diff --git a/testdata/legacy_transcript/README.md b/testdata/legacy_transcript/README.md
index 11c16cc58..18bb130e2 100644
--- a/testdata/legacy_transcript/README.md
+++ b/testdata/legacy_transcript/README.md
@@ -61,3 +61,101 @@ prunes nested modules from a parent module zip, while ordinary fixture files are
 part of the immutable module keep-core downloads. The pinned fixture therefore
 makes the historical identity independent of a developer's module cache without
 disappearing from the release artifact being qualified.
+
+## Mixed-binary legacy signing interop harness
+
+`verify.sh`'s oracle proves byte-for-byte proof compatibility from fixed,
+pre-recorded transcripts. It never runs an actual historical binary, so it
+cannot by itself prove that a *live* historical peer and a live current peer
+can complete a real signing exchange together. `verify_mixed_interop.sh`
+closes that gap: it drives a genuine two-process ECDSA signing ceremony
+between this checked-out (current) implementation and a subprocess running
+the pinned historical `threshold-network/tss-lib@2e712689` commit (the same
+commit qualified above), exchanging real GG18/GG20 round wire messages.
+
+```sh
+./testdata/legacy_transcript/verify_mixed_interop.sh
+```
+
+`historical_signer/main.go` is copied into a temporary module built from the
+same `historical/go.mod.fixture`/`historical/go.sum.fixture` pin as the
+oracle, exactly like `verify.sh`'s pattern. It drives one live historical
+`ecdsa/signing.LocalParty` (party index 1, "Bob") over a bounded,
+newline-delimited JSON protocol on stdin/stdout: `init`/`deliver`/`quit`
+commands in, `message`/`signature`/`error`/`turn_done` events out. No network
+access happens at run time; the pinned module must already be in the local
+module cache (the same precondition `verify.sh` has always had).
+
+`mixed_interop/main.go` (entry point/orchestration), `mixed_interop/peer.go`
+(subprocess wire protocol), `mixed_interop/scenarios.go` (scenario logic and
+per-proof verification), and `mixed_interop/homogeneous.go` (the control
+scenario) together implement the current-side driver (`go run` from the
+repository root, matching the oracle). For a fixed 2-of-20 `keygen_data_0/1`
+fixture pair, deterministic seeds, and a fixed message, they drive three
+scenarios:
+
+- **reject**: a current party with `tss.ProtocolModeLegacy` and the default
+  (off) `SetLegacyHistoricalBobCompatibility` opt asserts that round 3 fails
+  closed against the historical peer's live, real Bob/BobWC proof, whose T1
+  witness (recovered from the actual wire bytes via
+  `SignRound2Message.UnmarshalProofBob`/`UnmarshalProofBobWC`, not a
+  hand-picked value) is asserted to exceed the default tight `N + q^6` bound.
+  The rejection is additionally constrained structurally — never by parsing
+  the error string — to `tss.Error.Round() == 3`, the historical peer's
+  party ID present in `tss.Error.Culprits()`, and no round-3 message ever
+  emitted by the current party. Independently of the live round-3 failure,
+  the harness also re-verifies Bob's and BobWC's proofs *separately* (each
+  against its own compat-off/compat-on call to `ProofBob.VerifyLegacy` /
+  `ProofBobWC.VerifyLegacy`, using the actual captured wire proof and public
+  inputs — Alice's own Paillier key/Ring-Pedersen parameters, her round-1
+  ciphertext, Bob's round-2 response, and Bob's `PrepareForSigning`-derived
+  EC contribution): both must independently reject at the tight bound *and*
+  independently accept at the loose bound. This catches a regression where
+  only one of the two proof paths is correctly wired (e.g. Bob accepts the
+  widened bound but BobWC is left at the tight one, or vice versa), which an
+  aggregate round-3 pass/fail alone cannot distinguish.
+- **accept**: the identical exchange with `SetLegacyHistoricalBobCompatibility(true)`
+  set before construction; round 3 succeeds and the ceremony provably
+  continues through round 8 (both directions), proving the current party
+  didn't just tolerate the historical proof but kept advancing the protocol
+  with the historical peer afterward. The same independent per-proof
+  Bob/BobWC verification above is asserted here too (both accepting at the
+  loose bound).
+- **homogeneous-control**: two current-implementation parties, no historical
+  subprocess at all, complete the identical ceremony shape under the default
+  configuration — proof that "reject" above is specific to the historical
+  witness range and not a general legacy-mode defect. This scenario is never
+  substituted for the cross-version exchanges above.
+
+All three scenarios deliberately stop once a party's own round 8 message
+appears (never delivering a round-8-or-later message onward): this
+repository's own `round3Fixture` (`ecdsa/signing/round_3_test.go`) and
+`historicalBobProofForWitnessY`
+(`crypto/mta/legacy_bob_historical_witness_test.go`) already establish the
+precedent of driving a 2-of-20 minimal subset of the `test/_ecdsa_fixtures`
+keygen fixtures (threshold 1, not the fixture set's real threshold 10) for
+this exact class of round-level interop check. That minimal subset is
+sufficient for every per-peer MtA/Schnorr check through round 8 (each is a
+property of the two parties' own consistent local computation), but round 9's
+final aggregate check (`U == T`) verifies a *global* Shamir reconstruction
+identity that only holds for a correctly-sized threshold+1 co-signer set.
+Reaching a real, live-exchanged round 8 message already proves the historical
+Bob/BobWC witness was accepted and every subsequent round 3–8
+verification/decommitment step (Bob_end, the Gamma/Schnorr proofs, and both
+decommitments) succeeded against a genuine historical binary. Driving a full,
+globally-valid signature to completion is possible but requires
+`testThreshold+1` (11) correctly-thresholded co-signers rather than an
+arbitrary 2-of-20 subset — substantially more harness complexity for a
+property (global reconstruction validity) that is orthogonal to the specific
+Bob/BobWC compatibility mechanism this harness exists to exercise.
+
+The exact witness scalar values are not byte-reproducible run to run: signing
+round 2 (`ecdsa/signing/round_2.go`) draws the Bob and BobWC witnesses from
+two goroutines running concurrently against the process-global
+`crypto/rand.Reader`, so which goroutine consumes which slice of the
+deterministic keystream is scheduler-dependent. Every run nonetheless
+deterministically reproduces the *qualitative* property under test — a high
+witness that exceeds the tight bound, a closed-by-default rejection, and an
+opt-in acceptance that keeps progressing — which is what `verify_mixed_interop.sh`
+asserts and fails on.
