diff --git a/tests/samourai-crew/run_tests.sh b/tests/samourai-crew/run_tests.sh
index beda8cc..f854465 100755
--- a/tests/samourai-crew/run_tests.sh
+++ b/tests/samourai-crew/run_tests.sh
@@ -173,8 +173,7 @@ if [ "$MODE" = "one-shot" ] || [ "$MODE" = "all" ]; then
     run_test "audit_byteslice"           /tests/audit/audit_byteslice.sh
     run_test "audit_array_alias"         /tests/audit/audit_array_alias.sh
     run_test "audit_var_init_order"      /tests/audit/audit_var_init_order.sh
-    run_test "audit_cross_realm_recover" /tests/audit/audit_cross_realm_recover.sh \
-        "broader pattern not yet fixed, see f87249327"
+    run_test "audit_cross_realm_recover" /tests/audit/audit_cross_realm_recover.sh
 
     echo ""
     echo "=== E2E Tests (one-shot) ==="
@@ -182,17 +181,17 @@ if [ "$MODE" = "one-shot" ] || [ "$MODE" = "all" ]; then
     run_test "e2e_mempool_stress" /tests/e2e/e2e_mempool_stress.sh
 
     echo ""
-    echo "=== Security Markdown Audit (KNOWN VULNERABLE — gnolang/gno#5714) ==="
+    echo "=== Security Markdown Audit (PR #5714 merged — sanitize library opt-in) ==="
     run_test "audit_md_title_leak"     /tests/security-markdown/audit_md_title_leak.sh \
-        "Render() returns unsanitized title, see gnolang/gno#5714"
+        "naive realm without sanitize.InlineText — unsafe pattern documented, see gnolang/gno#5714"
     run_test "audit_md_html_inject"    /tests/security-markdown/audit_md_html_inject.sh \
-        "Render() returns raw HTML tag, see gnolang/gno#5714"
+        "naive realm without sanitize.Block — unsafe pattern documented, see gnolang/gno#5714"
     run_test "audit_md_link_hijack"    /tests/security-markdown/audit_md_link_hijack.sh \
-        "Render() returns hijacked link URL, see gnolang/gno#5714"
+        "naive realm without sanitize.URL — unsafe pattern documented, see gnolang/gno#5714"
     run_test "audit_md_blockquote"     /tests/security-markdown/audit_md_blockquote.sh \
-        "Render() returns injected blockquote, see gnolang/gno#5714"
+        "naive realm without sanitize.Block — unsafe pattern documented, see gnolang/gno#5714"
     run_test "audit_md_image_tracking" /tests/security-markdown/audit_md_image_tracking.sh \
-        "Render() returns external image URL, see gnolang/gno#5714"
+        "naive realm without sanitize.ImageURL — unsafe pattern documented, see gnolang/gno#5714"
 
     echo ""
     echo "=== Stress Tests ==="
diff --git a/tests/samourai-crew/security-markdown/audit_md_blockquote.sh b/tests/samourai-crew/security-markdown/audit_md_blockquote.sh
index 6d434ad..481c906 100755
--- a/tests/samourai-crew/security-markdown/audit_md_blockquote.sh
+++ b/tests/samourai-crew/security-markdown/audit_md_blockquote.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 # Targets: gnolang/gno#5714 — markdown injection in Render()
+# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
 # Vector: blockquote context confusion
-# A user-controlled comment can inject a blockquote that visually mimics
-# an official statement from the core team.
-# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
+# This test realm deliberately omits sanitize.Block() to document the risk of
+# naive comment-aggregation patterns. Realm authors must call sanitize helpers explicitly.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 # shellcheck source=common.sh
diff --git a/tests/samourai-crew/security-markdown/audit_md_html_inject.sh b/tests/samourai-crew/security-markdown/audit_md_html_inject.sh
index d78c997..f88b600 100755
--- a/tests/samourai-crew/security-markdown/audit_md_html_inject.sh
+++ b/tests/samourai-crew/security-markdown/audit_md_html_inject.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 # Targets: gnolang/gno#5714 — markdown injection in Render()
+# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
 # Vector: raw HTML injection
-# User-supplied HTML content is returned verbatim by Render() and may be
-# rendered by the browser on gno.land if gnoweb does not escape it.
-# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
+# This test realm deliberately omits sanitize.Block() to document the risk of
+# naive Render() implementations. Realm authors must call sanitize helpers explicitly.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 # shellcheck source=common.sh
diff --git a/tests/samourai-crew/security-markdown/audit_md_image_tracking.sh b/tests/samourai-crew/security-markdown/audit_md_image_tracking.sh
index 1af6d25..8f9394b 100755
--- a/tests/samourai-crew/security-markdown/audit_md_image_tracking.sh
+++ b/tests/samourai-crew/security-markdown/audit_md_image_tracking.sh
@@ -1,11 +1,10 @@
 #!/bin/sh
 # Targets: gnolang/gno#5714 — markdown injection in Render()
-# Vector: external image tracking pixel
-# An attacker who can inject markdown into Render() can embed an external image
-# URL. Gnoweb renders it as <img src="https://attacker.com/...">, causing every
-# visitor's browser to load the external resource — deanonymizing viewers.
-# If gnoweb ever fetches images server-side, this also becomes an SSRF vector.
-# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
+# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
+# Vector: external image tracking pixel (deanonymization + SSRF)
+# This test realm deliberately omits sanitize.ImageURL() to document the risk.
+# Without it, gnoweb renders <img src="https://attacker.com/..."> on every page view.
+# Realm authors must call sanitize.ImageURL() on any user-supplied image src.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 # shellcheck source=common.sh
diff --git a/tests/samourai-crew/security-markdown/audit_md_link_hijack.sh b/tests/samourai-crew/security-markdown/audit_md_link_hijack.sh
index 2c9de58..1567779 100755
--- a/tests/samourai-crew/security-markdown/audit_md_link_hijack.sh
+++ b/tests/samourai-crew/security-markdown/audit_md_link_hijack.sh
@@ -1,9 +1,10 @@
 #!/bin/sh
 # Targets: gnolang/gno#5714 — markdown injection in Render()
-# Vector: link URL hijacking
-# A user-controlled message can contain a link whose display text resembles
-# an official URL while the actual href points to a malicious destination.
-# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
+# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
+# Vector: link URL hijacking (phishing)
+# This test realm deliberately omits sanitize.URL() to document the risk.
+# Display text mimics an official URL while href points to a malicious destination.
+# Realm authors must call sanitize.URL() on any user-supplied link href.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 # shellcheck source=common.sh
diff --git a/tests/samourai-crew/security-markdown/audit_md_title_leak.sh b/tests/samourai-crew/security-markdown/audit_md_title_leak.sh
index 551dc7e..350ba59 100755
--- a/tests/samourai-crew/security-markdown/audit_md_title_leak.sh
+++ b/tests/samourai-crew/security-markdown/audit_md_title_leak.sh
@@ -1,8 +1,10 @@
 #!/bin/sh
 # Targets: gnolang/gno#5714 — markdown injection in Render()
-# Vector: user-controlled title injected unsanitized into markdown body,
-# allowing arbitrary headings to be rendered in a proposal or page.
-# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
+# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
+# Vector: title leak into body (heading injection via embedded newlines)
+# This test realm deliberately omits sanitize.InlineText() on the title field.
+# Without it, newlines in user-supplied titles escape into the markdown body.
+# Realm authors must call sanitize.InlineText() on any user-supplied single-line field.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 # shellcheck source=common.sh