Complete Quaternius intake record: verify SHA-256 and add the download date

TODO.md

@@ -40,9 +40,12 @@ baseline sheet.
 
 ### 1. Intake and canonical base
 
-- [ ] Keep the three researched CC0 GLBs (`Casual`, `Casual_Hoodie`, `Worker`) plus the
+- [x] Keep the three researched CC0 GLBs (`Casual`, `Casual_Hoodie`, `Worker`) plus the
       licence/mirror notes in `tmp/npc-research/quaternius/`; record the source URL,
       licence, SHA-256 and download date in `docs/npc-model-sourcing.md`.
+      Verified: the three GLBs are in `tmp/npc-research/quaternius/`, SHA-256 re-hash matches the
+      recorded table, the mirror HTML/README are retained next to the folder, and the download
+      date (2026-11-03) is now recorded.
 - [ ] Inventory the four meshes, 62 joints, 24 clips and material names in each GLB; map
       Quaternius materials to the five project slots (`skin`, `cloth`, `pants`, `accessory`,
       `hair`).

docs/npc-model-sourcing.md

@@ -56,7 +56,8 @@ locally in `tmp/npc-research/quaternius/` with the licence and mirror notes.
 
 Source: [Quaternius Ultimate Modular Characters](https://quaternius.com/packs/ultimatemodularcharacters.html)
 and [Ultimate Modular Women](https://quaternius.com/packs/ultimatemodularwomen.html),
-CC0 1.0. The Ducz mirror is a browser builder over the same packs; it adds 21
+CC0 1.0. Download date: 2026-11-03 (via the Ducz Character Creator browser export).
+The Ducz mirror is a browser builder over the same packs; it adds 21
 outfits and a shared skeleton. The three full GLBs are the initial scope; the
 21-part builder is a fallback for role coverage, not the default.