diff --git a/.github/workflows/cli-agent-bridge-windows.yml b/.github/workflows/cli-agent-bridge-windows.yml
index f6862063..3007fa24 100644
--- a/.github/workflows/cli-agent-bridge-windows.yml
+++ b/.github/workflows/cli-agent-bridge-windows.yml
@@ -5,11 +5,15 @@ on:
     paths:
       - 'plugins/Hylouis233/cli-agent-bridge/**'
       - '.github/workflows/cli-agent-bridge-windows.yml'
+      - 'package.json'
+      - 'package-lock.json'
   push:
     branches: [main, plugin/cli-agent-bridge]
     paths:
       - 'plugins/Hylouis233/cli-agent-bridge/**'
       - '.github/workflows/cli-agent-bridge-windows.yml'
+      - 'package.json'
+      - 'package-lock.json'
 
 permissions:
   contents: read
@@ -34,9 +38,9 @@ jobs:
           set -euo pipefail
           node --test --test-concurrency=1 \
             plugins/Hylouis233/cli-agent-bridge/tests/process-tree.test.mjs \
-            plugins/Hylouis233/cli-agent-bridge/tests/server.test.mjs \
+            plugins/Hylouis233/cli-agent-bridge/integration/server.mjs \
             plugins/Hylouis233/cli-agent-bridge/tests/workspace-lock.test.mjs \
-            plugins/Hylouis233/cli-agent-bridge/test/server.test.mjs \
+            plugins/Hylouis233/cli-agent-bridge/integration/stdio.mjs \
             2>&1 | tee bridge-windows.tap
       - name: Preserve complete test output, including failures
         if: always()
diff --git a/plugins/Hylouis233/cli-agent-bridge/README.md b/plugins/Hylouis233/cli-agent-bridge/README.md
index 058834ff..890d7c2c 100644
--- a/plugins/Hylouis233/cli-agent-bridge/README.md
+++ b/plugins/Hylouis233/cli-agent-bridge/README.md
@@ -215,15 +215,27 @@ you already obtained a valid ID from that backend outside this Plugin.
 
 ## Verification
 
-Run the dependency-free fake-backend suites from the repository root:
+The default repository `npm run check` runs the deterministic process-tracker fixtures and
+workspace-lock tests. Full server integration tests live outside Node's automatic test discovery
+and run in `.github/workflows/cli-agent-bridge-windows.yml` on Windows, the supported production
+containment platform. Plugin, workflow, and root package changes trigger that job.
+
+Run all dependency-free fake-backend suites explicitly from the repository root:
 
 ```text
-node --test plugins/Hylouis233/cli-agent-bridge/test/server.test.mjs
-node --test plugins/Hylouis233/cli-agent-bridge/tests/server.test.mjs
+node --test plugins/Hylouis233/cli-agent-bridge/integration/stdio.mjs
+node --test plugins/Hylouis233/cli-agent-bridge/integration/server.mjs
+node --test plugins/Hylouis233/cli-agent-bridge/tests/process-tree.test.mjs
 node --test plugins/Hylouis233/cli-agent-bridge/tests/workspace-lock.test.mjs
 ```
 
-They cover the full MCP flow plus in-process and cross-process canonical worktree locking, stale
+Explicit POSIX integration runs remain experimental: they opt into the unsupported polling
+tracker and may correctly quarantine when short-lived parent/child identities cannot be captured
+under load. They are diagnostic runs, not a required repository CI gate. No integration assertions
+are removed or relaxed; Windows still executes the complete suite, subject to its existing
+platform-specific skips.
+
+The suites cover the full MCP flow plus in-process and cross-process canonical worktree locking, stale
 owner compare-and-swap, live-owner non-steal, quarantined-lease recovery after an explicit
 operator approval rename, interruptible lease state updates, shared quarantine markers, queued and
 discovery-phase cancellation (including list_backends probes), overall deadlines, cancel/timeout
diff --git a/plugins/Hylouis233/cli-agent-bridge/tests/server.test.mjs b/plugins/Hylouis233/cli-agent-bridge/integration/server.mjs
similarity index 99%
rename from plugins/Hylouis233/cli-agent-bridge/tests/server.test.mjs
rename to plugins/Hylouis233/cli-agent-bridge/integration/server.mjs
index d3393466..1394e405 100644
--- a/plugins/Hylouis233/cli-agent-bridge/tests/server.test.mjs
+++ b/plugins/Hylouis233/cli-agent-bridge/integration/server.mjs
@@ -9,7 +9,7 @@ import { createServer } from "node:net";
 import { createInterface } from "node:readline";
 import test, { after, before } from "node:test";
 import { promisify } from "node:util";
-import { acquireCliAgentBridgeTestLock } from "./plugin-test-lock.mjs";
+import { acquireCliAgentBridgeTestLock } from "../tests/plugin-test-lock.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
@@ -30,7 +30,7 @@ import {
 } from "../server.mjs";
 
 const execFileAsync = promisify(execFile);
-const testsRoot = path.dirname(fileURLToPath(import.meta.url));
+const testsRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../tests");
 const pluginRoot = path.resolve(testsRoot, "..");
 const serverPath = path.join(pluginRoot, "server.mjs");
 const fakeBackendPath = path.join(testsRoot, "fake-backend.mjs");
diff --git a/plugins/Hylouis233/cli-agent-bridge/test/server.test.mjs b/plugins/Hylouis233/cli-agent-bridge/integration/stdio.mjs
similarity index 99%
rename from plugins/Hylouis233/cli-agent-bridge/test/server.test.mjs
rename to plugins/Hylouis233/cli-agent-bridge/integration/stdio.mjs
index 124ec614..c9bbb4d5 100644
--- a/plugins/Hylouis233/cli-agent-bridge/test/server.test.mjs
+++ b/plugins/Hylouis233/cli-agent-bridge/integration/stdio.mjs
@@ -1,5 +1,5 @@
 // Self-contained tests for the cli-agent-bridge stdio MCP server.
-// Run with: node --test test/server.test.mjs
+// Run with: node --test integration/stdio.mjs
 // No network access is required: the delegation test uses a fake slow backend.
 //
 // Every test drives its server through withServer(), which always stops the