Hackathon/a2r commerce checkout frontier

Description

The pitch.

## Motivation

Agentic checkout is multi-attribute. A shopping agent negotiating a purchase is trading price against delivery deadline ("I'll pay a premium for expedited"), under a constraint no utility weight can express: a hard wallet budget. Price-only bargaining cannot represent the premium, and unconstrained multi-attribute bargaining cannot represent the wallet. This submission evaluates the **buyer side**  in agent-to-retail commerce the shopping agent is the deployed software; the vendor side is usually a quoting engine.

## What ships

- **Plugin** `("negotiation", "checkout_frontier")` — `packages/nest-plugins-reference/nest_plugins_reference/negotiation/checkout_frontier.py`, registered in `_BUILTINS` and as a `nest.plugins.negotiation` entry point.
- **Scenario** `checkout_market` — `scenarios/checkout_market.yaml` + `packages/nest-core/nest_core/scenarios_builtin/checkout_market.py`: 10 shopper-vendor pairs, scripted margin-only vendors quoting an early expedited "rush" lane, the configured plugin in the buyer seat, hard budgets and cost floors drawn per pair from the scenario seed.
- **Adversarial validators** — `validate_checkout_pareto_efficient` (no closed deal is Pareto-dominated by a *cap-feasible* bundle exchanged in the same session) and `validate_checkout_budget_and_floor` (no quote or deal crosses the quoting agent's own declared money cap). Both fail vacuous traces.
- **Tests** — 17 unit tests; 6 property tests (Hypothesis, 200 examples on the flagship dominance property, plus the pinned-counterexample and disjoint-caps cases); 16 validator/integration tests including the end-to-end discrimination gate on seeds 42/7/1337 and a byte-identical-trace determinism test.

## The mechanism, and the guarantee it buys

`CheckoutFrontier` layers one rule on top of classical monotonic concession (Keeney–Raiffa additive MAUT, Zeuthen aspiration decay, per-attribute patience, direction-reading trade-off): **best-standing-quote acceptance**. Every bundle the counterparty ever offered stays live; once the best cap-eligible one clears the aspiration floor, the agent accepts it if it is the offer on the table, or re-proposes it verbatim (the counterparty running the same rule accepts its own returning quote — one extra round, guaranteed convergence).

That changes the guarantee class. The merged `pareto` plugin (#30) documents its own boundary in `test_fsj_tradeoff_does_not_guarantee_pareto_optimality`: a Pareto-improving bundle offered early can be rejected while aspiration is high and be *gone* by the time aspiration decays — self-play can close a dominated deal, so its self-play guarantee was deliberately downgraded to individual rationality. Standing quotes remove the ephemerality: nothing generous ever expires. The flagship Hypothesis property — **no self-play agreement is Pareto-dominated by any cap-feasible bundle either side exchanged** — runs green at 200 examples, and a dedicated test replays PR #30's pinned counterexample configuration and settles it clean.

Supporting details that make the property hold and replay byte-identically: earliest-offer tie-breaks (under the counterparty's own concession, the earliest of equally-good-for-us quotes is best for *them*), acceptance only when the best standing quote *is* the current offer, fresh counters capped by the previous fresh counter's own utility, and all weights on a six-decimal lattice so no utility gap on the integer grid can fall inside the validators' `1e-9` epsilon.

Hard caps are constraints, not utility terms: a buyer never accepts, echoes, or proposes above `budget`; a vendor never goes below `floor`; with mutually exclusive caps the plugin declines to counter and the checkout breaks down honestly (`close` → `None`) instead of closing an unaffordable deal.

## Relationship to merged PR #30 (novelty delta)

This is the same problem statement (07) solved for a different regime, not a re-issue; nothing in #30 is modified and the two

…