#34406 Cloud start: a start refused on this Mac says why, and marks no step failed

Leo, on the "The app refused the agent connection." card under a failed "Set up a Cloud machine" step: "what happened here on this build?"

What happened

A Cloud first send from a New Tab chat whose folder chip named a folder that was not one of the pane's folders. AgentPaneHandOff.cloud (folderInScope) correctly refused it with transport.path_outside_roots before anything reached Cloud, but:

• the reply's message is the generic transportFailedMessage ("The app refused the agent connection."), which cloudStartEnded showed as is;
• startupChecklist marks "machine" failed whenever no step began, so the card blamed "Set up a Cloud machine";
• nothing was logged under app.cloud (CloudStartChat never ran), so the log showed no Cloud failure at all.

Change

• cloudStartEnded: a transport.* code is worded by its code (cloudRefusalText): transport.path_outside_roots reads "This folder isn't open in this tab; pick it to send it to Cloud." (new cloudStartup.folderNotOpen, 21 locales), any other through transportErrors.errorMessage. It sets refusedHere.
• startupChecklist: a refusedHere start marks no step failed.
• AgentPaneHandOff.cloud logs the pane's own refusals (transport.*, cloud_attachments, unsupported) under app.cloud.

folderInScope is not widened. Why the chip's folder was not a root is the follow-up PR (a New Tab recent project nobody clicked is never granted for Cloud).

Small, contained fix (light path): one subagent review, tests in cloudStartProgress.test.ts and CloudStartView.test.tsx.

Risk: low. Only the failed Cloud start card's words and step marks change, plus one log line.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes a Cloud start refused on this Mac show why it was refused, stop blaming the "Set up a Cloud machine" step, and log the refusal under app.cloud.

• A transport.* refusal now shows reason-specific wording instead of the generic "The app refused the agent connection."; a folder outside the tab reads "This folder isn't open in this tab; pick it to send it to Cloud."
• A refusal made by the pane before reaching Cloud marks no checklist step failed.
• The pane's own refusals are logged under app.cloud.