@@ -30,7 +30,7 @@ Delegate only by these streams (`.github/audit/_preamble.md` -> "Work streams").
 
 - `actions` — `docs/specs/security-ci.md`: "GitHub Actions Policies", "Automated Maintainer (tend)".
 - `releases` — `docs/specs/security-ci.md`: "Hosted Deployments", "VS Code Extension Releases", "Desktop Releases".
-- `audit` — `docs/specs/security-audit.md`: "Schedule and gate", "Deterministic checks", "Skipping an unchanged audit", "Domains", "Orchestration", "Outcomes and reporting", "Findings", "Embargo", "Findings ledger", "Disclosure", "Environment and `AUDIT_PAT`", "Canary recall".
+- `audit` — `docs/specs/security-audit.md`: "Schedule and gate", "Deterministic checks", "Skipping an unchanged audit", "Domains", "Orchestration", "Outcomes and reporting", "Findings", "Embargo", "Findings ledger", "Disclosure", "Environment and `AUDIT_PAT`", "Canary recall", "Red team".
 - `qualitative` — the qualitative pass below, once, over the whole of this domain's scope.
 
 ## Qualitative pass
 
@@ -0,0 +1,113 @@
+name: codex-audit-report
+
+# Publishes the red team's report (docs/specs/security-audit.md -> "Red team"):
+# what a maintainer's `scripts/security-audit-local.sh --engine codex` run
+# computed, typed in as dispatch inputs. Nothing here runs a model or reads a
+# secret, and nothing here gates a release: release.yml waits on
+# security-audit.yaml alone. The inputs are non-secret by construction —
+# computed verdicts and counts, never a finding — and
+# `scripts/security-audit-public-body.mjs` checks each against its pattern,
+# and the counts against the CI canary run they share seeds with, before it
+# posts anything.
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: "The commit on main the Codex run audited (40-hex)"
+        type: string
+        required: true
+      model:
+        description: "The Codex model the run used"
+        type: string
+        required: true
+        default: gpt-6-sol
+      verdicts:
+        description: "Each domain's computed verdict: `domain=PASS|FAIL|INCONCLUSIVE …`; empty for a canary alone"
+        type: string
+        default: ""
+      canary_run:
+        description: "The CI canary run whose key seeded the Codex canary; empty for verdicts alone"
+        type: string
+        default: ""
+      canary_seeded:
+        description: "Seeds applied"
+        type: string
+        default: ""
+      canary_caught:
+        description: "Seeds Codex caught"
+        type: string
+        default: ""
+      canary_either:
+        description: "Seeds Claude or Codex caught"
+        type: string
+        default: ""
+      canary_unfinished:
+        description: "Codex domains that left no finished report"
+        type: string
+        default: ""
+
+run-name: codex-audit-report (advisory, not an audit)
+
+# Each job declares its own.
+permissions: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # `issues: write` for the one comment on the status issue; `actions: read`
+    # to read the CI canary run and download its `canary-recall`.
+    permissions:
+      contents: read
+      issues: write
+      actions: read
+    steps:
+      - name: Refuse any ref but main
+        run: |
+          [ "$GITHUB_REF" = refs/heads/main ] && exit 0
+          echo "::error::A red-team report publishes from main only."
+          exit 1
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: package.json
+
+      # Inputs reach the builder through the environment, never interpolated
+      # into the script. It refuses a dispatch by anyone but an admin.
+      - name: Publish the red-team report
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          COMMIT: ${{ inputs.commit }}
+          MODEL: ${{ inputs.model }}
+          VERDICTS: ${{ inputs.verdicts }}
+          CANARY_RUN: ${{ inputs.canary_run }}
+          CANARY_SEEDED: ${{ inputs.canary_seeded }}
+          CANARY_CAUGHT: ${{ inputs.canary_caught }}
+          CANARY_EITHER: ${{ inputs.canary_either }}
+          CANARY_UNFINISHED: ${{ inputs.canary_unfinished }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/codex-recall"
+          node scripts/security-audit-public-body.mjs --engine codex \
+            --date "$(date -u +%Y-%m-%dT%H:%MZ)" --run-url "$RUN_URL" \
+            --commit "$COMMIT" --model "$MODEL" --verdicts "$VERDICTS" \
+            --canary-run "$CANARY_RUN" --canary-seeded "$CANARY_SEEDED" \
+            --canary-caught "$CANARY_CAUGHT" --canary-either "$CANARY_EITHER" \
+            --canary-unfinished "$CANARY_UNFINISHED" \
+            --record "$RUNNER_TEMP/codex-recall/codex-recall.json"
+
+      # The counts website/scripts/generate-canary-recall.js reads beside the
+      # CI canary run's own `canary-recall`.
+      - name: Upload the red-team recall
+        if: inputs.canary_run != ''
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: codex-recall
+          path: ${{ runner.temp }}/codex-recall/codex-recall.json
+          retention-days: 90
+          if-no-files-found: error
@@ -21,6 +21,8 @@ Source of truth: `create_release` in `scripts/sign-and-deploy.sh`; `publish-vsco
 
