diff --git a/quest/m0/README.md b/quest/m0/README.md
index 64c5905..40c732b 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -82,7 +82,6 @@ repository.
 - [Studio on macOS with capture granted](/quest/m0/app-macos.md) - camera, screen, and audio capture run on a Mac, not only Linux
 - [Studio on Windows](/quest/m0/app-windows.md) - the studio runs on Windows, not only Linux
 - [Viewer-side composition](/quest/m0/compose/README.md) - sources as their own tracks plus a layout track, composed by viewers, with a server-composed program as the fallback
-- [The program encoder drains](/quest/m0/program-drain.md) - a hardware encoder never loses the program's last frames at exit or on pause
 - [Broadcast sources play in sync](/quest/m0/broadcast-sync.md) - subscribed broadcasts and guests play audio and video on the publisher's timestamps, with `moq play`'s delay
 - [Wayland display and window sources](/quest/m0/wayland-sources.md) - portal-picked sources that reopen without the picker
 - [Live encode control](/quest/m0/encode-control.md) - simulcast rungs that follow the bandwidth grant, live bitrate and resolution, keyframes on request
diff --git a/quest/m0/program-drain.md b/quest/m0/program-drain.md
deleted file mode 100644
index e4df0f7..0000000
--- a/quest/m0/program-drain.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# [XS] The program encoder drains
-
-## Goal
-
-The program's encoder drains its buffered pictures before it stops at exit
-or when a new canvas ends its rendition, and before the studio publishes the
-gap marker of an on-demand pause, so a
-pipelined hardware encoder never loses the program's last frames.
-
-## Plan
-
-Source encoders already drain before they are replaced or their track ends,
-and a failed drain aborts the track
-([#3](https://github.com/moq-dev/studio/pull/3)). Give the program the same
-behaviour through the same path rather than a second one. openh264 buffers
-nothing, so prove it on an encoder that does, or with a test double that
-holds frames.
diff --git a/rs/moq-scene/src/publish.rs b/rs/moq-scene/src/publish.rs
index 35636e8..c368f85 100644
--- a/rs/moq-scene/src/publish.rs
+++ b/rs/moq-scene/src/publish.rs
@@ -218,14 +218,153 @@ impl Drop for Listing<'_> {
 	}
 }
 
