroupColumnRefusal = Error & {
+  code?: string; status?: number; httpStatus?: number;
+  fields?: string[]; object?: string; param?: string; path?: string;
+};
+
+/** The column a key projects, and how the engine names its position. */
+function columnOf(key: AggregateGroupKey, i: number): { column: string; path: string } {
+  return typeof key === 'string'
+    ? { column: key, path: `groupBy.${i}` }
+    : { column: key.field, path: `groupBy.${i}.field` };
+}
+
+/**
+ * Refuse `query` when two of the keys the ObjectQL strategy would hand the
+ * engine for it over `cube` project one column, with the engine's refusal for
+ * it.
+ */
+export function assertPreviewGroupColumnsDistinct(query: AnalyticsQuery, cube: Cube): void {
+  const object = aggregateObjectOf(cube);
+  const groupBy = aggregateGroupKeys(query, cube);
+  const seen = new Map<string, string>();
+  for (const [i, key] of groupBy.entries()) {
+    const { column, path } = columnOf(key, i);
+    const first = seen.get(column);
+    if (first === undefined) {
+      seen.set(column, path);
+      continue;
+    }
+    const err = new Error(
+      `aggregate('${object}'): ${path} names the column '${column}', which ${first} already names — `
+      + `one row cannot carry two values under one column. The query was NOT run. Give one of the group `
+      + "entries its own 'alias'. A repeated column name kept only the last value written under it: a "
+      + 'count overwritten by a sum, or the group keys replaced by the numbers, while the answer looked served.',
+    ) as GroupColumnRefusal;
+    err.code = StandardErrorCode.enum.INVALID_QUERY;
+    err.status = 400;
+    err.httpStatus = 400;
+    Object.assign(err, { object, param: 'groupBy', path, fields: [column] });
+    throw err;
+  }
+}
@@ -220,6 +220,9 @@ function bucketEchoRefused(dimension: string, granularity: string, cause: Bucket
   return err;
 }
 
+/** One `engine.aggregate` group key: a column, or a column bucketed by a granularity. */
+export type AggregateGroupKey = string | { field: string; dateGranularity: string };
+
 /**
  * [#28692, #28744] Append `item` to an `engine.aggregate` `groupBy` unless an
  * identical key is already there: the same column, or the same column bucketed
@@ -231,17 +234,103 @@ function bucketEchoRefused(dimension: string, granularity: string, cause: Bucket
  * two values under one name: the column raw beside its bucket, or two buckets
  * of it, are different keys, so both are handed on and the engine refuses them.
  */
-function pushGroupKey(
-  groupBy: Array<string | { field: string; dateGranularity: string }>,
-  item: string | { field: string; dateGranularity: string },
-): void {
+function pushGroupKey(groupBy: AggregateGroupKey[], item: AggregateGroupKey): void {
   const same = (a: (typeof groupBy)[number]) =>
     typeof a === 'string' || typeof item === 'string'
       ? a === item
       : a.field === item.field && a.dateGranularity === item.dateGranularity;
   if (!groupBy.some(same)) groupBy.push(item);
 }
 
