docs(quest): finish WebTransport refusal delivery verification

quest/m0/README.md

@@ -83,6 +83,10 @@ have fixes on `main`: macOS tests (#5335), drill-sensitivity (#5338), loom
 
 - [qmux release backport](/quest/m0/qmux-credit-backport.md) - adopt the 0.5 fix independently of the next breaking cut
 
+- [noq 1.3.x close fix](/quest/m0/refusal-close-backport-upstream.md) - a published 1.3.x `web-transport-moq` acknowledges the CLOSE capsule before teardown
+
+- [Refusal close backport](/quest/m0/refusal-close-backport.md) - `release` reports a refused browser session as `unauthorized`, never "Connection lost"
+
 - [Lite SETUP backport](/quest/m0/lite-setup-backport.md) - `release` closes a moq-lite session on a repeated SETUP parameter or a second Setup Stream, in a later 0.14.x patch (#5521)
 - [Kotlin wrapper POM release](/quest/m0/kt-ffi-pom.md) - `dev.moq:moq` 0.5.2 ships from `release`, its POMs naming moq-ffi at `[0.4.3,0.5)`
 

quest/m0/refusal-close-backport-upstream.md

@@ -0,0 +1,22 @@
+# [S] noq releases the acknowledged-close fix on 1.3.x
+
+## Goal
+
+A `web-transport-moq` 1.3.x after 1.3.5 is on crates.io with the
+acknowledged-close fix from [moq-dev/noq#40](https://github.com/moq-dev/noq/pull/40),
+so a refused WebTransport session delivers its CLOSE capsule before teardown.
+Check crates.io for a 1.3.x newer than 1.3.5. Delete this condition once it
+ships.
+
+## Plan
+
+Backport noq#40's merge commit (e27c0ce) to noq's `release/1.3`, following
+its existing `-1.3` fix branches, with both regressions:
+`close_waits_for_capsule_ack` and `close_ack_wait_ends_with_connection`.
+Never move the published line to 2.x as the fix.
+
+Public API: none. Wire: none; the CLOSE capsule is delivered, not changed.
+
+## Related
+
+- [Release pin](/quest/m0/refusal-close-backport.md) - adopts the published fix

quest/m0/refusal-close-backport.md

@@ -0,0 +1,21 @@
+# [XS] Backport the acknowledged-close pin to release
+
+## Goal
+
+On `release`, a browser refused by the relay reliably sees `unauthorized`
+(close code 2), never "Connection lost", because the release line pins a
+`web-transport-moq` 1.3.x with the acknowledged-close fix.
+
+## Plan
+
+`release` pins `web-transport-moq` 1.3.5, which starts the 100 ms teardown
+grace before the CLOSE capsule is acknowledged. `main` already carries the fix
+in moq-tokio's `quic::web` (#5664). Once the 1.3.x fix ships, bump the
+release-line pin and run `just test interop --all`, keeping the exact browser
+refusal assertion. Follow the backport workflow.
+
+Public API: none. Wire: none.
+
+## Required
+
+- [noq 1.3.x publication](/quest/m0/refusal-close-backport-upstream.md) - the release-line fix is available

quest/m1/test-flakes-2/README.md

@@ -35,7 +35,6 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [Interop close code](/quest/m1/test-flakes-2/interop-close-code.md) - the browser reliably sees `unauthorized` for a refused session
 - [Auth refresh mocks time](/quest/m1/test-flakes-2/auth-refresh-mock-time.md) - moq-relay's auth refresh and fixed-lease tests measure a grant's life on one mocked clock
 - [uring teardown close](/quest/m1/test-flakes-2/uring-teardown-close.md) - moq-uring's published-close teardown test holds under load, fixed at its cause