fix(room): release remote participants when the room is closed

`RoomSession::close` unpublished the local participant's tracks and then dropped
the remote participant map. Dropping the map does not release the participants:
every remote publication registers callbacks that hold the participant which owns
them — `on_subscribed`/`on_unsubscribed` capture the `RemoteParticipant`, and
`on_muted`/`on_unmuted` capture it through the publication map — so each remote
participant is kept alive by a cycle through its own publications.

A leaked participant holds `Arc<RtcEngine>`, so it pins the whole engine, its peer
connections and the WebRTC runtime: exactly what commit 16530d2 set out to
release. Each connect/close cycle leaked another one.

`handle_participant_disconnect` already unregisters these when a peer actually
leaves, but it also emits ParticipantDisconnected and TrackUnpublished. The peers
have not left here — the room is closing — so unregister directly instead, leaving
the event stream unchanged.

Two ordering constraints make this correct:

- The teardown runs after `room_handle` has been joined. `room_task` is what
  inserts remote participants, so draining the map any earlier would let an engine
  event queued behind the close repopulate it, and those participants would never
  be visited.
- Each publication is unregistered before its track is detached.
  `RemoteTrackPublication::set_track(None)` invokes the unsubscribe handler *before*
  clearing it, and that handler dispatches TrackUnsubscribed carrying strong clones
  of the participant and track. Clearing the handlers first keeps teardown silent,
  so a receiver the application has stopped draining cannot pin the participant
  through a queued event.

`test_close_releases_room_session` did not catch any of this because it runs with a
single participant and no tracks, so neither cycle is ever formed. The new test uses
two participants with a published, subscribed track, keeps its event receiver alive
and undrained across the close, and asserts via a drop probe that the remote
participant's internals are released.

Author: LautaroPetaccio

livekit/src/room/mod.rs

@@ -1201,6 +1201,31 @@ impl RoomSession {
         let _ = handle.remote_dt_task.await;
         let _ = handle.room_handle.await;
 
+        // Tear down the remote participants. Dropping the map is not enough: each of their
+        // publications registers callbacks that hold the participant which owns them, so the
+        // participant — and the `Arc<RtcEngine>` it holds — survives the room unless those
+        // callbacks are unregistered.
+        //
+        // This runs only after `room_handle` has been joined. `room_task` is what inserts
+        // remote participants, so doing it any earlier would let an engine event queued
+        // behind us repopulate the map after we had already drained it, and those
+        // participants would never be visited.
+        //
+        // Unregister before detaching the track, not after: `RemoteTrackPublication::
+        // set_track(None)` invokes the unsubscribe handler *before* clearing, and that
+        // handler dispatches `TrackUnsubscribed` carrying strong clones of the participant
+        // and track. Clearing the handlers first keeps teardown silent, so a receiver the
+        // application has stopped draining cannot pin the participant through a queued
+        // event. `handle_participant_disconnect` is deliberately not reused for the same
+        // reason: these peers have not left, the room is closing.
+        let remote_participants = std::mem::take(&mut *self.remote_participants.write());
+        for participant in remote_participants.into_values() {
+            for (sid, publication) in participant.track_publications() {
+                participant.remove_publication(&sid);
+                publication.set_track(None);
+            }
+        }
+
         self.dispatcher.clear();
         Ok(())
     }

livekit/src/room/participant/remote_participant.rs

@@ -112,6 +112,15 @@ impl RemoteParticipant {
         self.inner.track_publications.read().clone()
     }
 
+    /// Test-only: returns a probe that reports whether this participant's internals have
+    /// been dropped. Each of its publications registers callbacks that hold the
+    /// participant, so teardown has to unregister them; `Drop` alone never runs.
+    #[cfg(feature = "__lk-e2e-test")]
+    pub fn drop_probe(&self) -> impl Fn() -> bool + Send + Sync + 'static {
+        let inner = Arc::downgrade(&self.inner);
+        move || inner.upgrade().is_none()
+    }
+
     pub(crate) async fn add_subscribed_media_track(
         &self,
         sid: TrackSid,

livekit/tests/room_test.rs

@@ -14,12 +14,15 @@
 
 #[cfg(feature = "__lk-e2e-test")]
 use {
-    anyhow::{Ok, Result},
+    anyhow::{anyhow, Ok, Result},
     chrono::{TimeDelta, TimeZone, Utc},
-    common::test_rooms,
+    common::{
+        test_rooms,
+        video::{SolidColorParams, SolidColorTrack},
+    },
     libwebrtc::prelude::PeerConnectionState,
-    livekit::{ConnectionState, ParticipantKind, RoomEvent},
-    std::time::Duration,
+    livekit::{options::VideoCodec, ConnectionState, ParticipantKind, RoomEvent},
+    std::{sync::Arc, time::Duration},
     tokio::time::{self, timeout},
 };
 
@@ -140,3 +143,65 @@ async fn test_close_releases_room_session() -> Result<()> {
     assert!(session_dropped(), "room callbacks retained the room session after close");
     Ok(())
 }
+
+/// `close()` must tear down remote participants, not only the local one.
+///
+/// Every remote publication registers callbacks that hold the participant which owns
+/// them: `on_subscribed`/`on_unsubscribed` capture the `RemoteParticipant`, and
+/// `on_muted`/`on_unmuted` capture it through the publication map. Those are reference
+/// cycles, so a remote participant — and the `Arc<RtcEngine>` it holds — outlives the
+/// room unless teardown unregisters them. Only the disconnect path does that, and
+/// `close()` never walks the remote participants.
+#[cfg(feature = "__lk-e2e-test")]
+#[test_log::test(tokio::test)]
+async fn test_close_releases_remote_participants() -> Result<()> {
+    let mut rooms = test_rooms(2).await?;
+    let (sub_room, mut sub_events) = rooms.remove(0);
+    let (pub_room, _pub_events) = rooms.remove(0);
+
+    // The cycles only exist once the remote participant has a publication.
+    let mut solid_track = SolidColorTrack::new(
+        Arc::new(pub_room),
+        SolidColorParams { width: 320, height: 240, luma: 128 },
+    );
+    solid_track.publish(VideoCodec::VP8, false).await?;
+
+    timeout(Duration::from_secs(15), async {
+        loop {
+            match sub_events.recv().await {
+                Some(RoomEvent::TrackSubscribed { .. }) => break Ok(()),
+                Some(_) => continue,
+                None => break Err(anyhow!("event stream ended before the track was subscribed")),
+            }
+        }
+    })
+    .await??;
+
+    let remote = sub_room
+        .remote_participants()
+        .into_values()
+        .next()
+        .ok_or_else(|| anyhow!("subscriber never saw the publisher"))?;
+    let remote_dropped = remote.drop_probe();
+    drop(remote);
+
+    // `sub_events` is deliberately kept alive and undrained across the close. Teardown
+    // must not dispatch anything carrying the participant: a queued event holds strong
+    // clones, so a receiver the application has stopped polling would pin the participant
+    // just as effectively as the callbacks did.
+    sub_room.close().await?;
+    drop(sub_room);
+
+    let released = timeout(Duration::from_secs(10), async {
+        while !remote_dropped() {
+            time::sleep(Duration::from_millis(50)).await;
+        }
+    })
+    .await
+    .is_ok();
+
+    drop(sub_events);
+
+    assert!(released, "remote participant retained after the room was closed");
+    Ok(())
+}