+
diff --git a/testdata/legacy_transcript/historical_signer/main.go b/testdata/legacy_transcript/historical_signer/main.go
new file mode 100644
index 000000000..706a7dc59
--- /dev/null
+++ b/testdata/legacy_transcript/historical_signer/main.go
@@ -0,0 +1,229 @@
+// Command historical_signer drives a single historical (threshold-network/tss-lib@2e712689)
+// ECDSA signing party (index 1, the fixed "peer" role) through a live signing
+// ceremony, exchanging real GG18/GG20 round messages with a host process over
+// a bounded, newline-delimited JSON protocol on stdin/stdout.
+//
+// This file is compiled only inside the pinned historical module set up by
+// verify_mixed_interop.sh (go.mod.fixture replaces github.com/bnb-chain/tss-lib
+// with the exact threshold-network/tss-lib@2e712689 commit). It is never part
+// of the current module's build graph.
+//
+// Protocol (one JSON object per line):
+//
+//	host -> signer: {"cmd":"init","seed":"<label>","message_hex":"<hex>"}
+//	host -> signer: {"cmd":"deliver","is_broadcast":bool,"wire_hex":"<hex>"}
+//	host -> signer: {"cmd":"quit"}
+//
+//	signer -> host: {"event":"message","is_broadcast":bool,"wire_hex":"<hex>"}
+//	signer -> host: {"event":"signature","r_hex":"<hex>","s_hex":"<hex>"}
+//	signer -> host: {"event":"error","message":"<diagnostic text, not asserted on>"}
+//	signer -> host: {"event":"turn_done"}
+//
+// The signer always plays party index 1 in a fixed 2-of-2 ceremony built from
+// the existing test/_ecdsa_fixtures/keygen_data_{0,1}.json fixtures (byte
+// identical between this historical commit and current dev), so both sides
+// derive identical PartyIDs and key material independently without needing to
+// serialize either over the wire.
+package main
+
+import (
+	"bufio"
+	cryptorand "crypto/rand"
+	"crypto/sha512"
+	"encoding/binary"
+	"encoding/hex"
+	"encoding/json"
+	"math/big"
+	"os"
+	"sync"
+
+	"github.com/bnb-chain/tss-lib/common"
+	"github.com/bnb-chain/tss-lib/ecdsa/keygen"
+	"github.com/bnb-chain/tss-lib/ecdsa/signing"
+	"github.com/bnb-chain/tss-lib/tss"
+)
+
+// deterministicReader replays a fixed SHA-512 keystream derived from a label
+// so the historical prover's witness sampling (including the MtA blinding
+// value that becomes the Bob/BobWC T1 witness) is reproducible across runs.
+type deterministicReader struct {
+	seed    []byte
+	mu      sync.Mutex
+	counter uint64
+	buffer  []byte
+}
+
+// Read is safe for concurrent use: signing round 2 draws fresh MtA blinding
+// randomness for the Bob and BobWC proofs from two goroutines running
+// concurrently, both against the process-global crypto/rand.Reader this
+// function replaces. Serializing access to the counter/buffer keystream
+// state avoids torn reads that would otherwise corrupt both goroutines'
+// values.
+func (r *deterministicReader) Read(output []byte) (int, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	total := len(output)
+	for len(output) > 0 {
+		if len(r.buffer) == 0 {
+			counter := make([]byte, 8)
+			binary.BigEndian.PutUint64(counter, r.counter)
+			digest := sha512.Sum512(append(append([]byte{}, r.seed...), counter...))
+			r.buffer = digest[:]
+			r.counter++
+		}
+		copied := copy(output, r.buffer)
+		output = output[copied:]
+		r.buffer = r.buffer[copied:]
+	}
+	return total, nil
+}
+
+func fixedRandom(label string) {
+	cryptorand.Reader = &deterministicReader{seed: []byte("mixed-interop/" + label)}
+}
+
+type command struct {
+	Cmd         string `json:"cmd"`
+	Seed        string `json:"seed,omitempty"`
+	MessageHex  string `json:"message_hex,omitempty"`
+	IsBroadcast bool   `json:"is_broadcast,omitempty"`
+	WireHex     string `json:"wire_hex,omitempty"`
+}
+
+type event struct {
+	Event       string `json:"event"`
+	IsBroadcast bool   `json:"is_broadcast,omitempty"`
+	WireHex     string `json:"wire_hex,omitempty"`
+	Message     string `json:"message,omitempty"`
+	RHex        string `json:"r_hex,omitempty"`
+	SHex        string `json:"s_hex,omitempty"`
+}
+
+type signer struct {
+	out    chan tss.Message
+	end    chan common.SignatureData
+	party  tss.Party
+	peerID *tss.PartyID
+	writer *bufio.Writer
+	enc    *json.Encoder
+}
+
+func (s *signer) emit(e event) {
+	if err := s.enc.Encode(e); err != nil {
+		panic(err)
+	}
+	s.writer.Flush()
+}
+
+// drain flushes every currently-buffered outbound message and, if the
+// ceremony has finished, the resulting signature, as protocol events.
+func (s *signer) drain() {
+	for {
+		select {
+		case msg := <-s.out:
+			wire, _, err := msg.WireBytes()
+			if err != nil {
+				s.emit(event{Event: "error", Message: err.Error()})
+				continue
+			}
+			s.emit(event{Event: "message", IsBroadcast: msg.IsBroadcast(), WireHex: hex.EncodeToString(wire)})
+		case <-s.end:
+			// Unreachable in this harness's driven scenarios (the host
+			// deliberately never delivers enough rounds to reach
+			// completion; see mixed_interop/main.go's doc comment), kept
+			// only as a defensive completion signal. Not binding the
+			// received value avoids copying common.SignatureData (a
+			// protobuf message embedding a sync.Mutex) by value, matching
+			// this repository's own ecdsa/signing test convention of
+			// `case <-endCh:`.
+			s.emit(event{Event: "signature"})
+		default:
+			return
+		}
+	}
+}
+
+func main() {
+	reader := bufio.NewScanner(os.Stdin)
+	reader.Buffer(make([]byte, 0, 64*1024), 8*1024*1024)
+	writer := bufio.NewWriter(os.Stdout)
+	s := &signer{writer: writer, enc: json.NewEncoder(writer)}
+
+	// Restore the original entropy source on exit; only this process's
+	// signing-round randomness is made deterministic, and only for the
+	// lifetime of this subprocess.
