Don't rotate PQ keys if data path is idle for ~90s (less than a WG handhshake time

client/internal/pqkem/convergence_test.go

@@ -52,8 +52,8 @@ func TestManager_RekeyToleratesKFailures(t *testing.T) {
 	// Establish: bootstrap + data-path-rekeyed so B becomes established and its data
 	// path is usable.
 	bootstrap(t, dA, dB)
-	dA.OnDataPathRekeyed("bbbb")
-	dB.OnDataPathRekeyed("aaaa")
+	dA.OnDataPathRekeyed("bbbb", 0)
+	dB.OnDataPathRekeyed("aaaa", 0)
 	require.NotEqual(t, PSK{}, wgB.psk("aaaa"))
 
 	// Drop B's outbound so rekeys can no longer converge.

client/internal/pqkem/manager.go

@@ -20,6 +20,14 @@ const (
 	// DefaultMaxRekeyFailures is how many consecutive rekey (non-initial) failures
 	// are tolerated before OnRekeyFailed. The initial exchange fails immediately.
 	DefaultMaxRekeyFailures = 3
+
+	// rotationActivityWindow gates rotation on recent real-data activity: a rekey
+	// clocks a rotation only if the peer exchanged user data within this window. It
+	// must stay shorter than the data path's rekey interval (WireGuard
+	// REKEY_AFTER_TIME ~120s) so the rotation's own traffic — which itself renews the
+	// activity signal — ages out before the next rekey, letting an idle tunnel stop
+	// rotating instead of self-sustaining.
+	rotationActivityWindow = 90 * time.Second
 )
 
 // LocalID and RemoteID are peer identity keys (e.g. WireGuard public keys). They are
@@ -319,7 +327,17 @@ func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error {
 // initiator that just derived a PSK, it chains the next exchange: a fresh offer over
 // the data path that acknowledges the just-completed one (its arrival under the new
 // key proves to the responder that the key works).
-func (m *Manager) OnDataPathRekeyed(remoteID RemoteID) {
+// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey.
+// sinceActivity is how long ago the peer last exchanged real user data; when it
+// exceeds rotationActivityWindow the tunnel is treated as idle and rotation is
+// skipped — an idle tunnel has nothing to protect, and rotating would emit data-path
+// traffic that keeps the peer artificially active (see conn.onWGCheckSuccess).
+func (m *Manager) OnDataPathRekeyed(remoteID RemoteID, sinceActivity time.Duration) {
+	if sinceActivity >= rotationActivityWindow {
+		m.trace("pqkem: peer idle, skipping data-path rotation", "peer", remoteID, "since_activity", sinceActivity)
+		return
+	}
+
 	m.mu.Lock()
 	ex := m.exchanges[remoteID]
 	chain := ex != nil && ex.state == stateAwaitingRekey

client/internal/pqkem/manager_test.go

@@ -143,8 +143,8 @@ func TestManager_ChainRotatesAndAcks(t *testing.T) {
 
 	// Data path up: B (initiator) chains the next offer over the data path, which
 	// rotates both to a fresh PSK and acknowledges A.
-	dA.OnDataPathRekeyed("bbbb")
-	dB.OnDataPathRekeyed("aaaa")
+	dA.OnDataPathRekeyed("bbbb", 0)
+	dB.OnDataPathRekeyed("aaaa", 0)
 
 	psk2A := wgA.psk("bbbb")
 	psk2B := wgB.psk("aaaa")
@@ -152,6 +152,30 @@ func TestManager_ChainRotatesAndAcks(t *testing.T) {
 	require.NotEqual(t, psk1, psk2B, "the chain rotated to a new PSK")
 }
 
+func TestManager_RotationSkippedWhenIdle(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+	psk1 := wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, psk1)
+
+	// Idle: the peer's last real-data activity is older than the window, so a rekey
+	// must NOT clock a rotation.
+	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow)
+	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow)
+	require.Equal(t, psk1, wgB.psk("aaaa"), "idle peer must not rotate the PSK")
+	require.Equal(t, psk1, wgA.psk("bbbb"), "idle peer must not rotate the PSK")
+
+	// Active: activity within the window clocks the rotation as usual.
+	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow-1)
+	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow-1)
+	psk2 := wgB.psk("aaaa")
+	require.NotEqual(t, psk1, psk2, "recent activity must clock a rotation")
+	require.Equal(t, psk2, wgA.psk("bbbb"), "both sides converge on the rotated PSK")
+}
+
 func TestManager_NonInitiatorReturnsNoOffer(t *testing.T) {
 	dA := NewManager("aaaa", newFakeWG(), nil)
 	defer dA.Stop()