diff --git a/work/projects/CPM Breakage Testing Steps.md b/work/projects/CPM Breakage Testing Steps.md
new file mode 100644
index 00000000..70327bd4
--- /dev/null
+++ b/work/projects/CPM Breakage Testing Steps.md	
@@ -0,0 +1,36 @@
+### Testing Steps
+
+Run each case with fresh app data so daily pixel deduplication does not hide results. In Xcode’s console, filter by `PixelKit`.
+
+#### Healthy navigation
+
+1. Open `http://privacy-test-pages.site/features/autoconsent/`.
+2. Wait at least 5 seconds → no `debug_web_extension_cpm_*` pixel is sent.
+
+#### Failure, stuck, and recovery
+
+1. Open **Debug → Web Extensions → Simulate CPM Messaging Breakage (On)**.
+2. Load the Autoconsent test page and wait 5 seconds → `debug_web_extension_cpm_initialization_failed_after_other` is sent; no `stuck` pixel is sent.
+3. Navigate to another HTTP(S) page and wait 5 seconds → `debug_web_extension_cpm_messaging_stuck_other` is sent.
+4. Select **Simulate CPM Messaging Breakage (Off)**.
+5. Reload the page → `debug_web_extension_cpm_messaging_recovered_without_extension_reload` is sent.
+6. Navigate again → no additional CPM failure or recovery pixel is sent.
+
+#### Concurrent navigations
+
+1. Select **Simulate CPM Messaging Breakage (On)**.
+2. Load HTTP(S) pages in two tabs before either 4-second timeout expires.
+3. Wait 5 seconds → initialization failures are observed, but no `debug_web_extension_cpm_messaging_stuck_*` pixel is sent.
+4. Start another navigation after those failures and wait 5 seconds → `debug_web_extension_cpm_messaging_stuck_other` is sent.
+
+#### Extension reload
+
+1. Start with **Simulate CPM Messaging Breakage (Off)** and use the Fire button to trigger extension reloading.
+2. After data clearing completes, select **Simulate CPM Messaging Breakage (On)**.
+3. Load the Autoconsent test page and wait 5 seconds → these pixels are sent:
+    - `debug_web_extension_cpm_initialization_failed_after_extension_reload`
+    - `debug_web_extension_cpm_messaging_extension_reload_failed`
+4. Navigate again and wait 5 seconds → `debug_web_extension_cpm_messaging_stuck_extension_reload` is sent.
+5. Select **Simulate CPM Messaging Breakage (Off)** and reload → `debug_web_extension_cpm_messaging_recovered_after_extension_reload` is sent.
+
+Session-restoration and tab-crash attribution are covered by unit tests because the in-memory Debug-menu toggle does not survive app restart and does not itself crash a tab.
\ No newline at end of file