-/// A captured or replayed source's video, encoded frame by frame as it is shown.
-pub(crate) struct Video {
+/// What an [`Encoding`] needs of its encoder: a
+/// [`moq_video::encode::Encoder`], or a test's stand-in that holds pictures the
+/// way a pipelined hardware backend does.
+pub trait Encode {
+	/// [`Encoder::encode`](moq_video::encode::Encoder::encode).
+	fn encode(&mut self, frame: &moq_video::Frame) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error>;
+	/// [`Encoder::flush`](moq_video::encode::Encoder::flush).
+	fn flush(&mut self) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error>;
+	/// [`Encoder::finish`](moq_video::encode::Encoder::finish).
+	fn finish(self) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error>;
+	/// [`Encoder::cut`](moq_video::encode::Encoder::cut).
+	fn cut(&mut self) -> Result<(), moq_video::Error>;
+}
+
+impl Encode for moq_video::encode::Encoder {
+	fn encode(&mut self, frame: &moq_video::Frame) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error> {
+		self.encode(frame)
+	}
+
+	fn flush(&mut self) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error> {
+		self.flush()
+	}
+
+	fn finish(self) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error> {
+		self.finish()
+	}
+
+	fn cut(&mut self) -> Result<(), moq_video::Error> {
+		self.cut()
+	}
+}
+
+/// An encoder and the video track it publishes into.
+///
+/// A pipelined backend still holds its last pictures when its encoder is
+/// replaced, the track pauses, or the track ends, so each of those publishes
+/// them first. Dropping this ends the track cleanly rather than leaving
+/// subscribers with a dropped one, and a drain that fails aborts the track with
+/// the reason.
+pub struct Encoding<E: Encode = moq_video::encode::Encoder> {
 	/// Taken only to abort or finish it, as the track ends.
 	producer: Option<moq_video::encode::Producer>,
+	encoder: Option<E>,
+}
+
+impl<E: Encode> Encoding<E> {
+	/// Publish into `producer`, with no encoder open yet.
+	pub fn new(producer: moq_video::encode::Producer) -> Self {
+		Self {
+			producer: Some(producer),
+			encoder: None,
+		}
+	}
+
+	/// Whether an encoder is open.
+	pub fn is_open(&self) -> bool {
+		self.encoder.is_some()
+	}
+
+	/// Encode with `encoder` from here on, after draining the one it replaces.
+	pub fn open(&mut self, encoder: E) -> Result<(), Error> {
+		self.drain()?;
+		self.encoder = Some(encoder);
+		Ok(())
+	}
+
+	/// Encode `frame` and publish what the encoder hands back.
+	///
+	/// # Panics
+	///
+	/// When no encoder is [open](Self::open).
+	pub fn encode(&mut self, frame: &moq_video::Frame) -> Result<(), Error> {
+		let encoder = self.encoder.as_mut().expect("an encoder is open");
+		let encoded = encoder.encode(frame)?;
+		self.producer.as_mut().expect("open until it ends").publish(&encoded)?;
+		Ok(())
+	}
+
+	/// Close the encoder, publishing what it still holds.
+	pub fn drain(&mut self) -> Result<(), Error> {
+		if let (Some(encoder), Some(producer)) = (self.encoder.take(), &mut self.producer) {
+			producer.publish(&encoder.finish()?)?;
+		}
+		Ok(())
+	}
+
+	/// Mark a gap in the track after [draining](Self::drain) the encoder, so
+	/// the next one [opened](Self::open) starts with a keyframe, even on a
+	/// backend that cannot [cut](Encode::cut).
+	pub(crate) fn discontinuity(&mut self) -> Result<(), Error> {
+		self.drain()?;
+		self.producer.as_mut().expect("open until it ends").discontinuity()?;
+		Ok(())
+	}
+
+	/// Mark a gap in the track, such as the last viewer leaving an on-demand
+	/// one, keeping the encoder and its session open. What the encoder still
+	/// holds lands before the gap rather than after it, and the next picture
+	/// is a keyframe, so a viewer arriving after the gap starts there.
+	pub fn pause(&mut self) -> Result<(), Error> {
+		let producer = self.producer.as_mut().expect("open until it ends");
+		if let Some(encoder) = &mut self.encoder {
+			producer.publish(&encoder.flush()?)?;
+			encoder.cut()?;
+		}
+		producer.discontinuity()?;
+		Ok(())
+	}
+
+	/// End the track cleanly, after publishing what the encoder still holds.
+	/// A failure aborts the track with the reason.
+	pub fn finish(mut self) -> Result<(), Error> {
+		self.end()
+	}
+
+	/// End the track, failed with `err` so viewers see why, dropping what the
+	/// encoder still holds.
+	pub fn abort(mut self, err: moq_net::Error) {
+		self.encoder = None;
+		if let Some(producer) = self.producer.take() {
+			producer.abort(err);
+		}
+	}
+
+	fn end(&mut self) -> Result<(), Error> {
+		let drained = self.drain();
+		let Some(mut producer) = self.producer.take() else {
+			return drained;
+		};
+		let result = drained.and_then(|()| Ok(producer.finish()?));
+		if let Err(err) = &result {
+			producer.abort(moq_net::Error::Transport(err.to_string()));
+		}
+		result
+	}
+}
+
+impl<E: Encode> Drop for Encoding<E> {
+	fn drop(&mut self) {
+		let _ = self.end();
+	}
+}
+
+/// A captured or replayed source's video, encoded frame by frame as it is shown.
+pub(crate) struct Video {
+	track: Encoding,
 	config: moq_video::encode::Config,
-	/// Opened on the first frame, and reopened when the picture's size or color
-	/// space changes, which moves the rendition to a new track.
-	encoder: Option<moq_video::encode::Encoder>,
 	clock: moq_mux::Clock,
 	/// Where the capture's private timeline starts on the studio clock, in
 	/// microseconds, taken at the first frame.
@@ -254,15 +393,16 @@ impl Video {
 			.with_hls_hint(config.gop.duration(config.framerate));
 		let producer = moq_video::encode::Producer::new(listing.broadcast.clone(), reserved, rendition)?;
 		Ok(Self {
-			producer: Some(producer),
+			track: Encoding::new(producer),
 			config,
-			encoder: None,
 			clock: listing.studio.clock(),
 			epoch: None,
 		})
 	}
 
