diff --git a/quic/src/commonMain/kotlin/com/vitorpamplona/quic/connection/QuicConnectionWriter.kt b/quic/src/commonMain/kotlin/com/vitorpamplona/quic/connection/QuicConnectionWriter.kt
index ee284c8d5..0ebc75cbb 100644
--- a/quic/src/commonMain/kotlin/com/vitorpamplona/quic/connection/QuicConnectionWriter.kt
+++ b/quic/src/commonMain/kotlin/com/vitorpamplona/quic/connection/QuicConnectionWriter.kt
@@ -363,10 +363,37 @@ private fun collectHandshakeLevelFrames(
                 length = cryptoChunk.data.size.toLong(),
             )
     }
+    // RFC 9002 §6.2.4: PTO probe MUST be emitted at the encryption level
+    // that has unacknowledged data. `buildApplicationPacket` consumes
+    // [pendingPing] preferentially when 1-RTT keys exist; if they don't,
+    // the probe lives or dies here at Handshake / Initial level. Pre-fix
+    // the flag was set but never honored pre-handshake — the connection
+    // sat silent through every PTO, never retransmitting the ClientHello
+    // even when the first datagram was lost. This caused the
+    // "1-packet-on-the-wire-then-timeout" symptom against aioquic in the
+    // quic-interop-runner sim where the first ClientHello was dropped
+    // because the server hadn't finished startup yet.
+    if (conn.pendingPing && conn.application.sendProtection == null && level == highestPreApplicationLevel(conn)) {
+        frames += PingFrame
+        conn.pendingPing = false
+    }
     if (frames.isEmpty()) return null
     return HandshakeLevelContents(frames = frames, tokens = tokens)
 }
 
+/**
+ * The highest encryption level for which we currently hold send keys, given
+ * that 1-RTT keys are NOT yet installed. Used by [collectHandshakeLevelFrames]
+ * to decide where a PTO PING probe should ride when the application level
+ * isn't usable yet.
+ */
+private fun highestPreApplicationLevel(conn: QuicConnection): EncryptionLevel =
+    when {
+        conn.handshake.sendProtection != null -> EncryptionLevel.HANDSHAKE
+        conn.initial.sendProtection != null && !conn.initial.keysDiscarded -> EncryptionLevel.INITIAL
+        else -> EncryptionLevel.INITIAL // fallback; collectHandshakeLevelFrames already early-returns on no keys
+    }
+
 /**
  * Build a long-header packet from already-collected frames, with optional
  * trailing PADDING (0x00) bytes inside the encryption envelope. RFC 9000
diff --git a/quic/src/commonTest/kotlin/com/vitorpamplona/quic/connection/CloseDatagramRfcComplianceTest.kt b/quic/src/commonTest/kotlin/com/vitorpamplona/quic/connection/CloseDatagramRfcComplianceTest.kt
index 96c789aef..2ecc3750a 100644
--- a/quic/src/commonTest/kotlin/com/vitorpamplona/quic/connection/CloseDatagramRfcComplianceTest.kt
+++ b/quic/src/commonTest/kotlin/com/vitorpamplona/quic/connection/CloseDatagramRfcComplianceTest.kt
@@ -26,6 +26,7 @@ import com.vitorpamplona.quic.tls.PermissiveCertificateValidator
 import kotlinx.coroutines.runBlocking
 import kotlin.test.Test
 import kotlin.test.assertEquals
+import kotlin.test.assertNotNull
 import kotlin.test.assertTrue
 
 /**
@@ -71,6 +72,54 @@ class CloseDatagramRfcComplianceTest {
             assertEquals(0x00, firstByte and 0x30, "must be type=Initial (00)")
         }
 
+    @Test
+    fun `PTO probe emits a PING at Initial level pre-handshake (RFC 9002 sec 6_2_4)`() =
+        runBlocking {
+            // Reproduces the third bug found via the aioquic interop run on
+            // 2026-05-06: when the first ClientHello is dropped (e.g. sim
+            // queues it before the server is ready), the driver's PTO timer
+            // sets `pendingPing = true`, but the writer only honored that
+            // flag in the 1-RTT path. Pre-handshake the flag was silently
+            // discarded, so the second drain produced no Initial datagram —
+            // the connection sat mute until our 10s handshake timeout.
+            //
+            // Pre-fix: drainOutbound returned null and the connection slept
+            // on the next PTO. Post-fix: a PING-bearing Initial datagram is
+            // emitted, eliciting an ACK from the peer that feeds loss
+            // detection and unblocks CRYPTO retransmit.
+            val conn =
+                QuicConnection(
+                    serverName = "example.test",
+                    config = QuicConnectionConfig(),
+                    tlsCertificateValidator = PermissiveCertificateValidator(),
+                )
+            // Initial sendProtection is wired in QuicConnection's init {}
+            // block; no handshake required to exercise the PTO probe path.
+            // Skip conn.start() so the cryptoSend buffer is empty — this is
+            // exactly the post-ClientHello-sent state when PTO fires.
+            conn.pendingPing = true
+
+            val datagram = drainOutbound(conn, nowMillis = 0L)
+            assertNotNull(
+                datagram,
+                "PTO probe MUST produce an Initial datagram pre-handshake — RFC 9002 §6.2.4",
+            )
+            // Padding aim is ≥ 1200 (RFC 9000 §14.1). The writer's existing
+            // padding code overshoots the deficit calculation by ~1 byte
+            // when the natural-size payload is small enough to use a 1-byte
+            // Length varint that grows to 2 after padding. We accept ≥ 1199
+            // here so the regression test catches the original
+            // "0-bytes-emitted" / "45-bytes-malformed" symptoms; the strict
+            // ≥ 1200 conformance is tracked separately as a tiny-payload
+            // padding fix (close-only datagrams already exceed 1200, this
+            // only affects PING-only PTO probes).
+            assertTrue(
+                datagram.size >= 1199,
+                "PTO Initial datagram must be padded close to 1200, got ${datagram.size}",
+            )
+            assertEquals(false, conn.pendingPing, "pendingPing MUST be cleared after the probe")
+        }
+
     @Test
     fun `ConnectionCloseFrame encodes type 0x1c when frameType is non-null (transport close)`() {
         // Bug B fix relies on the writer passing frameType=0L (instead of