+	origRand := cryptorand.Reader
+	defer func() { cryptorand.Reader = origRand }()
+
+	for reader.Scan() {
+		line := reader.Bytes()
+		if len(line) == 0 {
+			continue
+		}
+		var cmd command
+		if err := json.Unmarshal(line, &cmd); err != nil {
+			s.emit(event{Event: "error", Message: "invalid command json: " + err.Error()})
+			continue
+		}
+		switch cmd.Cmd {
+		case "init":
+			s.handleInit(cmd)
+			s.emit(event{Event: "turn_done"})
+		case "deliver":
+			s.handleDeliver(cmd)
+			s.emit(event{Event: "turn_done"})
+		case "quit":
+			return
+		default:
+			s.emit(event{Event: "error", Message: "unknown command: " + cmd.Cmd})
+			s.emit(event{Event: "turn_done"})
+		}
+	}
+}
+
+func (s *signer) handleInit(cmd command) {
+	fixedRandom(cmd.Seed)
+
+	keys, partyIDs, err := keygen.LoadKeygenTestFixtures(2)
+	if err != nil {
+		s.emit(event{Event: "error", Message: "load keygen fixtures: " + err.Error()})
+		return
+	}
+	s.peerID = partyIDs[0]
+
+	msg := new(big.Int)
+	if _, ok := msg.SetString(cmd.MessageHex, 16); !ok {
+		s.emit(event{Event: "error", Message: "invalid message hex"})
+		return
+	}
+
+	ctx := tss.NewPeerContext(partyIDs)
+	params := tss.NewParameters(tss.S256(), ctx, partyIDs[1], 2, 1)
+
+	s.out = make(chan tss.Message, 16)
+	s.end = make(chan common.SignatureData, 1)
+	s.party = signing.NewLocalParty(msg, params, keys[1], s.out, s.end)
+
+	if pErr := s.party.Start(); pErr != nil {
+		s.emit(event{Event: "error", Message: pErr.Error()})
+		return
+	}
+	s.drain()
+}
+
+func (s *signer) handleDeliver(cmd command) {
+	if s.party == nil {
+		s.emit(event{Event: "error", Message: "deliver before init"})
+		return
+	}
+	wireBytes, err := hex.DecodeString(cmd.WireHex)
+	if err != nil {
+		s.emit(event{Event: "error", Message: "invalid wire hex: " + err.Error()})
+		return
+	}
+	if _, pErr := s.party.UpdateFromBytes(wireBytes, s.peerID, cmd.IsBroadcast); pErr != nil {
+		s.emit(event{Event: "error", Message: pErr.Error()})
+		return
+	}
+	s.drain()
+}
diff --git a/testdata/legacy_transcript/mixed_interop/homogeneous.go b/testdata/legacy_transcript/mixed_interop/homogeneous.go
new file mode 100644
index 000000000..7ad11c01f
--- /dev/null
+++ b/testdata/legacy_transcript/mixed_interop/homogeneous.go
@@ -0,0 +1,91 @@
+package main
+
+import (
+	"encoding/hex"
+	"fmt"
+	"math/big"
+
+	"github.com/bnb-chain/tss-lib/common"
+	"github.com/bnb-chain/tss-lib/ecdsa/keygen"
+	"github.com/bnb-chain/tss-lib/ecdsa/signing"
+	"github.com/bnb-chain/tss-lib/tss"
+)
+
+// runHomogeneousControl drives the identical ceremony shape through round 8
+// with two current-implementation parties and no historical subprocess at
+// all, to demonstrate the default legacy path is otherwise fully functional
+// and that "reject" above is specific to the historical witness range.
+func runHomogeneousControl() (*scenarioResult, error) {
+	restore := fixedRandom("homogeneous-control")
+	defer restore()
+
+	keys, partyIDs, err := keygen.LoadKeygenTestFixtures(2)
+	if err != nil {
+		return nil, fmt.Errorf("load keygen fixtures: %w", err)
+	}
+	ec := tss.S256()
+
+	msg := new(big.Int)
+	msg.SetString(fixedMessageHex, 16)
+	msgBytes, _ := hex.DecodeString(fixedMessageHex)
+
+	ctx := tss.NewPeerContext(partyIDs)
+	outCh := make(chan tss.Message, 32)
+	endCh := make(chan common.SignatureData, 2)
+
+	parties := make([]tss.Party, 2)
+	for i := range parties {
+		params := tss.NewParameters(ec, ctx, partyIDs[i], 2, 1)
+		params.SetProtocolMode(tss.ProtocolModeLegacy)
+		parties[i] = signing.NewLocalParty(msg, params, keys[i], outCh, endCh, len(msgBytes))
+	}
+
+	for _, p := range parties {
+		if err := p.Start(); err != nil {
+			return nil, fmt.Errorf("homogeneous start: %w", err)
+		}
+	}
+
+	result := &scenarioResult{Name: "homogeneous-control"}
+
+pump:
+	for {
+		select {
+		case m := <-outCh:
+			// See runMixedScenario's doc comment: stop before forwarding a
+			// round-8-or-later message so neither party auto-cascades into
+			// round 9's global reconstruction check, which this minimal
+			// 2-of-20 fixture subset cannot satisfy.
+			if roundNumberOf(m) >= 8 {
+				result.ReachedRound8 = true
+				break pump
+			}
+			wireBytes, _, wErr := m.WireBytes()
+			if wErr != nil {
+				return nil, fmt.Errorf("homogeneous wire bytes: %w", wErr)
+			}
+			dest := m.GetTo()
+			if dest == nil {
+				for _, p := range parties {
+					if p.PartyID().Index == m.GetFrom().Index {
+						continue
+					}
+					if _, uErr := p.UpdateFromBytes(wireBytes, m.GetFrom(), true); uErr != nil {
+						return nil, fmt.Errorf("homogeneous update: %w", uErr)
+					}
+				}
+			} else {
+				if _, uErr := parties[dest[0].Index].UpdateFromBytes(wireBytes, m.GetFrom(), false); uErr != nil {
+					return nil, fmt.Errorf("homogeneous update: %w", uErr)
+				}
+			}
+		case <-endCh:
+			result.Completed = true
+		}
+		if result.ReachedRound8 {
+			break pump
+		}
+	}
+
+	return result, nil
+}
diff --git a/testdata/legacy_transcript/mixed_interop/main.go b/testdata/legacy_transcript/mixed_interop/main.go
new file mode 100644
index 000000000..2134e735d
--- /dev/null
+++ b/testdata/legacy_transcript/mixed_interop/main.go
@@ -0,0 +1,165 @@
+// Command mixed_interop drives a genuine mixed-binary legacy signing
+// ceremony between this checked-out (current) implementation and a
+// subprocess running the historical threshold-network/tss-lib@2e712689
+// commit, exchanging real GG18/GG20 round wire messages between the two
+// processes.