-	/// Encode and publish `frame`, restamping it onto the studio clock.
+	/// Encode and publish `frame`, restamping it onto the studio clock. The
+	/// encoder opens on the first frame, and reopens when the picture's size or
+	/// color space changes, which moves the rendition to a new track.
 	pub(crate) fn encode(&mut self, frame: &mut moq_video::Frame) -> Result<(), Error> {
 		let captured = frame.timestamp.as_micros();
 		let epoch = *self
@@ -276,60 +416,29 @@ impl Video {
 			self.config.width = size.width;
 			self.config.height = size.height;
 			self.config.color = color;
-			self.drain()?;
+			// Before the next one opens, so a GPU at its session cap has room.
+			self.track.drain()?;
 		}
-		let encoder = match &mut self.encoder {
-			Some(encoder) => encoder,
-			None => self.encoder.insert(moq_video::encode::Encoder::new(&self.config)?),
-		};
-		let encoded = if frame.size() == size {
-			encoder.encode(frame)?
+		if !self.track.is_open() {
+			self.track.open(moq_video::encode::Encoder::new(&self.config)?)?;
+		}
+		if frame.size() == size {
+			self.track.encode(frame)
 		} else {
-			encoder.encode(&frame.resize(size, &Default::default())?)?
-		};
-		self.producer.as_mut().expect("open until it ends").publish(&encoded)?;
-		Ok(())
+			self.track.encode(&frame.resize(size, &Default::default())?)
+		}
 	}
 
 	/// Mark a break, such as a gap in a replay: what follows does not continue
 	/// what came before, and a viewer arriving during it waits for what follows
 	/// rather than being served the last picture as if it were live.
 	pub(crate) fn discontinuity(&mut self) -> Result<(), Error> {
-		self.drain()?;
-		self.producer.as_mut().expect("open until it ends").discontinuity()?;
-		Ok(())
-	}
-
-	/// Publish what the encoder still holds and close it, so a pipelined
-	/// backend's last pictures are not lost when the encoder is replaced or the
-	/// track ends.
-	fn drain(&mut self) -> Result<(), Error> {
-		if let (Some(encoder), Some(producer)) = (self.encoder.take(), &mut self.producer) {
-			producer.publish(&encoder.finish()?)?;
-		}
-		Ok(())
+		self.track.discontinuity()
 	}
 
 	/// End the track, failed with `err` so viewers see why.
-	pub(crate) fn abort(mut self, err: &Error) {
-		if let Some(producer) = self.producer.take() {
-			producer.abort(moq_net::Error::Transport(err.to_string()));
-		}
-	}
-}
-
-impl Drop for Video {
-	fn drop(&mut self) {
-		// A capture that ends, or a source removed or edited, ends its track
-		// cleanly rather than leaving subscribers with a dropped one.
-		let drained = self.drain();
-		match (self.producer.take(), drained) {
-			(Some(mut producer), Ok(())) => {
-				let _ = producer.finish();
-			}
-			(Some(producer), Err(err)) => producer.abort(moq_net::Error::Transport(err.to_string())),
-			(None, _) => {}
-		}
+	pub(crate) fn abort(self, err: &Error) {
+		self.track.abort(moq_net::Error::Transport(err.to_string()));
 	}
 }
 
