docs: add message.path field conventions to Error Handling

The path field appears in examples throughout the spec but has no
prose explaining how to construct it. Add a conventions section under
Error Handling covering:

- RFC 9535 JSONPath, snake_case property names
- Simple field references, indexed array access, filter expressions
- Why filter expressions are preferred over index-based paths
- Specificity rule (field-level path beats parent-level)
- Create vs. Update keying difference (item.id vs line item id)

Complements PR #380 which fixes the schema descriptions on the
message_* types.

Author: ytheesoft

docs/specification/checkout.md

@@ -119,8 +119,10 @@ platform receives messages indicating what's needed to progress.
 The `messages` array contains errors, warnings, and informational messages
 about the checkout state. `ucp.status` is the shape discriminator —
 `"success"` means the response carries the expected payload, `"error"`
-means it carries error information instead. The `severity` field on each
-error message prescribes the recommended action:
+means it carries error information instead. Each message carries a `type`,
+`code`, `severity`, `content`, and an optional `path` that identifies the
+specific field or line item the message refers to (see [The `path` Field](#the-path-field) below).
+The `severity` field prescribes the recommended platform action:
 
 | Severity                | Meaning                                          | Platform Action                                                   |
 | :---------------------- | :----------------------------------------------- | :---------------------------------------------------------------- |
@@ -182,6 +184,7 @@ Businesses **SHOULD** surface such messages as early as possible, and platforms
       "type": "error",
       "code": "invalid_phone",
       "severity": "recoverable",
+      "path": "$.buyer.contact.phone",
       "content": "Phone number format is invalid"
     },
     {
@@ -219,7 +222,11 @@ IF unrecoverable is not empty
 
 IF recoverable is not empty
   FOR EACH error IN recoverable
-    ATTEMPT to fix error (e.g., reformat phone number)
+    IF error.path is present
+      IDENTIFY the field at error.path in the request payload
+      ATTEMPT to fix that field (e.g., reformat phone at $.buyer.contact.phone)
+    ELSE
+      ATTEMPT generic fix based on error.code
   CALL Update Checkout
   RETURN and re-evaluate response
 
@@ -250,6 +257,51 @@ messages or deferring to checkout completion.
 Example: `out_of_stock` requires specific upfront UX, whereas
 `payment_required` can be handled generically at submission.
 
+#### The `path` Field
+
+The optional `path` field on a message anchors the error to a specific
+component of the response payload. Platforms use it to associate error
+messages with the input field or line item that caused them - for example,
+highlighting a specific address field in a form or flagging a specific
+cart line.
+
+`path` **MUST** be an [RFC 9535](https://www.rfc-editor.org/rfc/rfc9535)
+JSONPath expression relative to the root of the UCP response object.
+Property names **MUST** use snake_case matching the request schema.
+
+**Simple field reference:**
+
+```json
+{ "path": "$.buyer.contact.email" }
+```
+
+**Indexed array element:**
+
+```json
+{ "path": "$.line_items[0].quantity" }
+```
+
+**Filter expression (preferred when referencing a specific item by ID):**
+
+```json
+{ "path": "$.line_items[?(@.id=='line-item-uuid')].quantity" }
+```
+
+Filter expressions are preferred over index-based paths when the platform
+may reorder line items between requests.
+
+**Specificity rule:** A path to a specific field (e.g.,
+`$.buyer.contact.email`) takes precedence over a path to its parent
+(e.g., `$.buyer.contact`). When multiple errors apply to the same field,
+each message **SHOULD** carry the most specific path applicable.
+
+**Create vs. Update keying:** On `create_checkout`, line item filter
+expressions key on `item.id` (the catalog item identifier). On
+`update_checkout`, they key on the line item's own `id` (the
+session-scoped line item identifier assigned in the create response).
+
+When `path` is omitted, the message applies to the response as a whole.
+
 #### Eligibility Verification at Completion
 
 Platforms provide `context.eligibility` — buyer claims about eligible benefits