feat(ntfs): advertise extension link coverage and shared capacity

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

src/contracts/ntfsJournalToolContracts.ts

@@ -13,7 +13,7 @@ export const NTFS_JOURNAL_TOOL_CONTRACTS = [
     ...toolContractMetadata(NTFS_JOURNAL_OPERATION),
     kind: "application",
     description:
-      "Inspect USN V2/V3/V4 records from a local acquired NTFS journal with a caller-paired MFT from the same volume. Reads at most 64 MiB per file. Returns source-order events, explicit coverage rows, both SHA-256 identities, and nextFileOffset for another page using the same inputs. V2 MFT references include sequence numbers; opaque V3/V4 IDs remain unresolved. MFT inventory counts are inline by default; select mft_record_limit for up to 32 detailed records. V4 returns at most 16 extent samples per event with explicit omissions. History completeness remains unknown. Other journal versions and unverifiable references remain explicit. Reads only the selected acquisition files.",
+      "Inspect USN V2/V3/V4 records from a local acquired NTFS journal with a caller-paired MFT from the same volume. Reads at most 64 MiB per file. Returns source-order events, explicit coverage rows, both SHA-256 identities, and nextFileOffset for another page using the same inputs. V2 MFT references include sequence numbers; opaque V3/V4 IDs remain unresolved. MFT inventory counts are inline by default; select mft_record_limit for up to 32 detailed records, including identity-checked extension attributes and explicit link coverage. V4 returns at most 16 extent samples per event with explicit omissions. History completeness remains unknown. Other journal versions and unverifiable references remain explicit. Reads only the selected acquisition files.",
     inputSchema: ntfsJournalInputSchema,
     outputSchema: evidenceResultOf(ntfsJournalResultSchema),
     examples: [

src/domain/windows/ntfsJournalQuery.ts

@@ -39,7 +39,7 @@ export const ntfsJournalInputSchema = z.strictObject({
     .max(MFT_INLINE_HEADER_LIMIT)
     .default(0)
     .describe(
-      "MFT record details to include (0–32). Default 0 returns inventory counts; select 1–32 to inspect names and attributes.",
+      "MFT record details to include (0–32). Default 0 returns inventory counts. Detail pages share a 32-additional-record budget for extension metadata, with up to 32 attribute-list reference results per base record and explicit partial coverage.",
     ),
   mft_record_start: offset
     .default(0)

src/domain/windows/ntfsMft.ts

@@ -148,6 +148,7 @@ export interface MftMetadata {
   readonly omitted_record_headers: number;
   readonly record_header_start_index: number;
   readonly next_record_header_index: number | null;
+  /** These aggregate counts cover physical records, without double-counting linked attributes. */
   readonly file_name_count: number;
   readonly file_name_incomplete_record_count: number;
   readonly attribute_incomplete_record_count: number;
@@ -399,7 +400,7 @@ const scanMft = (
 
   if (incompleteNames > 0)
     limitations.push(
-      `File name coverage is incomplete for ${String(incompleteNames)} record(s)`,
+      `Local FILE_NAME coverage is incomplete for ${String(incompleteNames)} record(s)`,
     );
 
   const metadata: MftMetadata = {

src/domain/windows/ntfsMftAttributes.ts

@@ -152,6 +152,7 @@ export interface MftAttributeScan {
   readonly attributeIssue: AttributeIssue | null;
   readonly fileNames: readonly MftFileName[];
   readonly attributes: readonly MftAttribute[];
+  /** Physical-record walk; linked names have independent attribute-list coverage. */
   readonly fileNameCoverage: "complete" | "incomplete";
   /** Local attribute walk only; extension references are retained, never followed. */
   readonly attributeCoverage: "complete" | "incomplete";