Findings No. 8
Our own Permissions-Policy header switched off four features we shipped
microphone=(), midi=(), publickey-credentials-get=(), and display-capture=() each blocked a shipped feature in production while the dev server worked fine.
Our own Permissions-Policy response header switched off four features we shipped. microphone=() blocked getUserMedia, midi=() blocked Web MIDI (a user report, since the dev server sent no such header), publickey-credentials-get=() blocked every passkey sign-in, and display-capture=() kept a screen-audio source from opening the share picker. Each is (self) now.
Two sharper lessons rode along. First, autoplay is deliberately not listed in the policy at all, because disabling it also blocks explicit play() calls. Second, the header lived in two places, a constant in securityHeaders.ts and a copy in vercel.json, and the copies drift; keep them in step or derive one from the other.
Receipt: Stem Shovel (versions 0.60.0, 0.29.0, 0.79.0; docs/environment.md, "Response headers").