+//
+// It closes the mixed-binary assurance gap left by in-process fixtures
+// (crypto/mta/legacy_bob_historical_witness_test.go,
+// ecdsa/signing/round_3_test.go): those pin the *shape* of a historical
+// witness using this implementation's own prover equations, which proves the
+// verifier's bound math but never exercises an actual historical binary. This
+// program instead spawns the pinned historical commit as a child process (the
+// two versions share one Go module path and cannot be linked into one
+// binary), drives it through a live 2-of-2 signing ceremony opposite a
+// current-implementation party in ProtocolModeLegacy, and asserts on the
+// resulting behavior:
+//
+//   - "reject": the historical peer's real, live-drawn Bob/BobWC witness
+//     (MtA blinding value sampled below the Paillier modulus N, per the
+//     historical BobMid/BobMidWC) produces a round-2 proof whose T1 exceeds
+//     the default tight N+q^6 bound; a default-configured current party's
+//     round 3 must fail closed.
+//   - "accept": the same exchange, replayed against a fresh historical
+//     process with the identical deterministic seed (so the witness is
+//     provably the same shape), succeeds when the current party opts into
+//     SetLegacyHistoricalBobCompatibility(true), and the ceremony provably
+//     progresses: the current party emits its round-3 message, the
+//     historical peer accepts it, and the live exchange continues through
+//     round 8 in both directions (see runMixedScenario's doc comment for why
+//     full signature completion is intentionally out of scope here).
+//   - "homogeneous-control": two current-implementation parties (no
+//     historical subprocess at all) drive the same ceremony shape through
+//     round 8 under the default (non-opt-in) configuration, to make clear
+//     that "reject" is specific to the historical witness range and not a
+//     general legacy-mode defect. This scenario never claims a current-only
+//     run is a substitute for the cross-version exchange above.
+//
+// Usage: mixed_interop <historical-module-dir>
+//
+// <historical-module-dir> must contain a working `go run ./main.go` for
+// testdata/legacy_transcript/historical_signer/main.go, built against the
+// go.mod.fixture/go.sum.fixture pin (see verify_mixed_interop.sh).
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+)
+
+func main() {
+	if len(os.Args) != 2 {
+		fmt.Fprintln(os.Stderr, "Usage: mixed_interop <historical-module-dir>")
+		os.Exit(1)
+	}
+	histDir := os.Args[1]
+
+	results := map[string]interface{}{}
+
+	for _, cfg := range []struct {
+		name    string
+		seed    string
+		histDir string
+		compat  bool
+	}{
+		{"reject", "reject-seed", histDir, false},
+		{"accept", "accept-seed", histDir, true},
+	} {
+		result, err := runMixedScenario(cfg.name, cfg.seed, cfg.histDir, cfg.compat)
+		if err != nil {
+			results[cfg.name] = map[string]string{"error": err.Error()}
+			continue
+		}
+		results[cfg.name] = result
+	}
+
+	homCtrl, err := runHomogeneousControl()
+	if err != nil {
+		results["homogeneous-control"] = map[string]string{"error": err.Error()}
+	} else {
+		results["homogeneous-control"] = homCtrl
+	}
+	// Validate post-conditions: durable assertions about the protocol.
+	for name, res := range results {
+		switch r := res.(type) {
+		case *scenarioResult:
+			switch name {
+			case "reject":
+				if !r.DefaultRejected {
+					fmt.Printf("FAIL: %s: default-configured current party did not reject (compat off, live Bob/BobWC witness T1=%s, tight_bound=%s, above_tight=%v)\n",
+						name, r.WitnessBobT1, r.TightBound, r.AboveTightBound)
+					os.Exit(1)
+				}
+				if r.RejectionRound != 3 {
+					fmt.Printf("FAIL: %s: rejection was not at round 3 (tss.Error.Round()=%d)\n", name, r.RejectionRound)
+					os.Exit(1)
+				}
+				if r.RejectionPeerCulpritCount < 2 {
+					fmt.Printf("FAIL: %s: both production verifier failures did not name the historical peer (count=%d)\n", name, r.RejectionPeerCulpritCount)
+					os.Exit(1)
+				}
+				if r.AliceEmittedRound3 {
+					fmt.Printf("FAIL: %s: current party emitted a round-3 message despite rejecting\n", name)
+					os.Exit(1)
+				}
+				if r.BobProofOff {
+					fmt.Printf("FAIL: %s: Bob proof accepted at tight bound (compat off)\n", name)
+					os.Exit(1)
+				}
+				if r.BobWCProofOff {
+					fmt.Printf("FAIL: %s: BobWC proof accepted at tight bound (compat off)\n", name)
+					os.Exit(1)
+				}
+				if !r.AboveTightBound {
+					fmt.Printf("FAIL: %s: live Bob witness T1 not above tight bound (this scenario requires a high witness; re-run to get a fresh draw)\n", name)
+					os.Exit(1)
+				}
+				if !r.BobProofOn {
+					fmt.Printf("FAIL: %s: Bob proof not independently accepted with compat on (witness shape not confirmed valid)\n", name)
+					os.Exit(1)
+				}
+				if !r.BobWCProofOn {
+					fmt.Printf("FAIL: %s: BobWC proof not independently accepted with compat on (witness shape not confirmed valid)\n", name)
+					os.Exit(1)
+				}
+			case "accept":
+				if !r.Accepted {
+					fmt.Printf("FAIL: %s: opt-in current party did not accept and progress past round 3\n", name)
+					os.Exit(1)
+				}
+				if !r.AliceProgressed {
+					fmt.Printf("FAIL: %s: opt-in party did not progress\n", name)
+					os.Exit(1)
+				}
+				if !r.ReachedRound8 {
+					fmt.Printf("FAIL: %s: opt-in mixed ceremony did not progress through round 8\n", name)
+					os.Exit(1)
+				}
+				// Per-proof accept assertions
+				if !r.BobProofOn {
+					fmt.Printf("FAIL: %s: Bob proof not accepted with compat on\n", name)
+					os.Exit(1)
+				}
+				if !r.BobWCProofOn {
+					fmt.Printf("FAIL: %s: BobWC proof not accepted with compat on\n", name)
+					os.Exit(1)
+				}
+			case "homogeneous-control":
+				if !r.ReachedRound8 {
