livekit-server (verified on 1.13.7) serialises ParticipantPermission as can_publish / can_publish_sources; the reconciler read canPublish / canPublishSources, saw 'publishes nothing' for everyone and never called UpdateParticipant, so turning Allow Screen Sharing off did not stop an in-progress share. Normalise the permission keys before deciding. Verified on a local Synapse + LiveKit + guard stack: share track gone from the SFU 2 s after the policy flip. Tests added (44 pass). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA