docs: audit direct lifecycle and buffer endpoints

TODO.md

@@ -179,9 +179,9 @@ Present in the code but not yet fully endpoint-audited:
 - SDK `0x2222/26` through `0x2222/31` / wire `0x1a` through `0x1f` physical
   record synchronization calls are implemented in `src/nwconn.c` but have not
   yet received the detailed request-layout audit.
-- SDK `0x2222/33` / wire `0x21` Negotiate Buffer Size and SDK `0x2222/34` /
-  wire `0x22` TTS calls are present in `src/nwconn.c`; their layouts still need
-  source comparisons.
+- SDK `0x2222/34` / wire `0x22` TTS calls are present in `src/nwconn.c`;
+  their remaining state-changing layouts still need source comparisons beyond
+  the current availability/no-op note.
 - SDK `0x2222/35` / wire `0x23` AFP calls are present in `src/nwconn.c`; AFP has
   separate compatibility tests, but the NCP request-layout audit should still
   be completed endpoint by endpoint.
@@ -522,6 +522,54 @@ Known differences / follow-up:
   not routed through this compatibility handler.
 
 
+#### Direct connection lifecycle and buffer-size calls
+
+Current status:
+
+- Direct `NCP 0x2222/24` / wire function `0x18` End Of Job is implemented as a
+  paired `nwconn.c`/`nwbind.c` handoff.  The PDF/WebSDK request has no payload
+  after FunctionCode 24 and the reply has no payload.  `nwconn.c` releases
+  task-local handles and jobs first; `nwbind.c` closes matching print jobs and
+  sends the final empty success reply.
+- Direct `NCP 0x2222/25` / wire function `0x19` Logout is implemented as a
+  paired `nwconn.c`/`nwbind.c` handoff.  The PDF/WebSDK request has no payload
+  after FunctionCode 25 and the reply has no payload.  `nwconn.c` releases local
+  queue/file/user state; `nwbind.c` closes remaining print jobs, writes logout
+  accounting state, clears bindery identity fields, and sends the final empty
+  success reply.
+- Direct `NCP 0x2222/33` / wire function `0x21` Negotiate Buffer Size is handled
+  entirely in `src/nwconn.c`.  The request is `ProposedBufferSize` as a Hi-Lo
+  word and the reply is `AcceptedBufferSize` as a Hi-Lo word.  The current
+  parser/reply match the documented order.  MARS-NWE clamps valid proposals to
+  `LOC_RW_BUFFERSIZE`; proposals below 512 leave the existing/default negotiated
+  size in force and return that value.
+
+Missing-endpoint check:
+
+- These three are direct functions, not nested subfunction groups.  No additional
+  subfunctions are listed under SDK `24`, SDK `25`, or SDK `33` in the local
+  NDK/Core-Protocols PDF/WebSDK material.
+
+
+#### Retrospective endpoint coverage rule for audited blocks
+
+Current status:
+
+- From this point on, each endpoint-family patch should first list the
+  SDK/PDF/WebSDK endpoints in that family, then compare that list against the
+  real dispatcher cases and any forwarded target handlers before documenting
+  individual request/reply layouts.
+- Apply the same rule retroactively when touching an already-audited family:
+  message `0x2222/21`, directory/quota `0x2222/22`, file-server environment
+  `0x2222/23`, direct lifecycle `0x2222/24` and `0x2222/25`, semaphore
+  `0x2222/32`, and buffer negotiation `0x2222/33` should each state whether
+  missing endpoints were checked, and whether the family has active code,
+  disabled future stubs, or no top-level handler.
+- A disabled `#if 0` stub is only a documentation/slot marker.  Do not assign
+  `return(-1)` forwarding semantics to such stubs in `nwbind.c`; that special
+  forwarding meaning belongs to `nwconn.c`'s `handle_ncp_serv()` path.
+
+
 #### File Server Environment group 0x2222/23
 
 Current status: