@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Copyright (C) 2026 The Somewhere Authors
+
+package eu.nodepass.somewhere.quic
+
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import eu.nodepass.somewhere.protocol.DecodeResult
+import eu.nodepass.somewhere.protocol.frame.FlowKind
+import eu.nodepass.somewhere.protocol.session.NowhereSession
+import eu.nodepass.somewhere.protocol.session.QuicCarrier
+import eu.nodepass.somewhere.protocol.target.Target
+import eu.nodepass.somewhere.vpn.E2eEnvironment
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.net.InetSocketAddress
+import kotlin.time.Duration.Companion.nanoseconds
+
+/**
+ * A quiet connection stays open, and the interval it stays open with is derived.
+ *
+ * ## Why the arithmetic is not enough
+ *
+ * `KeepAliveTest` proves the number is inside the timeout. It cannot prove the
+ * PING is actually sent, that ngtcp2 was told, or that the Portal counts it as
+ * activity — which is three assumptions between a correct interval and a tunnel
+ * that survives being idle.
+ *
+ * Run against a Portal with `NOW_UDP_IDLE_TIMEOUT=20s`. The default is two
+ * minutes, and a case that waited that out would spend most of a suite's time
+ * asleep to prove one thing.
+ */
+@RunWith(AndroidJUnit4::class)
+class QuicKeepAliveTest {
+    @Test
+    fun theIntervalIsDerivedFromWhatTheTwoEndsNegotiated() {
+        withConnection { connection ->
+            val idle = connection.idleTimeoutNanos().nanoseconds
+            assertTrue("no idle timeout was negotiated at all", idle.inWholeSeconds > 0)
+
+            val interval = connection.keepAliveInterval
+            assertNotNull("no keep-alive was set after the handshake", interval)
+            assertTrue(
+                "a $interval keep-alive does not stay inside a $idle timeout",
+                KeepAlive.staysInside(interval!!, idle),
+            )
+        }
+    }
+
+    /**
+     * The claim itself: an idle **authenticated** connection outlives the
+     * timeout and still opens a flow.
+     *
+     * The word that had to be added is "authenticated", and the first version
+     * of this case did not have it. It opened a connection, slept, and then
+     * asked for a flow — and the Portal had already closed it, with
+     * `authentication deadline elapsed` in its log. **A QUIC connection carries
+     * its AuthFrame on its first flow**, so a connection that has not opened
+     * one has not authenticated, and upstream's five-second handshake deadline
+     * ends it long before any idle timeout is in question. Keep-alive is not
+     * what keeps an unauthenticated connection alive; nothing is.
+     *
+     * The flow at the end is what makes this a measurement rather than a wait.
+     * A connection that had quietly died would look identical from here — QUIC
+     * does not announce an idle close — and only asking it to do something
+     * distinguishes the two.
+     */
+    @Test
+    fun anIdleAuthenticatedConnectionOutlivesTheIdleTimeoutAndStillOpensAFlow() {
+        withConnection { connection ->
+            val idle = connection.idleTimeoutNanos().nanoseconds
+            val session =
+                NowhereSession(
+                    sharedKey = key(),
+                    connect = { error("a QUIC session must not dial TLS") },
+                    quicStreams =
+                        QuicCarrier.StreamFactory {
+                            QuicStreamTransport(connection, connection.openStream())
+                        },
+                    quicDatagrams = connection,
+                )
+            session.use {
+                val target = (Target.ofIpv4(byteArrayOf(127, 0, 0, 1), ORIGIN_PORT) as DecodeResult.Ok).value
+
+                // Authenticate, by doing the only thing that authenticates.
+                val first = session.openFlow(target, FlowKind.Tcp)
+                assertTrue("the session never authenticated: ${first.reasonOrNull()?.detail}", first is DecodeResult.Ok)
+                (first as DecodeResult.Ok).value.close()
+
+                Thread.sleep(IDLE_WAIT_MILLIS)
+
+                val second = session.openFlow(target, FlowKind.Tcp)
+                assertTrue(
+                    "the connection did not survive ${IDLE_WAIT_MILLIS}ms of quiet " +
+                        "(idle timeout $idle, keep-alive ${connection.keepAliveInterval}): " +
+                        "${second.reasonOrNull()?.detail}",
+                    second is DecodeResult.Ok,
+                )
+                (second as DecodeResult.Ok).value.close()
+            }
+        }
+    }
+
+    private fun withConnection(body: (QuicConnection) -> Unit) {
+        val portal = E2eEnvironment.requirePortal()
+        QuicConnection
+            .open(
+                remote = InetSocketAddress(portal.substringBeforeLast(':'), portal.substringAfterLast(':').toInt()),
+                alpn = "now/1",
+                serverName = null,
+                protect = { true },
+            ).use { connection ->
+                connection.completeHandshake()
+                body(connection)
+            }
+    }
+
+    private fun key() =
+        (
+            eu.nodepass.somewhere.protocol.auth.SharedKey
+                .of(E2eEnvironment.sharedKey) as DecodeResult.Ok
+        ).value
+
+    private companion object {
+        const val ORIGIN_PORT = 28091
+
+        /**
+         * Past upstream's five-second handshake deadline and past any
+         * plausible per-connection idle, without making a suite wait out the
+         * two-minute default for the sake of one claim.
+         */
+        const val IDLE_WAIT_MILLIS = 45_000L
+    }
+}
@@ -538,6 +538,13 @@ static int quic_init(struct quic_conn *c) {
     settings.initial_ts = now_ns();
 