+					fmt.Printf("FAIL: %s: homogeneous control did not reach round 8\n", name)
+					os.Exit(1)
+				}
+			}
+		case map[string]string:
+			fmt.Printf("FAIL: %s: scenario returned an error: %s\n", name, r["error"])
+			os.Exit(1)
+		default:
+			fmt.Printf("FAIL: %s: unexpected result type %T\n", name, res)
+			os.Exit(1)
+		}
+	}
+
+	enc := json.NewEncoder(os.Stdout)
+	enc.Encode(map[string]interface{}{"results": results})
+}
diff --git a/testdata/legacy_transcript/mixed_interop/peer.go b/testdata/legacy_transcript/mixed_interop/peer.go
new file mode 100644
index 000000000..0c31768f0
--- /dev/null
+++ b/testdata/legacy_transcript/mixed_interop/peer.go
@@ -0,0 +1,83 @@
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+)
+
+// ---- subprocess wire protocol ----
+
+type command struct {
+	Cmd         string `json:"cmd"`
+	Seed        string `json:"seed,omitempty"`
+	MessageHex  string `json:"message_hex,omitempty"`
+	IsBroadcast bool   `json:"is_broadcast,omitempty"`
+	WireHex     string `json:"wire_hex,omitempty"`
+}
+
+type event struct {
+	Event       string `json:"event"`
+	IsBroadcast bool   `json:"is_broadcast,omitempty"`
+	WireHex     string `json:"wire_hex,omitempty"`
+	Message     string `json:"message,omitempty"`
+	RHex        string `json:"r_hex,omitempty"`
+	SHex        string `json:"s_hex,omitempty"`
+}
+
+type historicalPeer struct {
+	cmd    *exec.Cmd
+	stdin  *json.Encoder
+	stdout *bufio.Scanner
+}
+
+func spawnHistoricalPeer(dir string) (*historicalPeer, error) {
+	cmd := exec.Command("go", "run", "-mod=readonly", "./main.go")
+	cmd.Dir = dir
+	cmd.Stderr = os.Stderr
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, err
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+	scanner := bufio.NewScanner(stdout)
+	scanner.Buffer(make([]byte, 0, 64*1024), 8*1024*1024)
+	return &historicalPeer{cmd: cmd, stdin: json.NewEncoder(stdin), stdout: scanner}, nil
+}
+
+func (h *historicalPeer) send(c command) error {
+	return h.stdin.Encode(c)
+}
+
+// readTurn reads events until (and excluding) a "turn_done" sentinel.
+func (h *historicalPeer) readTurn() ([]event, error) {
+	var events []event
+	for h.stdout.Scan() {
+		line := h.stdout.Bytes()
+		if len(line) == 0 {
+			continue
+		}
+		var e event
+		if err := json.Unmarshal(line, &e); err != nil {
+			return events, fmt.Errorf("decode historical event: %w", err)
+		}
+		if e.Event == "turn_done" {
+			return events, nil
+		}
+		events = append(events, e)
+	}
+	return events, fmt.Errorf("historical subprocess closed stdout before turn_done")
+}
+
+func (h *historicalPeer) quit() {
+	_ = h.send(command{Cmd: "quit"})
+	_ = h.cmd.Wait()
+}
diff --git a/testdata/legacy_transcript/mixed_interop/scenarios.go b/testdata/legacy_transcript/mixed_interop/scenarios.go
new file mode 100644
index 000000000..75449352e
--- /dev/null
+++ b/testdata/legacy_transcript/mixed_interop/scenarios.go
@@ -0,0 +1,443 @@
+package main
+
+import (
+	"crypto/elliptic"
+	"crypto/sha512"
+	"encoding/binary"
+	"encoding/hex"
+	"fmt"
+	"math/big"
+	"sync"
+
+	cryptorand "crypto/rand"
+
+	"github.com/bnb-chain/tss-lib/common"
+	"github.com/bnb-chain/tss-lib/crypto"
+	"github.com/bnb-chain/tss-lib/crypto/mta"
+	"github.com/bnb-chain/tss-lib/crypto/paillier"
+	"github.com/bnb-chain/tss-lib/ecdsa/keygen"
+	"github.com/bnb-chain/tss-lib/ecdsa/signing"
+	"github.com/bnb-chain/tss-lib/tss"
+)
+
+// ---- deterministic randomness (host side) ----
+
+type deterministicReader struct {
+	seed    []byte
+	mu      sync.Mutex
+	counter uint64
+	buffer  []byte
+}
+
+// Read is safe for concurrent use: this implementation's signing rounds draw
+// fresh MtA blinding randomness for a peer's Bob and BobWC proofs from two
+// goroutines running concurrently (round_2.go), and both draw from the
+// process-global crypto/rand.Reader this function replaces. Serializing
+// access to the counter/buffer keystream state avoids torn reads that would
+// otherwise corrupt both goroutines' values.
+func (r *deterministicReader) Read(output []byte) (int, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	total := len(output)
+	for len(output) > 0 {
+		if len(r.buffer) == 0 {
+			counter := make([]byte, 8)
+			binary.BigEndian.PutUint64(counter, r.counter)
+			digest := sha512.Sum512(append(append([]byte{}, r.seed...), counter...))
+			r.buffer = digest[:]
+			r.counter++
+		}
+		copied := copy(output, r.buffer)
+		output = output[copied:]
+		r.buffer = r.buffer[copied:]
+	}
+	return total, nil
+}
+
+func fixedRandom(label string) func() {
+	original := cryptorand.Reader
+	cryptorand.Reader = &deterministicReader{seed: []byte("mixed-interop/" + label)}
+	return func() { cryptorand.Reader = original }
+}
+
+// ---- scenario machinery ----
+
+// roundNumberOf identifies the signing-round number of a message purely from
+// its concrete protobuf content type, never from error text or any other
+// source-derived string.
+func roundNumberOf(m tss.Message) int {
+	pm, ok := m.(tss.ParsedMessage)
+	if !ok {
+		return 0
+	}
+	switch pm.Content().(type) {
+	case *signing.SignRound1Message1, *signing.SignRound1Message2:
+		return 1
+	case *signing.SignRound2Message:
+		return 2
+	case *signing.SignRound3Message:
+		return 3
+	case *signing.SignRound4Message:
+		return 4
+	case *signing.SignRound5Message:
+		return 5
+	case *signing.SignRound6Message:
+		return 6
+	case *signing.SignRound7Message:
+		return 7
+	case *signing.SignRound8Message:
+		return 8
+	case *signing.SignRound9Message:
+		return 9
+	default:
+		return 0
+	}
+}
+
+type scenarioResult struct {
+	Name string `json:"name"`
+	// Behavioral: default rejection. RejectionRound and the peer culprit count
+	// come from *tss.Error's structured Round()/Culprits() accessors, never
+	// from parsing RejectionErr's text. Both round-3 verifier goroutines must
+	// independently attribute their failure to the historical peer.
