test(utas-host): squad host mutation battery (20 mutants, all killed)

mutation-battery.sh injects each of the 20 required wrong behaviours into
the committed host (or the adapter it composes) source, runs the one host
test that must catch it, and requires a non-zero exit (killed), reverting
via git after each. Adds a duplicate-definition host round-trip test.

Kills: authz-skipped, authz-loop-empty, failure-masked-as-success,
PUT-as-partial-diff, extension-dropped, stale-accepted, missing-fabricated,
overlay-clobbers-{userInfo,settings,pile}, list-separate-shaping,
captain-as-resourceId, kit-by-slot, client-eval-dropped, host-trusts-fp,
per-slot-N+1, squad/active-to-Rust, duplicate-collapse, stale-content-length,
python-squad-after-failure. 20/20 killed.

openfut-utas-host/tests/host_test.rs

@@ -1025,4 +1025,42 @@ fn unrelated_route_still_reaches_python() {
     assert_eq!(resp.status, 200);
     assert!(resp.headers.iter().any(|(k, _)| k.eq_ignore_ascii_case("x-from-python")));
     assert_eq!(rec.lock().len(), 1, "reached Python");
+}
+
+#[test]
+fn duplicate_definition_instances_stay_distinct_through_host() {
+    // Two owned copies of ONE definition (card_a): distinct owned ids and wire
+    // ids, one shared resourceId — must not collapse anywhere in the host.
+    let a = item("oc-a", "card_a", 87, "GK", "Argentina", "Premier League", "Chelsea");
+    let c = item("oc-c", "card_a", 87, "ST", "Argentina", "Premier League", "Chelsea");
+    let items = vec![a, c];
+    let (resolver, w) = resolver_with_wires(&items, &[("card_a", 20801)]);
+    assert_ne!(w["oc-a"], w["oc-c"], "two copies get distinct wire ids");
+    let core = FakeCore::new(items.clone(), 2);
+    let ent = entities();
+    let deps = SquadDeps { core: &core, resolver: &resolver, entities: &ent };
+    let body = put_body("f442", w["oc-a"], &[(0, w["oc-a"], 1), (1, w["oc-c"], 7)], "[]");
+    let (put, _) = handle_put_squad(&body, &deps);
+    assert_eq!(put.status, 200);
+
+    let py = json!({"userInfo": {"personaId": 1}, "squad": {"players": []}});
+    let (url, _r) = spawn_mock_python_json(py);
+    let pass = PassClient::new(&url);
+    let (umi, _) =
+        handle_user_mass_info("GET", "/ut/game/fifa17/userMassInfo", &[], b"", &deps, &pass);
+    let v: Value = serde_json::from_slice(&umi.body).unwrap();
+    let occ: Vec<&Value> = v["squad"]["players"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|p| p["itemData"]["id"].as_i64().unwrap() != 0)
+        .collect();
+    assert_eq!(occ.len(), 2);
+    assert_ne!(
+        occ[0]["itemData"]["id"], occ[1]["itemData"]["id"],
+        "two copies of one definition keep distinct wire ids"
+    );
+    for p in &occ {
+        assert_eq!(p["itemData"]["resourceId"], 20801, "shared asset id");
+    }
 }