Document the frozen npc_base fallback boundary

TODO.md

@@ -45,8 +45,10 @@ the rest of §C remains the broad review checklist.
       open and gripping at 0.8 m; silhouette, eye/mouth readability, ear/nose/jaw planes, finger
       separation and gear contact. Keep the 16,000/16,000 cap; optional extra bones are allowed, but the required 13 core bones and rest positions must not move.
       Recorded in `docs/3d-model-review.md` §Overhaul acceptance criteria.
-- [ ] Confirm the identity boundary: `npc_base.blend` is the frozen fallback and must not absorb
+- [x] Confirm the identity boundary: `npc_base.blend` is the frozen fallback and must not absorb
       prototype detail unless a separate contract decision approves it.
+      Recorded in `docs/3d-model-review.md` §Baseline inventory and
+      `docs/blender-assets.md` §Frozen fallback boundary.
 - [ ] Choose a local working-set layout: `tmp/npc-parts/<variant>/` (gitignored) for part `.blend`
       and preview GLBs; only the assembled character GLBs, AO/maps, manifest and review sheets are
       committed. Do not add a new committed `.blend` source tree without a docs/ADR decision.

docs/blender-assets.md

@@ -35,6 +35,16 @@ captures in `docs/screenshots/`.
   doors, stair handrails and a dark sedan. Today's in-game props are primitive
   boxes, and the trees are cones.
 
+## Frozen fallback boundary
+
+`assets/models/npc/npc_base.blend` is the tracked, frozen plain-primitive
+fallback. Prototype head/face/hand detail from the local part pipeline must not
+be saved into it; a separate contract decision (ADR or owner sign-off) is
+required before any prototype detail is absorbed. Working scenes live under
+`tmp/npc-parts/` (gitignored) and are exported as local GLBs for review, never
+directly over the tracked `.blend`. The same rule already appears in
+[`asset-tooling.md#recommended-part-workflow`](asset-tooling.md#recommended-part-workflow).
+
 ## Optional MCP
 
 Blender MCP can be used for interactive head/face/hand part exploration, but it