+	DefaultRejected           bool   `json:"default_rejected"`
+	RejectionRound            int    `json:"rejection_round,omitempty"`
+	RejectionPeerCulpritCount int    `json:"rejection_peer_culprit_count"`
+	AliceEmittedRound3        bool   `json:"alice_emitted_round3"`
+	RejectionErr              string `json:"rejection_err,omitempty"`
+	// Behavioral: acceptance/progress
+	Accepted        bool `json:"accepted"`
+	AliceProgressed bool `json:"alice_progressed"`
+	ReachedRound8   bool `json:"reached_round_8"`
+	Completed       bool `json:"completed"`
+	// Per-proof verification: tight bound
+	WitnessBobT1    string `json:"witness_bob_t1,omitempty"`
+	WitnessBobWCT1  string `json:"witness_bob_wc_t1,omitempty"`
+	TightBound      string `json:"tight_bound,omitempty"`
+	AboveTightBound bool   `json:"above_tight_bound"`
+	// Per-proof assertions (independent Bob vs BobWC, compat off vs on)
+	BobProofOff   bool `json:"bob_proof_off"`
+	BobWCProofOff bool `json:"bob_wc_proof_off"`
+	BobProofOn    bool `json:"bob_proof_on"`
+	BobWCProofOn  bool `json:"bob_wc_proof_on"`
+}
+
+const fixedMessageHex = "00f163ee51bcaeff9cdff5e0e3c1a646abd19885fffbab0b3b4236e0cf95c9f5"
+
+// verifyBobProof calls ProofBob.VerifyLegacy against the given public inputs,
+// with the compat flag set to the supplied value. Returns true iff the proof
+// verifies successfully.
+func verifyBobProof(pf *mta.ProofBob, ec elliptic.Curve, pk *paillier.PublicKey,
+	NTilde, h1, h2, c1, c2 *big.Int, compat bool) bool {
+	if pf == nil {
+		return false
+	}
+	return pf.VerifyLegacy(ec, pk, NTilde, h1, h2, c1, c2, compat)
+}
+
+// verifyBobWCProof calls ProofBobWC.VerifyLegacy against the given public
+// inputs, with the compat flag set to the supplied value. Returns true iff the
+// proof verifies successfully.
+func verifyBobWCProof(pf *mta.ProofBobWC, ec elliptic.Curve, pk *paillier.PublicKey,
+	NTilde, h1, h2, c1, c2 *big.Int, B *crypto.ECPoint, compat bool) bool {
+	if pf == nil || pf.ProofBob == nil || B == nil {
+		return false
+	}
+	return pf.VerifyLegacy(ec, pk, NTilde, h1, h2, c1, c2, B, compat)
+}
+
+// verifyPerProofIndependently extracts Bob's captured round-2 message and
+// verifies the Bob and BobWC proofs independently (each against its own
+// tight/loose compat flag), storing the four results on result. Called from
+// every exit path of runMixedScenario — including the early return on
+// rejection — since capturedBobR2/aliceCA are already fully populated by the
+// time round 3 verification runs; skipping this on the rejection path would
+// silently leave the four fields at their zero value instead of reporting a
+// genuine verification outcome.
+func verifyPerProofIndependently(result *scenarioResult, capturedBobR2 *signing.SignRound2Message, aliceCA *big.Int, keys []keygen.LocalPartySaveData, partyIDs tss.SortedPartyIDs, ec elliptic.Curve) {
+	if capturedBobR2 == nil || aliceCA == nil {
+		return
+	}
+	pfBob, _ := capturedBobR2.UnmarshalProofBob()
+	pfBobWC, _ := capturedBobR2.UnmarshalProofBobWC(ec)
+
+	// ProofBob and ProofBobWC public inputs, per the exact call convention
+	// in ecdsa/signing/round_3.go's Alice_end/Alice_end_wc goroutines: the
+	// MtA scheme runs entirely under Alice's own Paillier key and
+	// Ring-Pedersen parameters (Bob homomorphically operates on Alice's
+	// ciphertext and proves he did so correctly against Alice's trusted
+	// setup, which only Alice can verify).
+	// - pk = Alice's OWN Paillier public key (not Bob's)
+	// - NTilde, h1, h2 = Alice's own Ring-Pedersen parameters
+	// - c1 = Alice's own round-1 MtA ciphertext to Bob (cA; shared by both
+	//   proofs)
+	// - c2 = Bob's round-2 response for that specific proof: C1 for Bob,
+	//   C2 for BobWC (per NewSignRound2Message's field order)
+	// - B = Bob's EC contribution, the same public value round_3.go's
+	//   bigWs[j] resolves to via PrepareForSigning
+	bobIdx := partyIDs[1].Index
+	aliceIdx := partyIDs[0].Index
+
+	pkAlice := keys[aliceIdx].PaillierPKs[aliceIdx]
+	NTildeA := keys[aliceIdx].NTildei
+	h1A := keys[aliceIdx].H1i
+	h2A := keys[aliceIdx].H2i
+	cBBob := new(big.Int).SetBytes(capturedBobR2.GetC1())
+	cBBobWC := new(big.Int).SetBytes(capturedBobR2.GetC2())
+
+	// B must be Alice's own PrepareForSigning-derived bigWs[bobIdx], not a
+	// raw BigXj[bobIdx]: PrepareForSigning applies a Lagrange scalar
+	// multiplication across every party's Shamir share (prepare.go), and
+	// the party count it must use is the *signing session's* party count
+	// (2), not the fixture file's underlying 20-party keygen ceremony.
+	// Production's NewLocalPartyWithKDD reslices to the session's party
+	// count via keygen.BuildLocalSaveDataSubset before ever calling
+	// PrepareForSigning (see ecdsa/signing/local_party.go); replaying
+	// PrepareForSigning against the raw, un-resliced 20-party fixture data
+	// would silently compute the wrong Lagrange coefficients.