@@ -569,6 +678,125 @@ mod tests {
 		.await;
 	}
 
+	/// Holds its newest pictures back the way a pipelined hardware encoder
+	/// does, handing them over only on a flush or finish. openh264, the encoder
+	/// on every machine, holds nothing.
+	struct Pipelined {
+		encoder: moq_video::encode::Encoder,
+		held: Vec<moq_video::encode::Encoded>,
+	}
+
+	impl Pipelined {
+		const DEPTH: usize = 2;
+	}
+
+	impl Encode for Pipelined {
+		fn encode(&mut self, frame: &moq_video::Frame) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error> {
+			self.held.extend(self.encoder.encode(frame)?);
+			let ready = self.held.len().saturating_sub(Self::DEPTH);
+			Ok(self.held.drain(..ready).collect())
+		}
+
+		fn flush(&mut self) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error> {
+			let mut encoded = std::mem::take(&mut self.held);
+			encoded.extend(self.encoder.flush()?);
+			Ok(encoded)
+		}
+
+		fn finish(mut self) -> Result<Vec<moq_video::encode::Encoded>, moq_video::Error> {
+			let mut encoded = std::mem::take(&mut self.held);
+			encoded.extend(self.encoder.finish()?);
+			Ok(encoded)
+		}
+
+		fn cut(&mut self) -> Result<(), moq_video::Error> {
+			self.encoder.cut()
+		}
+	}
+
+	/// A pipelined encoder's last pictures land before a pause's gap rather
+	/// than after it, the picture after the gap opens a group of its own, and
+	/// the pictures it still holds as the track ends are published before the
+	/// track finishes cleanly.
+	#[tokio::test]
+	async fn a_pipelined_encoder_loses_no_pictures() {
+		let (publish, _catalog, consumer) = studio();
+		let claim = publish.claim("program");
+		let listing = Listing::new(&claim, &publish).unwrap();
+		let size = moq_video::Size::new(64, 48);
+		let framerate = moq_video::FrameRate::new(30, 1).unwrap();
+		let mut config = moq_video::encode::Config::new(size.width, size.height, framerate);
+		config.kind = moq_video::encode::Kind::Named("openh264".into());
+		let rendition = config.probe().await.unwrap();
+		let producer =
+			moq_video::encode::Producer::new(listing.broadcast.clone(), listing.catalog.reserve(), rendition).unwrap();
+		let (name, rendition) = listing.catalog.snapshot().video.renditions.pop_first().unwrap();
+		// Every group, however far behind the newest, since this reads only once
+		// the track has ended.
+		let mut subscription = moq_net::track::Subscription::default();
+		subscription.max_delay = None;
+		let subscriber = consumer.track(&name).unwrap().subscribe(subscription).await.unwrap();
+		let container = moq_mux::catalog::hang::Container::try_from(&rendition).unwrap();
+		let mut reader = moq_mux::container::Consumer::new(subscriber, container);
+
+		let mut track = Encoding::new(producer);
+		let encoder = moq_video::encode::Encoder::new(&config).unwrap();
+		track
+			.open(Pipelined {
+				encoder,
+				held: Vec::new(),
+			})
+			.unwrap();
+		for millis in [0, 33, 66] {
+			track.encode(&gray(size, millis)).unwrap();
+		}
+		track.pause().unwrap();
+		for millis in [500, 533, 566] {
+			track.encode(&gray(size, millis)).unwrap();
+		}
+		track.finish().unwrap();
+
+		/// What a viewer reads, in order.
+		#[derive(Debug, PartialEq)]
+		enum Seen {
+			/// A group opens.
+			Group,
+			/// A picture, at its timestamp in milliseconds.
+			Picture(u128),
+			/// The media stops for a gap.
+			End,
+		}
+		let mut seen = Vec::new();
+		let mut current = None;
+		while let Some(read) = reader.read().await.unwrap() {
+			match read {
+				moq_mux::container::Read::Frame { group, frame } => {
+					if current.replace(group) != Some(group) {
+						seen.push(Seen::Group);
+					}
+					seen.push(Seen::Picture(frame.timestamp.as_micros() / 1000));
+				}
+				moq_mux::container::Read::End { .. } => seen.push(Seen::End),
+				moq_mux::container::Read::Gap { .. } => panic!("pictures went missing"),
+			}
+		}
+		use Seen::*;
+		assert_eq!(
+			seen,
+			[
+				Group,
+				Picture(0),
+				Picture(33),
+				Picture(66),
+				End,
+				Group,
+				Picture(500),
+				Picture(533),
+				Picture(566),
+			]
+		);
+	}
+
 	/// An edited source's replacement owns the listing from the moment it
 	/// opens, even when the old source's driver only gets to list itself later,
 	/// and the old one's end leaves the replacement listed.
diff --git a/rs/moq-studio/src/engine.rs b/rs/moq-studio/src/engine.rs
index fd4d57e..b501842 100644
--- a/rs/moq-studio/src/engine.rs
+++ b/rs/moq-studio/src/engine.rs
@@ -23,6 +23,7 @@ use std::time::Duration;
 use anyhow::Context;
 use bytes::Bytes;
 use kio::clock::Instant;
+use moq_scene::publish::Encoding;
 use moq_scene::source::{self, Driver, Sources};
 use moq_scene::{Canvas, Collection, Compositor, Draft, Edit, History, wgpu};
 use moq_video::render::export::{Exporter, Pending, Route};
@@ -411,6 +412,10 @@ pub struct Engine {
 	pub room: Option<Arc<crate::guests::Room>>,
 	/// Keeps broadcast sources' origin open when no connection holds it.
 	_origin: Option<moq_net::origin::Producer>,
+	/// Set by [`stop`](Self::stop), which ends the program clock.
+	stopped: AtomicBool,
+	/// The program clock's thread, which [`stop`](Self::stop) waits on.
+	program: Mutex<Option<std::thread::JoinHandle<()>>>,
 }
 
