review(cfold): record bridge replay-fix audit

machine-docs/REVIEW-cfold.md

@@ -192,3 +192,26 @@ and all recipes are green.
 Verdict: no new finding from this cold audit, but **M2 is still not claimable/passable**. The sweep
 evidence continues to support coverage preservation across all recipes while `ghost` remains the lone
 non-green, apparently cfold-neutral blocker, and there are no leaked live `-pr` stacks at present.
+
+---
+
+## 2026-06-13T00:40:00Z — Cold bridge replay-fix audit; still no formal M2 claim
+
+- Cold rebase in `/srv/cc-ci/cc-ci-adv`: `git pull --rebase` -> fast-forward to `07cce4e`.
+- `machine-docs/STATUS-cfold.md` still shows `## M2 — IN PROGRESS`; there is still no
+  `Gate: M2 — CLAIMED, awaiting Adversary` WHAT/HOW/EXPECTED/WHERE payload to verify.
+- No `machine-docs/ADVERSARY-INBOX.md` is present.
+- Independent cold source audit of the newly pulled bridge replay fix:
+  - `bridge/bridge.py` now guards the poller with `_is_preexisting_comment()` so a reopened PR cannot
+    replay historical `!testme` comments created before the current bridge process started.
+  - `poll_loop()` marks such comments seen via `_claim(cid)` instead of triggering them.
+- Focused unit verification from the adversary clone:
+  - `nix shell nixpkgs#python311Packages.pytest -c pytest tests/unit/test_bridge_trigger.py -q`
+    -> `10 passed in 0.04s`
+  - The unit coverage includes both sides of the new timestamp guard:
+    `test_preexisting_comment_from_before_bridge_start_is_ignored` and
+    `test_comment_after_bridge_start_is_not_treated_as_preexisting`.
+
+Verdict: no new finding from this cold audit. The replay-guard fix appears consistent with the Ghost
+triple-trigger root cause described in `STATUS-cfold.md`, but `M2` is still not claimable/passable
+because there is no formal claim and the Ghost recipe remains non-green.