A CDP test must prove what it attached to

Chromium does not report a debugging port it could not bind — it just does not listen, and every request then goes to whatever is on that port. Measured here: a test assuming a fixed port attached to the user's own browser, full of logged-in tabs, and only a URL filter stopped it evaluating JavaScript in them. Ports are now found, never assumed, and nothing is attached to until it answers as Electron.

A hardcoded debugging port is a live hazard, not a style problem. Chromium does not report a --remote-debugging-port it could not bind — it just does not listen, and every request then goes to whatever is on that port. Measured here: a test that assumed a port attached to the user's own Chrome, full of logged-in tabs, and only a URL filter stopped it evaluating JavaScript in them.

Every CDP test in the repo goes through one driver. The port is found, never assumed — the hidden launcher picks a free one, records it, and removes the record on exit; a test reads that, sweeps a range if there is nothing registered, and refuses ambiguity rather than guessing between two instances. There is deliberately no fallback constant. Nothing is attached to until /json/version answers with JSON that names Electron — a browser answers there too, with Chrome/…, and is refused.

• So is a port answering HTML, and one that accepts the connection and then says nothing — which is what two ports on this machine do, because a service forwards them from WSL. Hence a 1.5s probe timeout; without it the whole suite waits on the OS.
• The negative tests run against HTTP servers the suite owns. Never point a negative test at a real browser.
• A failing CDP test has to exit. An open CDP socket holds the event loop, so a catch that sets process.exitCode without closing it leaves the process alive for ever — one test was measured at over 90s and still going, against 11s now. A test that reports by exit code ends by closing everything, and the driver settles every pending request both when the target goes away and when it simply never replies.
• CDP_PORT names an instance; it vouches for nothing.

• The source catalogue records no separate caveats for this entry. The implementation and evidence above define its scope.