diff --git a/AI.md b/AI.md
index 42a15b3..1ac91e6 100644
--- a/AI.md
+++ b/AI.md
@@ -33,6 +33,7 @@ use, the current project status that the user pasted into the chat.
 - NetWare 4.x/OES/MOAB-only endpoints are not part of the default implementation target.  Already implemented compatibility code must not be removed or wrapped just because it is 4.x-era; only new, not-yet-implemented 4.x stubs should be placed behind `#if MARS_NWE_4`.  `MARS_NWE_4` is currently hard-disabled in `include/config.h.cmake` and should stay `0` unless the user explicitly asks to start that work.
 - When a `0x2222` group is forwarded out of `nwconn.c`, document both layers: `nwconn.c` should explain the group handoff/header, and the destination file (for example `nwbind.c`) should document concrete subfunction request/reply layouts.
 - For documentation-only endpoint patches, do not change parser offsets, byte order, reply layout, or completion behavior.  Always compare the code parser/reply layout against the applicable SDK/WebSDK/PDF request format and, when available, the uploaded SDK include prototypes.  If the code differs from the SDK layout, document the concrete difference inline and mirror it in `TODO.md` for later testing.  If it matches, say so in the patch summary so the audit trail is clear.
+- When an SDK/WebSDK/PDF endpoint number is written in decimal notation, convert it carefully to the wire `case` value before adding inline documentation.  Example: Directory Services `0x2222/22/12` in the PDF means SubFunctionCode decimal 12, i.e. wire `case 0x0c`; it is not the existing `case 0x12` / decimal 18 Allocate Permanent Directory Handle.  Place disabled stubs directly at the correct numeric slot inside the dispatcher, never appended at the end of the function.
 - Keep `TODO.md` endpoint audit notes grouped by endpoint family and NetWare generation instead of as one long flat list.
 - The rejected `0152-docs-note-message-control-subfunction.patch` must not be applied: it documented `0x2222/21/0x0c Connection Message Control`, which is outside the default NetWare 1.x/2.x/3.x MARS-NWE target scope.
 
diff --git a/TODO.md b/TODO.md
index 7b67487..a3cd2dd 100644
--- a/TODO.md
+++ b/TODO.md
@@ -245,6 +245,11 @@ Current status:
 - No NetWare 1.x/2.x/3.x SDK/PDF entries were found for direct `22/07`,
   `22/08`, or `22/09` during this audit.  The next documented direct directory
   calls continue at `22/0a`.
+- The next WebSDK/PDF recheck found `22/12` in the old documentation, but
+  that number is decimal notation: the wire subfunction is `0x0c`, not the
+  already implemented `case 0x12` below.  `22/12` / `0x0c` Scan Directory for
+  Trustees is documented for NetWare 2.x/3.x and has only a disabled inline
+  stub for now.
 - `22/0a` Create Directory, `22/0b` Delete Directory, `22/0d` Add Trustee to
   Directory, `22/0e` Delete Trustee from Directory, and `22/0f` Rename
   Directory now have inline request-layout documentation.
@@ -294,6 +299,11 @@ Current status:
   Directory for Extended Trustees, `22/27` Add Extended Trustee to Directory or
   File, `22/28` Scan Directory Disk Space, and `22/29` Get Object Disk Usage
   and Restrictions now have inline request/reply layout documentation.
+- WebSDK/PDF also documents `22/35` / wire `0x23` Get Directory Disk Space
+  Restriction and `22/36` / wire `0x24` Set Directory Disk Space Restriction
+  as NetWare 3.x-compatible directory quota calls.  They are not active cases
+  in this dispatcher yet; disabled inline stubs now sit at their numeric slots
+  between `22/22` and `22/25`.
 - `22/21` and `22/22` are forwarded to `nwbind.c` for quota prehandling; both
   layers are documented.  The shared `nwbind` prehandler reads ObjectID from
   the documented payload position.
@@ -327,6 +337,12 @@ Current status:
 
 Follow-up:
 
+- Implement or intentionally reject `22/12` / wire `0x0c` Scan Directory for
+  Trustees.  Do not confuse the SDK decimal subfunction number 12 with the
+  already implemented wire `case 0x12` / decimal 18 directory-handle call.
+- Implement or intentionally reject `22/35` / wire `0x23` Get Directory Disk
+  Space Restriction and `22/36` / wire `0x24` Set Directory Disk Space
+  Restriction.  Both are NetWare 3.x-compatible, not `MARS_NWE_4` work.
 - Verify the documented `22/00` source-handle interpretation against an old
   requester or direct test caller before changing behavior.
 - Decide whether `22/0a` and `22/0b` should apply or validate the documented
@@ -364,9 +380,10 @@ Follow-up:
 - Verify `22/30` DOSSequence byte order against an old requester or direct test
   caller; current code uses `GET_32()` and the PDF table does not spell out the
   order for that field.
-- The NetWare 1.x/2.x/3.x-compatible `0x2222/22` endpoint layout pass is now
-  complete through the documented `22/48` namespace call.  Continue with the
-  next non-4.x/OES-only group after this block.
+- The NetWare 1.x/2.x/3.x-compatible `0x2222/22` endpoint layout pass is
+  covered through the documented `22/48` namespace call, with the newly found
+  `22/12`, `22/35`, and `22/36` gaps tracked as disabled stubs/TODO items.
+  Continue with the next non-4.x/OES-only group after this block.
 