     ngtcp2_transport_params_default(&params);
+
+    // Announced so that a quiet connection is closed rather than held open for
+    // ever by whichever end forgets it first. Two minutes matches upstream's
+    // own default (`NOW_UDP_IDLE_TIMEOUT`), and the effective timeout is the
+    // smaller of the two ends' values -- so announcing ours is how this client
+    // gets a say rather than inheriting whatever the Portal chose.
+    params.max_idle_timeout = 120 * NGTCP2_SECONDS;
     // NW-P-19: only one bidirectional stream is credited before
     // authentication, and unidirectional streams are never used. Advertising
     // none of the latter says so on the wire rather than in a comment.
@@ -1235,6 +1242,61 @@ Java_eu_nodepass_somewhere_quic_QuicConnection_nativeMaxDatagram(JNIEnv *env,
     return (jint)usable;
 }
 
+/*
+ * The idle timeout actually in force, in nanoseconds.
+ *
+ * The smaller of the two ends' announced values, which is what governs: a
+ * client that computed its keep-alive from its own announcement alone would be
+ * safe against itself and late against a peer that announced less.
+ *
+ * Zero means neither end set one, and then nothing closes the connection for
+ * being quiet.
+ */
+JNIEXPORT jlong JNICALL
+Java_eu_nodepass_somewhere_quic_QuicConnection_nativeIdleTimeout(JNIEnv *env,
+                                                                  jclass clazz,
+                                                                  jlong handle) {
+    (void)env;
+    (void)clazz;
+    int err;
+    struct quic_conn *c = checked(handle, &err);
+    const ngtcp2_transport_params *local, *remote;
+    ngtcp2_duration ours, theirs;
+
+    if (!c) {
+        return err;
+    }
+    local = ngtcp2_conn_get_local_transport_params(c->conn);
+    remote = ngtcp2_conn_get_remote_transport_params(c->conn);
+    ours = local ? local->max_idle_timeout : 0;
+    theirs = remote ? remote->max_idle_timeout : 0;
+
+    if (ours == 0) {
+        return (jlong)theirs;
+    }
+    if (theirs == 0) {
+        return (jlong)ours;
+    }
+    return (jlong)(ours < theirs ? ours : theirs);
+}
+
+// How often to send a PING on an otherwise quiet connection. Zero disables it.
+JNIEXPORT void JNICALL
+Java_eu_nodepass_somewhere_quic_QuicConnection_nativeSetKeepAlive(JNIEnv *env,
+                                                                   jclass clazz,
+                                                                   jlong handle,
+                                                                   jlong nanos) {
+    (void)env;
+    (void)clazz;
+    int err;
+    struct quic_conn *c = checked(handle, &err);
+    if (!c) {
+        return;
+    }
+    ngtcp2_conn_set_keep_alive_timeout(
+        c->conn, nanos <= 0 ? UINT64_MAX : (ngtcp2_duration)nanos);
+}
+
 JNIEXPORT jstring JNICALL
 Java_eu_nodepass_somewhere_quic_QuicConnection_nativeLastMessage(JNIEnv *env,
                                                                   jclass clazz,
 
@@ -96,6 +96,22 @@ class QuicCarrier(
     /** Opens one client-initiated bidirectional stream as a byte transport. */
     fun interface StreamFactory {
         fun open(): Transport
+
+        /**
+         * Which connection the last [open] came from.
+         *
+         * A QUIC connection authenticates once — but *once per connection*, and
+         * a connection that died and was rebuilt is a new one that has never
+         * authenticated. Without this the carrier would remember having
+         * authenticated and send the first flow on the new connection with no
+         * AuthFrame, which a Portal answers with the silence it answers every
+         * unauthenticated flow with: a tunnel that survives a network change
+         * and then carries nothing.
+         *
+         * A factory that never rebuilds returns a constant, which is why this
+         * has a default.
+         */
+        fun generation(): Int = 0
     }
 
