fix(ntfs): leave unused MFT reference identities unresolved

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

src/domain/windows/ntfsJournalCorrelation.test.ts

@@ -53,6 +53,16 @@ it("uses the MFT decoder's record identity verdict", () => {
   ).toEqual({ kind: "unresolved" });
 });
 
+it("leaves unused zero-sequence records unresolved", () => {
+  const correlate = createUsnMftCorrelator([
+    { ...baseRecord, sequenceNumber: 0 },
+  ]);
+  expect(correlate({ fileReference: 7n, parentReference: 7n })).toEqual({
+    file: { kind: "unresolved" },
+    parent: { kind: "unresolved" },
+  });
+});
+
 it("keeps duplicates ambiguous and skips extensions and unverified records", () => {
   const correlate = createUsnMftCorrelator([
     baseRecord,

src/domain/windows/ntfsJournalCorrelation.ts

@@ -37,6 +37,7 @@ export const createUsnMftCorrelator = (
     // logical MFT stream. Extension records do not identify separate files.
     if (
       record.baseRecordReference !== null ||
+      record.sequenceNumber === 0 ||
       !record.extentValid ||
       record.fixups.verifiedSectors * FIXUP_SECTOR_BYTES !== record.totalBytes
     )