 /// The audio the program publishes.
@@ -514,6 +519,8 @@ impl Engine {
 			output,
 			room,
 			_origin: origin,
+			stopped: AtomicBool::new(false),
+			program: Mutex::default(),
 		});
 		let (video, audio, clock, publisher) = match publish {
 			Some(Publish {
@@ -535,9 +542,10 @@ impl Engine {
 			None => Duration::ZERO,
 		};
 		let program = engine.clone();
-		clocked("program".into(), async move || {
+		let thread = clocked("program".into(), async move || {
 			program.run_program(start, epoch, video).await
 		})?;
+		*engine.program.lock().unwrap() = Some(thread);
 		let mix = engine.clone();
 		clocked("audio".into(), async move || mix.run_audio(start, epoch, audio).await)?;
 		let save = engine.clone();
@@ -553,6 +561,20 @@ impl Engine {
 		Ok(engine)
 	}
 
+	/// Stop the program clock, then wait for each rendition's encoder to
+	/// publish the copies on their way to it and what it still holds, and to
+	/// end its video track, so quitting loses none of the program's last
+	/// pictures.
+	pub fn stop(&self) {
+		self.stopped.store(true, Ordering::Relaxed);
+		let thread = self.program.lock().unwrap().take();
+		if let Some(thread) = thread
+			&& thread.join().is_err()
+		{
+			tracing::error!("the program thread panicked");
+		}
+	}
+
 	/// Write the collection and its history to their files unless they
 	/// already hold them, or the scene file changed outside the studio.
 	pub fn save(&self) -> anyhow::Result<()> {
@@ -626,6 +648,9 @@ impl Engine {
 	/// drawn at and opens another, since a track never changes what it
 	/// carries. Drawing outlives the encoder: a failed output stops copying the
 	/// program, and the preview and program keep moving.
+	///
+	/// Runs until the studio [stops](Self::stop), and returns once every
+	/// rendition's encode thread has finished its track.
 	async fn run_program(&self, start: Instant, epoch: Duration, video: Option<(Renditions, Rendition)>) {
 		let (renditions, mut rendition) = video.unzip();
 		let mut canvas = self.state.lock().unwrap().compositor.canvas();
@@ -646,6 +671,21 @@ impl Engine {
 
