Hmm I can't find any special clauses in the carrot spec about legacy using a different path for change. But the legacy stuff is quite opaque and under-explained there.

<jeffro256> @ofrnxmr: Yes, assuming that the legacy wallet is the sender

<jeffro256> It's not about D_e sharing, it's about being able to calculate s_sr for the change enote as the receiver

<jeffro256> The math is here: monero-project/monero #115864

<jeffro256> But use X25519 instead of Ed25519, d_e instead of r, etc

<jeffro256> Knowing that receivers recover d_e during the scan process

I understand that part, but don't see the part that says 'legacy will use external selfsend for change'

<jeffro256> It's referenced as a "special" enote in the terminology

<jeffro256> But you're right that the spec doesn't specifically say that legacy will use external selfsend for change, but I figured that it was implied since the internal pathways only explicitly mentioned s_vb