+	aliceSubset := keygen.BuildLocalSaveDataSubset(keys[aliceIdx], partyIDs)
+	var B *crypto.ECPoint
+	if _, bigWs, pfsErr := signing.PrepareForSigning(
+		ec, aliceIdx, len(aliceSubset.Ks), aliceSubset.Xi,
+		aliceSubset.Ks, aliceSubset.BigXj,
+	); pfsErr == nil && bobIdx < len(bigWs) {
+		B = bigWs[bobIdx]
+	}
+
+	result.BobProofOff = pfBob != nil && verifyBobProof(pfBob, ec, pkAlice, NTildeA, h1A, h2A, aliceCA, cBBob, false)
+	result.BobProofOn = pfBob != nil && verifyBobProof(pfBob, ec, pkAlice, NTildeA, h1A, h2A, aliceCA, cBBob, true)
+
+	if B != nil {
+		result.BobWCProofOff = pfBobWC != nil && verifyBobWCProof(pfBobWC, ec, pkAlice, NTildeA, h1A, h2A, aliceCA, cBBobWC, B, false)
+		result.BobWCProofOn = pfBobWC != nil && verifyBobWCProof(pfBobWC, ec, pkAlice, NTildeA, h1A, h2A, aliceCA, cBBobWC, B, true)
+	}
+}
+
+// runMixedScenario drives one live ceremony between a current-implementation
+// Alice (party index 0, in this process) and a historical subprocess Bob
+// (party index 1), asserting the given compatibility configuration.
+//
+// The exchange is deliberately bounded to round 8: this repository's own
+// existing round3Fixture (ecdsa/signing/round_3_test.go) and
+// historicalBobProofForWitnessY (crypto/mta/legacy_bob_historical_witness_test.go)
+// already establish the precedent of driving a 2-of-20 minimal subset of the
+// test/_ecdsa_fixtures keygen fixtures (threshold=1, not the fixture set's
+// real threshold=10) for exactly this kind of round-level interop check.
+// That minimal subset is sufficient for every per-peer MtA/Schnorr check
+// through round 8 (each is a property of the two parties' own consistent
+// local computation), but round 9's final aggregate check (U == T) verifies
+// a *global* Shamir reconstruction identity that only holds for a
+// correctly-sized threshold+1 co-signer set. Reaching a real, live-exchanged
+// round 8 message already proves the historical Bob/BobWC witness was
+// accepted and every subsequent round-3..8 verification/decommitment step
+// (Bob_end, the Gamma/Schnorr proofs, and both decommitments) succeeded
+// against a genuine historical binary; deliberately stopping there avoids an
+// unrelated, expected reconstruction mismatch rather than masking a real one.
+func runMixedScenario(name, seedSuffix string, historicalDir string, compat bool) (*scenarioResult, error) {
+	restore := fixedRandom("alice-" + seedSuffix)
+	defer restore()
+
+	keys, partyIDs, err := keygen.LoadKeygenTestFixtures(2)
+	if err != nil {
+		return nil, fmt.Errorf("load keygen fixtures: %w", err)
+	}
+	ec := tss.S256()
+	alicePK := &keys[0].PaillierSK.PublicKey
+	q := ec.Params().N
+	q3 := new(big.Int).Mul(q, q)
+	q3 = new(big.Int).Mul(q, q3)
+	q6 := new(big.Int).Mul(q3, q3)
+	tightBound := new(big.Int).Add(alicePK.N, q6)
+
+	ctx := tss.NewPeerContext(partyIDs)
+	params := tss.NewParameters(ec, ctx, partyIDs[0], 2, 1)
+	params.SetProtocolMode(tss.ProtocolModeLegacy)
+	if compat {
+		params.SetLegacyHistoricalBobCompatibility(true)
+	}
+
+	msg := new(big.Int)
+	msg.SetString(fixedMessageHex, 16)
+	msgBytes, _ := hex.DecodeString(fixedMessageHex)
+
+	outCh := make(chan tss.Message, 16)
+	endCh := make(chan common.SignatureData, 1)
+	alice := signing.NewLocalParty(msg, params, keys[0], outCh, endCh, len(msgBytes))
+
+	peer, err := spawnHistoricalPeer(historicalDir)
+	if err != nil {
+		return nil, fmt.Errorf("spawn historical peer: %w", err)
+	}
+	defer peer.quit()
+
+	if err := peer.send(command{Cmd: "init", Seed: "bob-" + seedSuffix, MessageHex: fixedMessageHex}); err != nil {
+		return nil, fmt.Errorf("send init: %w", err)
+	}
+	peerEvents, err := peer.readTurn()
+	if err != nil {
+		return nil, fmt.Errorf("read historical init turn: %w", err)
+	}
+
+	if err := alice.Start(); err != nil {
+		return nil, fmt.Errorf("alice start: %w", err)
+	}
+
+	result := &scenarioResult{Name: name, TightBound: tightBound.Text(16)}
+
+	var pendingToBob []tss.Message
+	var pendingToAlice []event
+	// aliceCA captures Alice's own round-1 MtA ciphertext to Bob (the "cA"
+	// input shared by both the Bob and BobWC per-proof verifications
+	// below); it is not otherwise observable from Bob's round-2 message.
+	var aliceCA *big.Int
+
+	drainOut := func() {
+		for {
+			select {
+			case m := <-outCh:
+				if roundNumberOf(m) == 3 {
+					result.AliceEmittedRound3 = true
+				}
+				if roundNumberOf(m) >= 8 {
+					result.ReachedRound8 = true
+				}
+				if aliceCA == nil {
+					if pm, ok := m.(tss.ParsedMessage); ok {
+						if r1msg1, ok := pm.Content().(*signing.SignRound1Message1); ok {
+							aliceCA = r1msg1.UnmarshalC()
+						}
+					}
+				}
+				pendingToBob = append(pendingToBob, m)
+			case <-endCh:
+				result.Completed = true
+			default:
+				return
+			}
+		}
+	}
+	drainOut()
+	pendingToAlice = append(pendingToAlice, peerEvents...)
+
+	// captureRound2 captures the first historical Bob round-2 message and
+	// records the raw T1 scalar values for each proof.