     /** The unreliable half of a QUIC connection, as this carrier needs it. */
@@ -108,15 +124,16 @@ class QuicCarrier(
         fun maxDatagram(): Int
     }
 
-    private var authenticated = false
+    /** The generation this carrier last offered an AuthFrame on, or null. */
+    private var authenticatedOn: Int? = null
     private var closed = false
     private val open = mutableListOf<Transport>()
 
     /** Section 9's UDP carriage, when this connection has a datagram side. */
     private val lane: DatagramLane? = datagrams?.let { DatagramLane(it) }
 
-    /** Whether this connection has already offered its AuthFrame. */
-    val hasAuthenticated: Boolean get() = authenticated
+    /** Whether the current connection has already offered its AuthFrame. */
+    val hasAuthenticated: Boolean get() = authenticatedOn == streams.generation()
 
     fun openFlow(
         target: Target,
@@ -147,9 +164,10 @@ class QuicCarrier(
                 is DecodeResult.Ok -> built.value
             }
 
-        // Exactly once per connection, and before anything else on the wire.
+        // Exactly once per connection — and a rebuilt connection is a new one.
+        val generation = streams.generation()
         val authFrame =
-            if (authenticated) {
+            if (authenticatedOn == generation) {
                 ByteArray(0)
             } else {
                 Authentication.encodeFrame(
@@ -159,7 +177,7 @@ class QuicCarrier(
                     sessionId = sessionId.toByteArray(),
                 )
             }
-        authenticated = true
+        authenticatedOn = generation
 
         // A UDP flow's payload does not ride the stream. Section 9 is explicit:
         // after READY on the control stream, packets travel as DATAGRAMs — so
 
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Copyright (C) 2026 The Somewhere Authors
+
+package eu.nodepass.somewhere.quic
+
+import kotlin.time.Duration
+import kotlin.time.Duration.Companion.seconds
+
+/**
+ * How often an idle QUIC connection says something, so that it stays open.
+ *
+ * ## Why this is derived rather than fixed
+ *
+ * The reference client sends a keep-alive every fifteen seconds
+ * (`src/vector/session/quic.rs`, `Duration::from_secs(15)`), against an idle
+ * timeout that defaults to two minutes. On a server that costs nothing. On a
+ * phone it is a radio wake every fifteen seconds for the life of the tunnel,
+ * and the radio is the expensive part of a mobile connection by a wide margin —
+ * an idle modem that is woken often never reaches its low-power state at all.
+ *
+ * So the interval is read off the timeout that is actually in force. The peer
+ * announces `max_idle_timeout` in its transport parameters and the effective
+ * timeout is the smaller of the two ends' values; a keep-alive at half of that
+ * leaves a full interval of margin, which is one whole lost packet's worth.
+ *
+ * ## The two bounds, and why each exists
+ *
+ * A **floor** because a peer announcing a very short timeout would otherwise
+ * produce a keep-alive storm; below the floor the connection is simply allowed
+ * to close and be rebuilt, which costs one handshake rather than a permanently
+ * busy radio.
+ *
+ * A **ceiling** because middleboxes forget UDP mappings long before QUIC
+ * forgets connections. Thirty seconds is the interval below which most NAT
+ * bindings survive, and a keep-alive that outlived the binding would be sent
+ * into a path that no longer exists.
+ *
+ * Nothing here is negotiated or sent: a keep-alive interval is a local decision
+ * about when to send PING, and the specification says nothing about it.
+ */
+internal object KeepAlive {
+    /** The reference client's fixed interval, kept as the thing to beat. */
+    val UPSTREAM_INTERVAL: Duration = 15.seconds
+
+    /** Below this a connection is left to close and be rebuilt. */
+    val FLOOR: Duration = 5.seconds
+
+    /** Above this a NAT binding is more likely to have been forgotten. */
+    val CEILING: Duration = 30.seconds
+
+    /**
+     * The interval for a connection whose effective idle timeout is
+     * [idleTimeout], or null when no keep-alive should be sent at all.
+     *
+     * @param idleTimeout the smaller of the two ends' `max_idle_timeout`, which
+     *   is what actually governs. Zero means neither end set one, and then
+     *   nothing will close the connection for being quiet.
+     */
+    fun interval(idleTimeout: Duration): Duration? {
+        if (idleTimeout <= Duration.ZERO) return null
+        val half = idleTimeout / 2
+        if (half < FLOOR) return null
+        return if (half > CEILING) CEILING else half
+    }
+
+    /**
+     * Whether [interval] is safe for [idleTimeout].
+     *
+     * Stated separately from [interval] because it is the property that matters
+     * and it should be checkable against any value, not only the one this
+     * object computes.
+     */
+    fun staysInside(
+        interval: Duration,
+        idleTimeout: Duration,
+    ): Boolean = interval > Duration.ZERO && interval < idleTimeout
+}