Q:

GRE over IPSec Transport vs. Tunnel Mode

I have a misunderstanding, in this article, Figure 4-9, in Transport Mode, first header (IPsec Hdr), is correct? Should not be GRE IP Hdr?
https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/V3PN_SRND/V3PN_SRND/v3p_plan.html
https://www.cisco.com/c/dam/en/us/td/i/000001-100000/80001-85000/81001-82000/81613.ps/_jcr_content/renditions/81613.jpg

A:

No, it should not be GRE. 
In both cases as shown (IPSec tunnel mode and transport mode), it's always IPsec encrypting GRE (and whatever it may contain). 
Therefore, the outermost header has to be IPSec. 