+	var capturedBobR2 *signing.SignRound2Message
+
+	captureWitness := func(e event) {
+		if capturedBobR2 != nil {
+			return
+		}
+		wireBytes, decErr := hex.DecodeString(e.WireHex)
+		if decErr != nil {
+			return
+		}
+		parsed, parseErr := tss.ParseWireMessage(wireBytes, partyIDs[1], e.IsBroadcast)
+		if parseErr != nil {
+			return
+		}
+		r2msg, ok := parsed.Content().(*signing.SignRound2Message)
+		if !ok {
+			return
+		}
+		capturedBobR2 = r2msg
+		bob, bErr := r2msg.UnmarshalProofBob()
+		if bErr == nil && bob != nil {
+			result.WitnessBobT1 = bob.T1.Text(16)
+			result.AboveTightBound = bob.T1.Cmp(tightBound) >= 0
+		}
+		bobWC, wcErr := r2msg.UnmarshalProofBobWC(ec)
+		if wcErr == nil && bobWC != nil {
+			result.WitnessBobWCT1 = bobWC.T1.Text(16)
+			if bobWC.T1.Cmp(tightBound) < 0 {
+				result.AboveTightBound = false
+			}
+		}
+	}
+
+pump:
+	for len(pendingToBob) > 0 || len(pendingToAlice) > 0 {
+		for _, m := range pendingToBob {
+			if result.ReachedRound8 {
+				break pump
+			}
+			wireBytes, _, wErr := m.WireBytes()
+			if wErr != nil {
+				return nil, fmt.Errorf("alice wire bytes: %w", wErr)
+			}
+			if sErr := peer.send(command{Cmd: "deliver", IsBroadcast: m.IsBroadcast(), WireHex: hex.EncodeToString(wireBytes)}); sErr != nil {
+				return nil, fmt.Errorf("send deliver to historical peer: %w", sErr)
+			}
+			events, rErr := peer.readTurn()
+			if rErr != nil {
+				return nil, fmt.Errorf("read historical peer turn: %w", rErr)
+			}
+			for _, e := range events {
+				switch e.Event {
+				case "message":
+					pendingToAlice = append(pendingToAlice, e)
+				case "signature":
+				case "error":
+					return nil, fmt.Errorf("historical peer reported an unexpected error: %s", e.Message)
+				}
+			}
+		}
+		pendingToBob = nil
+
+		toDeliver := pendingToAlice
+		pendingToAlice = nil
+		for _, e := range toDeliver {
+			if result.ReachedRound8 {
+				break
+			}
+			captureWitness(e)
+			wireBytes, decErr := hex.DecodeString(e.WireHex)
+			if decErr != nil {
+				return nil, fmt.Errorf("decode historical wire hex: %w", decErr)
+			}
+			if parsed, pErr := tss.ParseWireMessage(wireBytes, partyIDs[1], e.IsBroadcast); pErr == nil {
+				if roundNumberOf(parsed) >= 8 {
+					result.ReachedRound8 = true
+					break
+				}
+			}
+			ok, aErr := alice.UpdateFromBytes(wireBytes, partyIDs[1], e.IsBroadcast)
+			if aErr != nil {
+				result.DefaultRejected = true
+				result.RejectionErr = aErr.Error()
+				// Structural (non-text) constraints on the rejection: it
+				// must be tss.Error's own Round()==3, and both production
+				// verifier failures must attribute the historical peer.
+				result.RejectionRound = aErr.Round()
+				for _, culprit := range aErr.Culprits() {
+					if culprit.Index == partyIDs[1].Index {
+						result.RejectionPeerCulpritCount++
+					}
+				}
+				// UpdateFromBytes may enqueue output before returning an
+				// error. Observe that output before asserting fail-closed.
+				drainOut()
+				verifyPerProofIndependently(result, capturedBobR2, aliceCA, keys, partyIDs, ec)
+				return result, nil
+			}
+			_ = ok
+			result.AliceProgressed = true
+		}
+		drainOut()
+		if result.ReachedRound8 {
+			break pump
+		}
+	}
+
+	// Per-proof independent verification: extract Bob's round-2 message
+	// from the pump's captured state, unmarshal each proof, and verify
+	// them independently with compat=false and compat=true. This asserts
+	// that each proof individually (Bob and BobWC) rejects at the tight
+	// bound and accepts at the loose bound, catching a regression where
+	// only one proof path is correctly wired.
+	verifyPerProofIndependently(result, capturedBobR2, aliceCA, keys, partyIDs, ec)
+
+	if compat {
+		result.Accepted = true
+	}
+	return result, nil
+}
diff --git a/testdata/legacy_transcript/verify_mixed_interop.sh b/testdata/legacy_transcript/verify_mixed_interop.sh
new file mode 100755
index 000000000..69b618fa3
--- /dev/null
+++ b/testdata/legacy_transcript/verify_mixed_interop.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+#
+# Runs the mixed-binary legacy signing interop harness: a live, two-process
+# ECDSA signing ceremony between this checked-out (current) implementation
+# and a subprocess running the pinned historical threshold-network/tss-lib@
+# 2e712689 commit (the same commit qualified by verify.sh's oracle vectors).
+#
+# Unlike verify.sh's oracle, which replays fixed, pre-recorded proof
+# transcripts, this script drives an actual live historical LocalParty
+# through a real signing round exchange and asserts on its behavior:
+#
+#   - the historical peer's real, live-drawn Bob/BobWC witness (sampled below
+#     the Paillier modulus N, per the historical BobMid/BobMidWC) produces a
+#     round-2 proof whose T1 exceeds the default tight N+q^6 bound;
+#   - a default-configured current party's round 3 fails closed against it;
+#   - a current party with SetLegacyHistoricalBobCompatibility(true) accepts
+#     the identical exchange and provably progresses (through round 8; see
+#     testdata/legacy_transcript/mixed_interop/main.go's doc comment for why
+#     full signature completion is out of scope for this specific check);
+#   - a homogeneous (current-only) control completes the same shape, so the
+#     rejection above is never mistaken for a general legacy-mode defect.
+#
+# See testdata/legacy_transcript/README.md for the full design rationale.
+set -euo pipefail
+
+data_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repository_root="$(cd "${data_dir}/../.." && pwd)"
+historical_module="$(mktemp -d "${TMPDIR:-/tmp}/tss-mixed-interop.XXXXXX")"
+trap 'chmod -R u+w "${historical_module}" 2>/dev/null || true; rm -rf "${historical_module}"' EXIT
+
+cp "${data_dir}/historical/go.mod.fixture" "${historical_module}/go.mod"
+cp "${data_dir}/historical/go.sum.fixture" "${historical_module}/go.sum"
+cp "${data_dir}/historical_signer/main.go" "${historical_module}/main.go"
+
+(
+  cd "${repository_root}"
+  go run ./testdata/legacy_transcript/mixed_interop "${historical_module}"
+)