On the web, we have a way to handle the exact equivalent to your scenario. We do that by ensuring the user agrees to go to the store before handing them over a scarf. For instance, on the protocol level, you could reject all GET requests that do not have attached the proof of acceptance of the cough medicine quest. The rejection message (e.g. 403 Forbidden) would contain a machine-interpretable requirement of the quest. That synergizes well with the legal level - faking proof of quest acceptance would (AFAIK) constitute unauthorized access to scarf under CFAA. At the same time, the valid proof could match the legal definition of informed consent. It also meshes well with the social level, as whoever reads the 403 response (e.g. in their browser) would see the need to consent to the quest in order to get the scarf. Consenting to the quest, taking the scarf, and then not doing the quest would rightfully classify me as a thief and an asshole.

Let me flip it on you. Let's say you bake me a cake and give it to me. The following week you say, "Hey, you need to go to the store and pick up some cough medicine for me, because I gave you that cake." If I then refuse, would it be valid for you to claim I stole your cake?

In your scarf example, I also probably indicated to you that I would accept those terms. Suppose that I told you, upfront, before you gave me the scarf, "No, I'm not going to pick up cough medicine for you, period. If you hand me this scarf, I'm still not going to the store."

If you still handed the scarf to me after I made it clear I wasn't going to the store and made no effort to take it from you by force, could you claim that I stole from you?

Funnily enough, the second scenario is not entirely fictional. I remember a particularly scummy practice that businesses used to do when I was growing up where they'd mail you an unsolicited physical item and then demand payment or return of the item.

I don't remember if it was illegal at the time or if it became illegal later, but the basic gist was "if you post something to another person in the mail, you can't later demand that they send it back to you or pay you."

On the modern web, I connect to the NYT to read some text, and they return a bunch of unsolicited code that I never agreed to request. The idea that I have the obligation to run code that I never requested from the server (literally, my ad blocker prevents the request from being made) when I never agreed to any terms surrounding that code is... crazy to me. In any other domain we would call that crazy.