diff --git a/plans/content-on-sx.md b/plans/content-on-sx.md
index cd0e14e1..4a20622b 100644
--- a/plans/content-on-sx.md
+++ b/plans/content-on-sx.md
@@ -111,8 +111,43 @@ lib/content/api.sx ── (content/edit) (content/render) (content/history) ─
 - [x] portable data serialization (`data.sx`: content/to-data + from-data, round-trips tree)
 - [x] wire serialization (`wire.sx`: content/to-wire + from-wire, SX-text on the wire)
 
+## Known limitations
+
+- **Markdown table cells containing `|` do not round-trip.** `asMarkdown` on a
+  table emits cell text raw (table.sx `CtTable>>asMarkdown:`), so a cell `x|y`
+  renders the row `| x|y | z |` — which `md/import` then splits into *three*
+  cells (`md-import.sx` `md/-cells` splits on every `|`). Repro: build
+  `(mk-table "t" (list "A" "B") (list (list "x|y" "z")))`, `asMarkdown` →
+  re-`md/import` → cells become `("x" "y" "z")`. Same applies to a literal `|`
+  in a header. (HTML/SX/text/data/wire/CRDT round-trips are unaffected — only
+  the Markdown text boundary.)
+  *Fix sketch* (when sx-tree edit tooling is restored — see below): add
+  `String>>mdCellEscaped` (escape `|` → `\|`) in table.sx and use it for every
+  header/cell in `CtTable>>asMarkdown:`; in md-import.sx replace `md/-cells`'
+  naive `(split … "|")` with an escaped-aware splitter that breaks only on
+  unescaped `|` and unescapes `\|` → `|`. Both sides must change together
+  (export-only escaping makes self-round-trip worse, not better).
+  *Blocker:* in this worktree every sx-tree **edit** tool (`sx_replace_node`,
+  `sx_replace_by_pattern`, `sx_insert_near`, …) raises yojson `"Expected
+  string, got null"`; only `sx_write_file` works. md-import.sx is 449 lines, so
+  a safe surgical edit isn't currently possible — deferred rather than risk a
+  full manual rewrite of working import code.
+
 ## Progress log
 
+- 2026-06-07 — Audit (markdown round-trip): probed the Markdown text boundary
+  for round-trip fidelity. Found one real data-corruption bug — table cells
+  containing `|` don't survive `asMarkdown` → `md/import` (recorded under
+  **Known limitations** with repro + fix sketch). Could not land the fix this
+  pass: it must touch md-import.sx (449 lines) and every sx-tree *edit* tool is
+  currently broken in this worktree (yojson error; only `sx_write_file` works),
+  so a safe surgical edit isn't possible and a full manual rewrite of working
+  import code is too risky to be responsible. Deferred + documented rather than
+  half-fix (export-only escaping worsens self-round-trip). Engine remains
+  COMPLETE + audited at 787/787; with the roadmap exhausted, the tree-wide
+  audit done, and the one open finding tooling-blocked, the vertical is
+  **SATURATED** — pacing the loop down.
+
 - 2026-06-07 — Hardening: validation now vets collection blocks ELEMENT-DEEP.
   `validate` previously checked only that list `items` / table `headers`/`rows`
   *are lists* — a list holding a non-string, or a table whose rows aren't lists