+/**
+ * The member `member` resolves to in `cube`'s `kind` bag: its own key, a
+ * `<cube>.`-qualified or other dotted spelling of a key, the key with its dots
+ * flattened, or (for a dotted dimension) a synthetic relation traversal.
+ * Module-level because it reads only the cube; `ObjectQLStrategy.lookupMember`
+ * is this function.
+ */
+function lookupCubeMember(
+  cube: Cube,
+  member: string,
+  kind: 'dimension' | 'measure',
+): { sql: string; type?: string } | undefined {
+  const bag = kind === 'dimension' ? cube.dimensions : cube.measures;
+  if (bag[member]) return bag[member];
+  if (member.includes('.')) {
+    const [first, ...rest] = member.split('.');
+    const tail = rest.join('.');
+    if (first === cube.name && bag[tail]) return bag[tail];
+    if (bag[tail]) return bag[tail];
+    const flat = member.replace(/\./g, '_');
+    if (bag[flat]) return bag[flat];
+    if (kind === 'dimension') return { sql: member, type: 'string' };
+  } else if (bag[member]) {
+    return bag[member];
+  }
+  return undefined;
+}
+
+/** The column `member` reads on the base object; `ObjectQLStrategy.resolveFieldName` is this function. */
+function resolveCubeFieldName(cube: Cube, member: string, kind: 'dimension' | 'measure' | 'any'): string {
+  if (kind === 'dimension' || kind === 'any') {
+    const dim = lookupCubeMember(cube, member, 'dimension');
+    if (dim) return dim.sql.replace(/^\$/, '');
+  }
+  if (kind === 'measure' || kind === 'any') {
+    const measure = lookupCubeMember(cube, member, 'measure');
+    if (measure) return measure.sql.replace(/^\$/, '');
+  }
+  return member.includes('.') ? member.split('.')[1] : member;
+}
+
+/** The object an aggregate over `cube` runs on; `ObjectQLStrategy.extractObjectName` is this function. */
+export function aggregateObjectOf(cube: Cube): string {
+  return cube.sql.trim();
+}
+
+/**
+ * The `engine.aggregate` `groupBy` the strategy's direct path hands the engine
+ * for `query`, in order: one key per `dimensions` entry, then one per bucketed
+ * `timeDimensions` entry not also listed there, each named once
+ * ({@link pushGroupKey}).
+ *
+ * [#28765] Module-level, and not exported from the package root, so the draft
+ * preview, which hands no engine anything, judges the same keys at the same
+ * positions and refuses a selection the engine would refuse with the engine's
+ * own words (`assertPreviewGroupColumnsDistinct`). It reads only the cube.
+ */
+export function aggregateGroupKeys(query: AnalyticsQuery, cube: Cube): AggregateGroupKey[] {
+  // Build groupBy from dimensions, honouring `timeDimensions` granularity.
+  // A date dimension with a granularity becomes a STRUCTURED groupBy item
+  // `{ field, dateGranularity }` — which `engine.aggregate()` buckets (the
+  // driver's own SQL expression, or in memory). Without this the ObjectQL
+  // path grouped raw timestamps (one bucket per row) and date-bucketed
+  // dataset widgets never matched their legacy `categoryGranularity`
+  // counterpart.
+  const granByDim = new Map<string, string>();
+  for (const td of query.timeDimensions ?? []) {
+    if (td.granularity) granByDim.set(td.dimension, td.granularity);
+  }
+  // [#28744] Each group key is named once (see {@link pushGroupKey}): two
+  // dimensions over one column (`region`, and `zone` declared over `region`)
+  // share its group, and the row mapping in `ObjectQLStrategy.execute` keys
+  // the answer by every dimension name over it.
+  const groupBy: AggregateGroupKey[] = [];
+  if (query.dimensions && query.dimensions.length > 0) {
+    for (const dim of query.dimensions) {
+      const field = resolveCubeFieldName(cube, dim, 'dimension');
+      const gran = granByDim.get(dim);
+      pushGroupKey(groupBy, gran ? { field, dateGranularity: gran } : field);
+      granByDim.delete(dim);
+    }
+  }
+  // Time dimensions not also listed in `dimensions` still bucket + group.
+  for (const [dim, gran] of granByDim) {
+    pushGroupKey(groupBy, { field: resolveCubeFieldName(cube, dim, 'dimension'), dateGranularity: gran });
+  }
+  return groupBy;
+}
+
 /**
  * ObjectQLStrategy — Priority 2
  *
@@ -263,35 +352,7 @@ export class ObjectQLStrategy implements AnalyticsStrategy {
     const cube = ctx.getCube(query.cube!)!;
     const objectName = this.extractObjectName(cube);
 
