It might have been me that wrote this text wrong in the first place...

It is Recipient_structure that must be serialized deterministic just like Sig_structure and friends. The current text says it should be the COSE_Recipient headers.

I am working on a PR for this and related.