Archive Milestone 4 in docs

Move completed M4 (persist) from PLAN.md to COMPLETED.md with a decisions
note (GUID identity, Save-As copy, MarkProjectDirty, known limitation);
update CLAUDE.md repo-identity to M0-M4 complete.

COMPLETED.md

@@ -95,3 +95,23 @@ added silence without an explicit tail).
   (open question) and confirm it runs headless.
 - [x] Populate a `Sample` from the finished file; hand to `bank_model`; console-log.
 - [x] Verify bit-identical repeats and exact-bounds by hand on a known range.
+
+---
+
+## Milestone 4 — persist (index ↔ project ext state)
+**Goal:** Write the `BankIndex` JSON to project ext state, reload on project open;
+project-relative path resolution. CONTEXT.md §persist, §Persistence & paths.
+**Verify (in DAW):** Index survives Save / Save As / close+reopen; **bank travels
+with the .rpp**; **relative paths only** in the persisted index (Save As to a new
+folder still resolves the bank).
+
+- [x] `SetProjExtState` / `GetProjExtState` under namespace `"reasampler"`.
+- [x] Bank-folder resolution from the current project path
+  (`EnumProjects` / `GetProjectPathEx`); store under a project-relative subfolder.
+- [x] Reload-on-open; confirm survival across Save / Save As.
+
+**Notes/decisions:**
+- Storage: `SetProjExtState` / `GetProjExtState`, namespace `"reasampler"`, keys `bank_index` (serialized JSON) and `project_guid`; relative paths only in the persisted index.
+- Project identity: keyed off a **minted GUID** stored in ext state (REAPER exposes no native per-project GUID), not the raw `ReaProject*` — a recycled pointer cannot misread a project switch as a Save-As.
+- Save-As: **copy** semantics (Daniel's decision) — the `reasampler_bank/` folder is copied under the new `.rpp`; the old project's bank stays intact. Every ext-state write calls `MarkProjectDirty` so captures/GUID changes flush on the normal save.
+- Known limitation (narrow, accepted): if a user does Save-As, closes the copy *without saving*, then reopens that copy to a *different* folder while the original is also open, identities can collide. Force-saving after Save-As would close the hole but was rejected as violating non-destructive.