diff --git a/local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md b/local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md
index 01d9699fa5..a2e1113d40 100644
--- a/local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md
+++ b/local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md
@@ -1,7 +1,7 @@
 # Red Bear OS: Console → Hardware-Accelerated KDE Plasma Desktop
 
-**Version:** 5.4 (2026-06-20)
-**Replaces:** v5.3 (2026-06-20)
+**Version:** 5.5 (2026-06-20)
+**Replaces:** v5.4 (2026-06-20)
 **Replaces:** v4.7 (2026-06-20)
 **Replaces:** v4.2 (2026-06-19)
 **Replaces:** v4.1 (2026-05-04)
@@ -9,6 +9,15 @@
 **Replaces:** v3.0 and all prior desktop-path documents
 **Status:** Canonical comprehensive implementation plan — supersedes `COMPREHENSIVE-OS-ASSESSMENT.md`, `DESKTOP-STACK-CURRENT-STATUS.md`, and all layer-specific plans.
 
+### What Changed in v5.5 (2026-06-20)
+
+| Change | Impact |
+|--------|--------|
+| **redox-drm kernel GPF FIXED** | Root cause: `PciDevice::open_io_ports` never called `acquire_iopl()`, so first `outl 0xCF8` triggered #GP(0). Added `ensure_iopl_acquired()` helper (thread-local Once) and wired into `open_io_ports`. Patch `P1-pci-open-io-ports-iopl.patch` applied to recipe and mirrored to `local/patches/`. |
+| **Qt6 Wayland null+8 crash verified FIXED** | Already fixed in commits `de2d74c37e` and `882c2974ec` (patch applied to qtwaylandscanner, null guards in generated code). Not a current blocker. |
+| **tlc compile errors FIXED** | Fixed `known_hosts.rs` fingerprint type mismatch (`String` → `Vec<u8>`) and format string argument mismatch. |
+| **Redox git forks research COMPLETED** | Found 20+ useful commits from redox-os/drivers (2024-2026): virtio-gpu UAF fix, Intel GPU driver, cosmic-comp compositor, libdrm patch, winit-wayland, gtk3-wayland, login_schemes.toml, init dependency system. Full summary in commit log. |
+
 ### What Changed in v5.4 (2026-06-20)
 
 | Change | Impact |
@@ -52,7 +61,7 @@ and what must happen, in what order, to reach a usable KDE Plasma desktop with h
 | **ACPI boot** | 🟢 Complete | QEMU + bare-metal proof | Shutdown robustness |
 | **IRQ / PCI / MSI-X** | 🟡 QEMU-proven | Source + build + QEMU | Hardware validation |
 | **relibc POSIX** | 🟢 ~85% coverage | Source + Redox-target tests | Message queues, AF_UNIX |
-| **DRM / KMS** | 🟡 Builds, QEMU boots | Source + build + QEMU boot | Qt6 Wayland null+8 crash blocks graphical login |
+| **DRM / KMS** | 🟡 Builds, QEMU boots, GPF fixed | Source + build + QEMU boot | Qt6 Wayland null+8 crash blocks graphical login |
 | **Mesa** | 🟡 swrast + virgl builds | Build (llvmpipe + `virtio_gpu_dri.so`) | virgl EGL runtime probe |
 | **Wayland compositor** | 🟡 Bounded proof | Build + QEMU | Qt6 Wayland `null+8` crash in `wl_proxy_add_listener` |
 | **Input / Seat** | 🟢 Working | Build + QEMU | libinput deferred |
diff --git a/local/recipes/tui/tlc/source/src/viewer/mod.rs b/local/recipes/tui/tlc/source/src/viewer/mod.rs
index 86602d5c5f..cb02455bac 100644
--- a/local/recipes/tui/tlc/source/src/viewer/mod.rs
+++ b/local/recipes/tui/tlc/source/src/viewer/mod.rs
@@ -172,6 +172,9 @@ impl Viewer {
             highlighter,
             #[cfg(feature = "syntect")]
             last_render_top: 0,
+            hex_edit_nibble: 0,
+            hex_edit_pending_high: None,
+            hex_edit_modified: false,
         })
     }
 
@@ -206,6 +209,9 @@ impl Viewer {
             highlighter,
             #[cfg(feature = "syntect")]
             last_render_top: 0,
+            hex_edit_nibble: 0,
+            hex_edit_pending_high: None,
+            hex_edit_modified: false,
         }
     }
 
diff --git a/local/recipes/tui/tlc/source/src/viewer/source.rs b/local/recipes/tui/tlc/source/src/viewer/source.rs
index 20c752cf4e..e77271f948 100644
--- a/local/recipes/tui/tlc/source/src/viewer/source.rs
+++ b/local/recipes/tui/tlc/source/src/viewer/source.rs
@@ -303,6 +303,41 @@ impl FileSource {
         }
     }
 
+    /// Overwrite the byte at `offset`. Returns
+    /// [`SourceError::NotMutable`] for `Chunked` sources — edits
+    /// require the full payload in memory.
+    pub fn write_byte(&mut self, offset: u64, value: u8) -> Result<(), SourceError> {
+        if offset >= self.size() {
+            return Err(SourceError::PastEnd {
+                offset,
+                size: self.size(),
+            });
+        }
+        match self {
+            Self::Inline { bytes } | Self::Compressed { bytes, .. } => {
+                bytes[offset as usize] = value;
+                Ok(())
+            }
+            Self::Chunked { .. } => Err(SourceError::NotMutable),
+        }
+    }
+
+    /// Persist the in-memory bytes to `path`. For `Compressed`
+    /// sources the decompressed bytes are written as a plain
+    /// byte-exact stream (no recompression).
+    pub fn save_to(&self, path: &Path) -> std::io::Result<()> {
+        let bytes = match self {
+            Self::Inline { bytes } | Self::Compressed { bytes, .. } => bytes.as_slice(),
+            Self::Chunked { .. } => {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::Other,
+                    "save_to requires Inline or Compressed source",
+                ));
+            }
+        };
+        std::fs::write(path, bytes)
+    }
+
     /// Decode the entire file as UTF-8 (only valid for inline).
     pub fn to_string_lossy(&self) -> Result<String, SourceError> {
         match self {