-    // Build groupBy from dimensions, honouring `timeDimensions` granularity.
-    // A date dimension with a granularity becomes a STRUCTURED groupBy item
-    // `{ field, dateGranularity }` — which `engine.aggregate()` buckets (the
-    // driver's own SQL expression, or in memory). Without this the ObjectQL
-    // path grouped raw timestamps (one bucket per row) and date-bucketed
-    // dataset widgets never matched their legacy `categoryGranularity`
-    // counterpart.
-    type GroupByItem = string | { field: string; dateGranularity: string };
-    const granByDim = new Map<string, string>();
-    for (const td of query.timeDimensions ?? []) {
-      if (td.granularity) granByDim.set(td.dimension, td.granularity);
-    }
-    // [#28744] Each group key is named once (see {@link pushGroupKey}): two
-    // dimensions over one column (`region`, and `zone` declared over
-    // `region`) share its group, and the row mapping below keys the answer by
-    // every dimension name over it.
-    const groupBy: GroupByItem[] = [];
-    if (query.dimensions && query.dimensions.length > 0) {
-      for (const dim of query.dimensions) {
-        const field = this.resolveFieldName(cube, dim, 'dimension');
-        const gran = granByDim.get(dim);
-        pushGroupKey(groupBy, gran ? { field, dateGranularity: gran } : field);
-        granByDim.delete(dim);
-      }
-    }
-    // Time dimensions not also listed in `dimensions` still bucket + group.
-    for (const [dim, gran] of granByDim) {
-      pushGroupKey(groupBy, { field: this.resolveFieldName(cube, dim, 'dimension'), dateGranularity: gran });
-    }
+    const groupBy = aggregateGroupKeys(query, cube);
 
     // The compiled dataset's own scope (#10298 / PR #10758), read ONCE and
     // reused below for both the per-measure aggregation filter (#10413 phase
@@ -1701,22 +1762,10 @@ export class ObjectQLStrategy implements AnalyticsStrategy {
     member: string,
     kind: 'dimension' | 'measure',
   ): { sql: string; type?: string } | undefined {
-    const bag = kind === 'dimension' ? cube.dimensions : cube.measures;
-    if (bag[member]) return bag[member];
-    if (member.includes('.')) {
-      const [first, ...rest] = member.split('.');
-      const tail = rest.join('.');
-      if (first === cube.name && bag[tail]) return bag[tail];
-      if (bag[tail]) return bag[tail];
-      const flat = member.replace(/\./g, '_');
-      if (bag[flat]) return bag[flat];
-      if (kind === 'dimension') return { sql: member, type: 'string' };
-    } else if (bag[member]) {
-      return bag[member];
-    }
-    return undefined;
+    return lookupCubeMember(cube, member, kind);
   }
 
+
   /**
    * [#14079] The (object, field) a filter member binds against — the echo's
    * copy of `NativeSQLStrategy.resolveStorageTarget`, kept beside the
@@ -1747,17 +1796,10 @@ export class ObjectQLStrategy implements AnalyticsStrategy {
   }
 
   private resolveFieldName(cube: Cube, member: string, kind: 'dimension' | 'measure' | 'any'): string {
-    if (kind === 'dimension' || kind === 'any') {
-      const dim = this.lookupMember(cube, member, 'dimension');
-      if (dim) return dim.sql.replace(/^\$/, '');
-    }
-    if (kind === 'measure' || kind === 'any') {
-      const measure = this.lookupMember(cube, member, 'measure');
-      if (measure) return measure.sql.replace(/^\$/, '');
-    }
-    return member.includes('.') ? member.split('.')[1] : member;
+    return resolveCubeFieldName(cube, member, kind);
   }
 
+
   private resolveMeasureAggregation(cube: Cube, measureName: string): { field: string; method: AggregationFunction } {
     const direct = this.lookupMember(cube, measureName, 'measure') as
       | { sql: string; type: string }
@@ -2307,7 +2349,7 @@ export class ObjectQLStrategy implements AnalyticsStrategy {
   }
 
   private extractObjectName(cube: Cube): string {
-    return cube.sql.trim();
+    return aggregateObjectOf(cube);
   }
 
   /**