 		loop {
 			let tick = clock.tick().await;
+			if self.stopped.load(Ordering::Relaxed) {
+				// Without a sender, each encoder publishes what it was sent and
+				// still holds, then finishes its track.
+				ending.extend(rendition.take().map(Rendition::end));
+				for thread in ending {
+					if thread.join().is_err() {
+						tracing::error!("an encode thread panicked");
+					}
+				}
+				// It holds the threads of the renditions it waits on.
+				if let Some((_, probe)) = probing {
+					let _ = probe.join();
+				}
+				return;
+			}
 			let (program, drawn) = {
 				let mut guard = self.state.lock().unwrap();
 				let state = &mut *guard;
@@ -1128,14 +1168,15 @@ fn encode(
 	rendition: u64,
 	opened: tokio::sync::oneshot::Sender<anyhow::Result<()>>,
 	video: mpsc::Receiver<Video>,
-	mut producer: moq_video::encode::Producer,
+	producer: moq_video::encode::Producer,
 	config: moq_video::encode::Config,
 	zero_copy: bool,
 ) {
-	let mut encoder = match moq_video::encode::Encoder::new(&config) {
+	let mut track = Encoding::new(producer);
+	let encoder = match moq_video::encode::Encoder::new(&config) {
 		Ok(encoder) => encoder,
 		Err(err) => {
-			producer.abort(moq_net::StreamError::Internal.into());
+			track.abort(moq_net::StreamError::Internal.into());
 			let err = anyhow::Error::new(err).context("video encoder");
 			stats.fail_video(format!("{err:#}"));
 			let _ = opened.send(Err(err));
@@ -1145,33 +1186,40 @@ fn encode(
 	stats.opened_encoder(rendition, encoder.name());
 	let _ = opened.send(Ok(()));
 
-	let result = encode_frames(stats, video, &mut producer, &mut encoder, zero_copy).and_then(|()| {
-		producer.finish()?;
-		Ok(())
-	});
-	if let Err(err) = result {
-		stats.fail_video(format!("{err:#}"));
-		producer.abort(moq_net::StreamError::Internal.into());
+	let encoded = track
+		.open(encoder)
+		.context("video encoder")
+		.and_then(|()| encode_frames(stats, video, &mut track, zero_copy));
+	match encoded {
+		// Publishes what the encoder still holds before the track ends, so a
+		// rendition's last pictures are not lost to a resize or to quitting. A
+		// failure aborts it.
+		Ok(()) => {
+			if let Err(err) = track.finish() {
+				stats.fail_video(format!("{err:#}"));
+			}
+		}
+		Err(err) => {
+			stats.fail_video(format!("{err:#}"));
+			track.abort(moq_net::StreamError::Internal.into());
+		}
 	}
 }
 
 fn encode_frames(
 	stats: &Stats,
 	video: mpsc::Receiver<Video>,
-	producer: &mut moq_video::encode::Producer,
-	encoder: &mut moq_video::encode::Encoder,
+	track: &mut Encoding,
 	zero_copy: bool,
 ) -> anyhow::Result<()> {
-	let mut paused = false;
-
 	while let Ok(video) = video.recv() {
 		let pending = match video {
 			Video::Frame(pending) => pending,
 			// Marks the gap, so a viewer arriving during it is not served the
-			// last group before it as if it were live.
+			// last group before it as if it were live, and one arriving after it
+			// starts from a keyframe.
 			Video::Pause => {
-				producer.discontinuity().context("video")?;
-				paused = true;
+				track.pause().context("video")?;
 				continue;
 			}
 			Video::Failed(err) => return Err(err).context("copying the program"),
@@ -1186,15 +1234,8 @@ fn encode_frames(
 			stats.read_back.fetch_add(1, Ordering::Relaxed);
 		}
 
