Legs are connected by the Crossover Point

One of the hops in the first header is marked as a crossover point

At the crossover point, we decrypt the second header with a hash of the payload, and then swap the headers.