diff --git a/COMPLETED.md b/COMPLETED.md
index 6690cea..3a7b7dd 100644
--- a/COMPLETED.md
+++ b/COMPLETED.md
@@ -30,3 +30,26 @@ build` is green with the new `bank_model` + `peaks` suites present.
 - [x] Refresh `README.md` layout/next-step sections to the sampler module set.
   (Landed-work reflection is doc-keeper's; this point exists so the stale MPE
   README does not mislead the first implementer.)
+
+---
+
+## Milestone 1 — bank_model + JSON round-trip (pure)
+**Goal:** The `Sample` metadata struct and `BankIndex` (add / remove / query /
+tier moves / dedup-by-hash) with JSON serialize/deserialize to `std::string`.
+CONTEXT.md §Data model, §Module architecture.
+**Verify:** CTest green. Round-trip is lossless (deserialize(serialize(x)) == x)
+across all fields; dedup-by-hash and tier filtering asserted; **relative paths
+only** invariant enforced at the model boundary (no absolute path accepted/stored).
+
+- [x] Define `Sample` with the full field set (id, display name, relative path,
+  source mode, source range in project time + PPQ, track GUID(s), wet/dry,
+  channels, SR, length sec + beats, capture tempo, optional key, peak/RMS/LUFS,
+  clip flag, tier, content hash, provenance, created ts). CONTEXT.md §Data model.
+- [x] `BankIndex`: ordered collection keyed by id; add / remove / query.
+- [x] Hash lookup for dedup-by-content-hash.
+- [x] Tier model (scratch | archive) + tier-move + tier filtering; scratch marked
+  auto-prunable.
+- [x] JSON serialize/deserialize to/from `std::string`.
+- [x] Tests: full-field round-trip lossless; dedup collapses equal-hash adds;
+  tier filter/move correct; relative-path invariant rejects absolute paths;
+  empty-index and malformed-JSON edge cases.
diff --git a/PLAN.md b/PLAN.md
index f74fa0d..f07de3e 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -14,27 +14,6 @@ it here and appends it to `COMPLETED.md`.
 
 ---
 
-## Milestone 1 — bank_model + JSON round-trip (pure)
-**Goal:** The `Sample` metadata struct and `BankIndex` (add / remove / query /
-tier moves / dedup-by-hash) with JSON serialize/deserialize to `std::string`.
-CONTEXT.md §Data model, §Module architecture.
-**Verify:** CTest green. Round-trip is lossless (deserialize(serialize(x)) == x)
-across all fields; dedup-by-hash and tier filtering asserted; **relative paths
-only** invariant enforced at the model boundary (no absolute path accepted/stored).
-
-- [ ] Define `Sample` with the full field set (id, display name, relative path,
-  source mode, source range in project time + PPQ, track GUID(s), wet/dry,
-  channels, SR, length sec + beats, capture tempo, optional key, peak/RMS/LUFS,
-  clip flag, tier, content hash, provenance, created ts). CONTEXT.md §Data model.
-- [ ] `BankIndex`: ordered collection keyed by id; add / remove / query.
-- [ ] Hash lookup for dedup-by-content-hash.
-- [ ] Tier model (scratch | archive) + tier-move + tier filtering; scratch marked
-  auto-prunable.
-- [ ] JSON serialize/deserialize to/from `std::string`.
-- [ ] Tests: full-field round-trip lossless; dedup collapses equal-hash adds;
-  tier filter/move correct; relative-path invariant rejects absolute paths;
-  empty-index and malformed-JSON edge cases.
-
 ## Milestone 2 — peaks (pure)
 **Goal:** Compute waveform min/max bins from raw PCM, dependency-free (not
 REAPER's peak API). CONTEXT.md §Module architecture, §Non-goals.
@@ -178,3 +157,7 @@ landed milestone.
   fidelity. (touches M3, informs M1 `Sample` fields)
 - **Thumbnail cache:** recompute peaks vs store peak bins alongside the index.
   (touches M2/M4/M5)
+- **`parseInt` narrowing hardening:** `src/bank_model.cpp` `parseInt` casts
+  `int64_t → int` via `static_cast` without a range check; integers that fit
+  in int64 but exceed `INT_MAX` are implementation-defined. Hardening candidate
+  — add bounds check before the cast when integer-field validation is in scope.