In a supertest test, do you have to call app.listen() before request(app)?

No. If the server isn't listening yet, supertest binds it to an ephemeral port for you. An ephemeral port is a free, random port the system picks. Because each test file gets its own random port, parallel test files don't collide.

supertest sends real HTTP requests. So middleware, body parsing and headers all run as they would in production. That is why "supertest calls route handlers in memory without any HTTP layer" is wrong. It is also why "supertest only sends requests to a server already listening on a known port" is wrong: supertest starts the server itself when needed.