@Anzus_GemWallet You are absolutely right on both points.
The bootstrapping problem is real. A minimal outer header (version | KDF id | bounded params) supplied as AEAD associated data is the correct way to do it — select KDF before decrypt, but still detect header tampering.
And yes, AEAD failure should be specified as authentication failed — the pre-KDF checksum is for catching transcription typos, it cannot prove wrong password vs corrupted ciphertext.
I think at this point the core problem is clear: we need an encrypted short backup for cold-storage, BIP-38 style, but for PQ SLH-DSA seeds, with a fixed-length, scannable, one-line = one-key sweep invariant.
I intentionally don’t want to go deeper into the byte layout alone. This should become a shared BIP, not my personal format. My proposal (pure 32-byte seed, prefix-agnostic BIP-360 compat, 104-char visual invariant) can be the starting point, but KDF bounds, header as AAD, failure semantics — that should be decided together by wallets.
If there is interest, I am happy to co-author or hand it over.