 
 ### Extended volume information field mapping
diff --git a/src/nwconn.c b/src/nwconn.c
index 56084bd..ad9b9df 100644
--- a/src/nwconn.c
+++ b/src/nwconn.c
@@ -3572,6 +3572,47 @@ static int handle_ncp_serv(void)
                  } 
                  break;
                  
+#if 0
+            case 0x0c : { /* Scan Directory for Trustees */
+                   /*
+                    * NCP 0x2222/22/12 Scan Directory for Trustees.
+                    *
+                    * Important notation note: the SDK/PDF writes this as
+                    * "22 12" using decimal subfunction notation.  The wire
+                    * SubFunctionCode byte is therefore 12 decimal, i.e. 0x0c.
+                    * Do not confuse it with active case 0x12 below, which is
+                    * decimal 18 / Alloc Permanent Directory Handle.
+                    *
+                    * SDK/WebSDK/include context:
+                    *   NetWare servers: 2.x, 3.x, 4.x, 5.x
+                    *   APIs: NWScanDirectoryForTrustees,
+                    *         NWScanDirectoryForTrustees2,
+                    *         NWIntScanForTrustees
+                    *
+                    * SDK request payload after the NCP 22 group header:
+                    *   byte DirectoryHandle
+                    *   byte TrusteeSetNumber
+                    *   byte DirectoryPathLen
+                    *   byte DirectoryPath[DirectoryPathLen]
+                    *
+                    * SDK reply payload:
+                    *   byte DirectoryPath[16]
+                    *   word CreationDate                 (Hi-Lo)
+                    *   word CreationTime                 (Hi-Lo)
+                    *   long DirectoryOwnerID             (Hi-Lo)
+                    *   long TrusteeIDSet[5]              (Hi-Lo)
+                    *   byte TrusteeAccessMask[5]
+                    *
+                    * Status: NetWare 2.x/3.x compatibility endpoint, not
+                    * NetWare-4-only.  Leave disabled until implemented; it
+                    * belongs in the default compatibility TODO bucket, not
+                    * behind MARS_NWE_4.
+                    */
+                  completition = 0xfb;
+                 }
+                 break;
+#endif
+
             case 0xd : {  /* Add Trustees to DIR  */
              /******** AddTrustesstoDir ***************/
                    /*
@@ -4295,6 +4336,57 @@ static int handle_ncp_serv(void)
                  }
                  return(-2); /* nwbind must do prehandling */
                  
+#if 0
+            case 0x23 : { /* Get Directory Disk Space Restriction */
+                   /*
+                    * NCP 0x2222/22/35 Get Directory Disk Space Restriction.
+                    *
+                    * SDK/WebSDK/include context:
+                    *   NetWare servers: 3.x, 4.x, 5.x
+                    *   APIs: NWGetDirSpaceLimitList, NWGetDirSpaceInfo
+                    *
+                    * SDK request payload after the NCP 22 group header:
+                    *   byte DirHandle
+                    *
+                    * SDK reply payload:
+                    *   byte NumberOfEntries
+                    *   repeated entries:
+                    *     byte Level
+                    *     long Max                       (Lo-Hi)
+                    *     long Current                   (Lo-Hi)
+                    *
+                    * Status: documented NetWare 3.x/default compatibility
+                    * endpoint.  No active case exists here yet, so keep this
+                    * disabled stub next to its numeric slot until implemented.
+                    */
+                  completition = 0xfb;
+                 }
+                 break;
+
+            case 0x24 : { /* Set Directory Disk Space Restriction */
+                   /*
+                    * NCP 0x2222/22/36 Set Directory Disk Space Restriction.
+                    *
+                    * SDK/WebSDK/include context:
+                    *   NetWare servers: 3.x, 4.x, 5.x
+                    *   APIs: NWSetDirSpaceLimit
+                    *
+                    * SDK request payload after the NCP 22 group header:
+                    *   byte DirHandle
+                    *   long DiskSpaceLimit              (Lo-Hi, 4K blocks)
+                    *
+                    * SDK completion: 0x00 success, 0x01 invalid space limit,
+                    * 0x8c no set privileges, 0xbf invalid name space.
+                    *
+                    * Status: documented NetWare 3.x/default compatibility
+                    * endpoint.  No active case exists here yet, so keep this
+                    * disabled stub next to its numeric slot until implemented.
+                    */
+                  completition = 0xfb;
+                 }
+                 break;
+#endif
+
             case 0x25 : { /* Set Directory Entry Information */
                    /*
                     * NCP 0x2222/22/37 Set Directory Entry Information.