-		// A viewer arriving after a break starts from a keyframe rather than
-		// waiting out the rest of a group nobody received the start of.
-		if std::mem::take(&mut paused) {
-			encoder.cut().context("video encoder")?;
-		}
-
 		let start = Instant::now();
-		let encoded = encoder.encode(&frame).context("video encoder")?;
-		producer.publish(&encoded).context("video")?;
+		track.encode(&frame).context("video")?;
 		stats
 			.encode_us
 			.store(start.elapsed().as_micros() as u64, Ordering::Relaxed);
@@ -1231,7 +1272,7 @@ fn spawn(driver: Driver) {
 		}
 	});
 	match started {
-		Ok(()) => {
+		Ok(_) => {
 			if let Err(mpsc::SendError(driver)) = handoff.send(driver) {
 				driver.fail("the source thread stopped");
 			}
@@ -1242,11 +1283,11 @@ fn spawn(driver: Driver) {
 
 /// Start a thread called `name` that runs `task` with its own clock and IO,
 /// returning why if either cannot start.
-fn clocked(name: String, task: impl AsyncFnOnce() + Send + 'static) -> anyhow::Result<()> {
+fn clocked(name: String, task: impl AsyncFnOnce() + Send + 'static) -> anyhow::Result<std::thread::JoinHandle<()>> {
 	// The thread starts before its runtime is built and handed over, since a
 	// runtime dropped in the async caller, as a refused spawn would, panics.
 	let (handoff, received) = mpsc::sync_channel::<tokio::runtime::Runtime>(1);
-	std::thread::Builder::new()
+	let thread = std::thread::Builder::new()
 		.name(name.clone())
 		.spawn(move || {
 			if let Ok(runtime) = received.recv() {
@@ -1262,7 +1303,7 @@ fn clocked(name: String, task: impl AsyncFnOnce() + Send + 'static) -> anyhow::R
 		runtime.shutdown_background();
 		anyhow::bail!("the {name} thread stopped");
 	}
-	Ok(())
+	Ok(thread)
 }
 
 #[cfg(test)]
@@ -1604,6 +1645,21 @@ mod tests {
 			.expect("the clip saves")
 			.expect("a clip");
 		assert_eq!(clip, dir.path().join("show-clip-1.mp4"));
+
+		// Quitting ends the program's video cleanly once the encoder published
+		// what it was handed, rather than leaving viewers a dropped track.
+		let mut track = broadcast.track(&resized).unwrap().subscribe(None).await.unwrap();
+		let stopping = engine.clone();
+		tokio::task::spawn_blocking(move || stopping.stop()).await.unwrap();
+		kio::clock::timeout(TIMEOUT, async {
+			while let Some(mut group) = track.recv_group().await.expect("the video finishes") {
+				while group.read_frame().await.expect("the video finishes").is_some() {}
+			}
+		})
+		.await
+		.expect("the video ends");
+		let failed = engine.stats.error();
+		assert!(failed.is_none(), "{failed:?}");
 	}
 
 	/// With a failover relay, both relays route the program under its one
diff --git a/rs/moq-studio/src/main.rs b/rs/moq-studio/src/main.rs
index fbdc3c8..fb191cc 100644
--- a/rs/moq-studio/src/main.rs
+++ b/rs/moq-studio/src/main.rs
@@ -172,6 +172,7 @@ fn main() -> anyhow::Result<ExitCode> {
 	};
 	// The edits since the last autosave, so quitting loses none.
 	let saved = engine.save();
+	engine.stop();
 	if let (Err(err), Err(_)) = (&saved, &ran) {
 		tracing::error!(error = format!("{err:#}"), "cannot save on quit");
 	}