docs: audit NDS fragger stubs

AI.md

@@ -11,18 +11,18 @@ When the user says this is a new chat or asks to continue mars-nwe work, first
 read this file before proposing patches or making assumptions.  Then ask for, or
 use, the current project status that the user pasted into the chat.
 
-## Current handoff status after patch 0216
+## Current handoff status after patch 0217
 
 The current accepted patch line in this chat is expected to include:
 
 - endpoint-audit/documentation patches through `0176-docs-audit-direct-lifecycle-buffer-endpoints.patch`;
 - redesign documentation patches `0177` through `0198`;
-- endpoint-audit/documentation patches `0199` through `0216`;
-- latest expected patch name: `0216-docs-audit-packet-burst-endpoints.patch`.
+- endpoint-audit/documentation patches `0199` through `0217`;
+- latest expected patch name: `0217-docs-audit-nds-fragger-stubs.patch`.
 
 When continuing in a new chat, first ask the user which patch was actually last
-applied.  If they confirm `0216`, build the next patch as `0217-...` against a
-tree that already contains `0216`.  If any patch failed or was skipped, rebuild
+applied.  If they confirm `0217`, build the next patch as `0218-...` against a
+tree that already contains `0217`.  If any patch failed or was skipped, rebuild
 against the last confirmed applied patch instead of assuming the file in
 `/mnt/data` was accepted.
 
@@ -198,20 +198,24 @@ Schema/import direction:
 
 Latest endpoint audit note:
 
-- Patch `0216` audits Packet Burst / Big Packet support in `src/nwconn.c`: SDK
-  `97` / wire `0x61` Get Big Packet NCP Max Packet Size, SDK `101` / wire
-  `0x65` Packet Burst Connection Request, and the follow-on `0x7777`
-  packet-burst data-plane handler.  `97` and `101` are 4.x-era direct NCPs and
-  are present in source, so no missing stubs were needed.  The audit documents
-  request/reply layouts, burst-mode disabled behavior (`0xfb`), and the current
-  lack of NDK security-flag negotiation for checksums/signatures/encryption.
-  The `0x7777` handler is not a normal `0x2222` endpoint; it is the runtime
-  data path created by `101`.
+- Patch `0217` audits the planned NetWare-4.x NDS/NCP Fragger family
+  `0x2222/104` / wire `0x68` in `src/nwconn.c`.  The top-level source case was
+  already present and still returns `0xfb` at runtime.  Patch `0217` adds
+  disabled `MARS_NWE_4` source-stub selector documentation for `104/01` Ping for
+  NDS NCP, `104/02` Send NDS Fragmented Request/Reply, `104/03` Fragment Close,
+  `104/04` Return Bindery Context, `104/05` Monitor NDS Connection, `104/06`
+  Return NDS Statistics, `104/07` Clear Statistics, and `104/08` Reload NDS
+  Software.
+- Remember that `104/02` is a nested-selector path: the NDS `Verb` is a 32-bit
+  payload field after the NDS subfunction, so future docs should write paths
+  like `0x2222/104/02 verb=<n>` instead of inventing one-byte `zz` cases.
+  Future implementation belongs to `nwnds`/`libdirectory`; `nwserv` remains
+  control plane only.
 
-The next patch number should be `0217` if `0216` was applied.  Likely next
-blocks are the planned-4.x NDS/NCP fragger `0x2222/104` path, deeper
-`0x2222/23` bindery/property/admin subfunction coverage, SDK `0x2222/90`
-generation-scope work, or another user-selected endpoint family.
+The next patch number should be `0218` if `0217` was applied.  Likely next
+blocks are deeper `0x2222/23` bindery/property/admin subfunction coverage,
+SDK `0x2222/36`/`37` NCP Extension scope, SDK `0x2222/17` Print/Spool, or
+another user-selected endpoint family.
 
 ## Patch workflow