 **Must ship a desktop release that carries, or changes, the one-time link version only after Hosted production serves that version** — its rendezvous routes and its `/connect/` page (`docs/specs/one-time.md` -> "Link"): run `.github/workflows/hosted-production.yml` first and confirm its live verification passed, `oneTimeSmoke` included. **Hosted must never stop serving a link version a shipped Burrow emits.**
 
+A release that changes remote control or Hosted runs the red team first (`docs/specs/security-audit.md` -> "Red team").
+
 Human-driven, in order:
 
 1. **Start a release branch** — from the main checkout, `wt switch --create release-next --base main`, then `pnpm install` in the new worktree; every later step runs there. **A release reaches `main` through one PR, never a direct push.**
 
@@ -44,8 +44,8 @@ Source of truth: `saveText` / `StorePath` in `dor-tools-builtin/src/editor-route
 `.md` and `.markdown` open in the bundled MDXEditor page; `.mdx` and other text stay in Monaco. Saving, reloading, and dirty reports follow [Editing files](#editing-files).
 
 - **Must resolve the viewer's direct `lexical` and `@lexical/link` imports to the same installed modules MDXEditor uses** (rationale).
-- **Must support GFM tables, task lists, frontmatter, code blocks, fenced `mermaid` diagrams, and a whole-document source mode**, which opens with the error when the rich editor cannot parse a file. Mermaid stays on 11 (rationale).
-- **Must keep HTML comments verbatim and save with one final newline, the file's majority bullet and thematic-break marker, and unpadded tables**; the rest follows MDXEditor's serialization. Its normalization of loaded text is not an edit (rationale).
+- **Must support GFM tables, task lists, frontmatter, code blocks, fenced `mermaid` diagrams, and a whole-document source mode**, which opens with the error when the rich editor cannot parse a file. **Must let source edits remain dirty and saveable after a parse error, and allow repaired source back into rich text.** Mermaid stays on 11 (rationale).
+- **Must keep HTML comments verbatim and save with one final newline, the file's majority bullet and thematic-break marker, and unpadded tables**. **Must retain simple standalone bracket labels, encode literal angle brackets in text as entities, and preserve recognized headings' existing blank-line choice**, with new or renamed headings following the majority style; ambiguous Markdown keeps the serializer's escapes. The rest follows MDXEditor's serialization. Its normalization of loaded text is not an edit (rationale).
 - **Never let document HTML reach the live DOM outside an allowlist** of tags and attributes, `href` limited to `http(s):`, `mailto:`, fragments, and scheme-less paths; saving keeps every original attribute, escaped, and HTML images serialize in an inert document. Mermaid diagrams are the one other path, under mermaid's own sanitizer (`docs/specs/security-local.md` → "Local-file viewer"; rationale).
 - **Must serve images on request from regular image-format files at or under the document's canonical directory**, by realpath, under a `sandbox` CSP. Nothing else loads, external URLs included.
 - **Never show an image at a size the document does not state**: unsized, it shows pixel for pixel, within the column. A pasted or dropped PNG or JPEG with a recorded scale goes in at its pixel width over that scale (rationale).
 
@@ -22,6 +22,8 @@ MDXEditor 4.3.3 depends on Lexical `^0.48.0`; independent direct bumps to 0.52 i
 
 MDXEditor 4.3 parses `<!-- … -->` and discards it, and trims and re-serializes the whole document on export; without the comment node and style detection, saving a typical README after a one-word edit deleted its comments and rewrote every `-` bullet as `*` (measured 2026-10).
 
+Issue #1254 (2026-10) exposed unconditional bracket escaping, literal angle brackets changing spelling across rich/source imports, and blank lines inserted after every heading. Serializer options keep simple labels and per-heading spacing without retaining a parallel source tree, while entity-encoding text brackets survives MDX JSX parsing. Code and HTML still use their own serializers. MDXEditor also leaves its initial-normalization flag set after a failed import; treating source changes as edits after that failure permits repair and save.
+
 Image sizes live in the document because GitHub shows an `<img>` without a `width` pixel for pixel: a Retina screenshot shown here at its recorded scale but left unsized in the file came out twice as large on GitHub. Writing the width on paste keeps the two renderings alike (2026-10).
 
 Image URLs carry a per-load generation because the browser keeps decoded images by URL: a reload that only remounted the editor still showed an image's old pixels after the file changed on disk (observed live, 2026-10).