diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23eb8cd..46e0890 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,22 @@ and this project uses [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Fixed
+- The vendored review bridge is back in step with the repository it is vendored
+  from, so the check that holds ADR-0009 passes again. The review lane's
+  session-cost harvest was written straight into the vendored copy of
+  `tui_review_bridge.py` and never reached upstream, so `sync-bridge.sh`
+  overwrote those 210 lines on every run and the diff behind it never came back
+  empty — red on every push since 0.7.0. The check was right and the change was
+  in the wrong repository: it now lives upstream (review-switch#4), tested there
+  at the seam that repository tests, since the machine-log writer belongs to
+  whichever consumer configures `--machine-log` and what the lane owns is the
+  argv it hands over. The pin moves to that merge commit and the vendored copy
+  is what the script fetches from it, byte-identical to what was already here.
+  Worth knowing for the next release: this check runs only on the 3.11 job and
+  fails in four seconds, so it went red for four releases while the three other
+  jobs went green beside it.
+
 ## [0.8.2] - 2026-08-19
 
 ### Added
diff --git a/scripts/sync-bridge.sh b/scripts/sync-bridge.sh
index 4dbd7c5..50918b2 100755
--- a/scripts/sync-bridge.sh
+++ b/scripts/sync-bridge.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 UPSTREAM_REPOSITORY="https://github.com/okqixiaobao727-design/review-switch"
 UPSTREAM_RAW_BASE="https://raw.githubusercontent.com/okqixiaobao727-design/review-switch"
-UPSTREAM_COMMIT="03f89b2400580c8998b2404bed12187effb94abe"
+UPSTREAM_COMMIT="a5fdabada7eb628a476683b7e885f1478209159a"
 UPSTREAM_PATH="skills/review-switch-codex/scripts/tui_review_bridge.py"
 VENDORED_PATH="skills/crew/assets/review/scripts/tui_review_bridge.py"
 
diff --git a/skills/crew/assets/review/scripts/tui_review_bridge.py b/skills/crew/assets/review/scripts/tui_review_bridge.py
index af17643..82892c1 100644
--- a/skills/crew/assets/review/scripts/tui_review_bridge.py
+++ b/skills/crew/assets/review/scripts/tui_review_bridge.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # Vendored from https://github.com/okqixiaobao727-design/review-switch
-# Pinned upstream commit: 03f89b2400580c8998b2404bed12187effb94abe
+# Pinned upstream commit: a5fdabada7eb628a476683b7e885f1478209159a
 # Changes belong upstream; update scripts/sync-bridge.sh when upgrading.
 
 """Interactive Codex TUI code-review channel for a Claude session.
diff --git a/tests/test_sync_bridge.py b/tests/test_sync_bridge.py
index 1355bf3..c2a9e60 100644
--- a/tests/test_sync_bridge.py
+++ b/tests/test_sync_bridge.py
@@ -14,10 +14,28 @@
 VENDORED_BRIDGE = pathlib.Path(
     "skills/crew/assets/review/scripts/tui_review_bridge.py"
 )
-UPSTREAM_REPOSITORY = "https://github.com/okqixiaobao727-design/review-switch"
-UPSTREAM_RAW_BASE = "https://raw.githubusercontent.com/okqixiaobao727-design/review-switch"
-UPSTREAM_COMMIT = "03f89b2400580c8998b2404bed12187effb94abe"
-UPSTREAM_PATH = "skills/review-switch-codex/scripts/tui_review_bridge.py"
+
+
+def pinned(name):
+    """One `NAME="value"` assignment, read from the script that owns it.
+
+    The pin is the script's to declare, and a copy of it here would be a second
+    place to edit on every upgrade — one that goes stale silently, since a test
+    asserting a sha nobody fetches proves nothing. What these tests are for is
+    that the sha the script fetches and the sha it writes into the header are the
+    same one, whatever it is.
+    """
+    for line in SYNC_SCRIPT.read_text(encoding="utf-8").splitlines():
+        key, separator, value = line.partition("=")
+        if separator and key == name:
+            return value.strip().strip('"')
+    raise AssertionError(f"{SYNC_SCRIPT} declares no {name}")
+
+
+UPSTREAM_REPOSITORY = pinned("UPSTREAM_REPOSITORY")
+UPSTREAM_RAW_BASE = pinned("UPSTREAM_RAW_BASE")
+UPSTREAM_COMMIT = pinned("UPSTREAM_COMMIT")
+UPSTREAM_PATH = pinned("UPSTREAM_PATH")
 EXPECTED_SOURCE_URL = f"{UPSTREAM_RAW_BASE}/{UPSTREAM_COMMIT}/{UPSTREAM_PATH}"
 EXPECTED_HEADER = (
     f"# Vendored from {UPSTREAM_REPOSITORY}\n"