wai/extensions/determinism-tiers.md

@@ -69,6 +69,43 @@ conformant reconstructions, this tier fixes one.
 A capability satisfying `decode-equivalence` satisfies `entropy-consistency` by
 construction; the reverse does not hold.
 
+### What a tier covers
+
+A tier is a property of the **whole path from codestream to the medium that is
+hashed, bound, or presented** — not of the decode stage in isolation. A sink that
+decodes conformantly and then alters the result has not satisfied the tier,
+however faithful the decode itself was.
+
+This is not hypothetical. Two mechanisms in force today change the medium *after*
+a conformant decode, and both arrive through the same pipe as the codestream:
+
+- **Post-decode neural filters.** ITU-T H.274 (V4, 01/2026) `nnpfc` / `nnpfa` SEI
+  messages activate a neural post-filter after decoding, changing output pixels.
+  The filter may be named by URI or carried in-band.
+- **Operation-reduction hints.** ISO/IEC 23001-11 (green metadata) carries
+  decoding-operation-reduction metadata whose express purpose is to let a decoder
+  spend fewer joules by doing less work — deliberate degradation, signalled
+  in-band and invisible to a conformance check that stops at the decoder.
+
+The rules:
+
+- A sink claiming a tier MUST evaluate it over the medium it **emits**. If it
+  applies post-decode processing that alters that medium, it MUST either not
+  apply the processing, or MUST NOT claim the tier for the emitted result.
+- An object that honours a decoding-operation-reduction hint MUST NOT claim
+  `decode-equivalence`, and a receipt over its output MUST NOT carry a
+  reproducible decoded-medium hash. Spending fewer joules by computing less is a
+  fidelity choice; a receipt that reports the joules while concealing the
+  degradation states a cost without its consideration.
+- A capability's registration SHOULD state whether its payload can carry
+  post-decode processing directives at all. A capability whose payload cannot is
+  unaffected by this section, and saying so is cheaper than leaving it open.
+
+The general rule, which is why this section exists: **a determinism claim covers
+what the sink emits.** A hash over a decode that something later modified
+describes an artifact nobody saw — the hash verifies, and it attests the wrong
+thing.
+
 ## 3. Declaring and using a tier
 
 - A capability's registration (§5) states its tier via its `*-equivalence`
@@ -81,6 +118,9 @@ construction; the reverse does not hold.
   neither tier and MUST NOT claim `replicate`. A receipt that carries a
   reproducible decoded-medium hash MUST come from a `decode-equivalence`
   capability.
+- **Post-decode processing.** A tier claim is void if the sink alters the medium
+  after decode (§2, *What a tier covers*). This applies to the emitted result,
+  not to the decoder's internal conformance.
 - **Provenance.** The [reproducible-reconstruction binding](reconstruction-binding.md)
   — a C2PA / JPEG-Trust hard binding over decoded pixels — requires
   `decode-equivalence`; over an `entropy-consistency` capability only the