I finally understood that transaction malleability is just the by ECDSA allowed change of the signature which changes the TxID and segwit, with the signatures being outside of the transaction fixed it. it took me 3 books to realize