I have a misunderstanding, in this article, Figure 4-9, in Transport Mode, first header (IPsec Hdr), is correct? Should not be GRE IP Hdr?
No, it should not be GRE.
In both cases as shown (IPSec tunnel mode and transport mode), it's always IPsec encrypting GRE (and whatever it may contain).
Therefore, the outermost header has to be IPSec.