docs: add task files for deferred safety/enhancement work

- remote-conversation-loading.md — implement list/load for RemoteBackend
- settings-error-display.md — wire validation errors to footer
- dead-code-cleanup.md — remove allow(dead_code), Letta aliases, unused imports
- numeric-cast-safety.md — add saturating cast helpers

docs/tasks/dead-code-cleanup.md

@@ -0,0 +1,59 @@
+# Task: Dead Code and Legacy Alias Cleanup
+
+**Priority:** Low
+**Effort:** 2-3 hours
+**Files:** Multiple across `src/`
+
+## Context
+
+The codebase has accumulated dead code and legacy compatibility shims from the ratatui→tuie migration and the Letta→Souveraine rename.
+
+## Items to Clean Up
+
+### 1. `#[allow(dead_code)]` annotations
+
+These structs/fields exist but aren't used:
+
+- `src/core/sensorium/mod.rs:120,129,226,272` — bandwidth/discovery structs
+- `src/core/chain/mod.rs:9,11,13` — chain fields
+- `src/core/subagent/mod.rs:9` — subagent field
+- `src/ui/tuie_app.rs:697,707` — unused helper methods
+
+**Action:** For each, either:
+- Remove the item if truly unused
+- Remove the `#[allow(dead_code)]` if it's actually used (check carefully)
+- Add a comment explaining why it's kept if it's a future seam
+
+### 2. `LETTA_` environment variable aliases
+
+`src/core/tools/defs.rs:128-139` injects `LETTA_MEMORY_DIR`, `LETTA_AGENT_ID` alongside `SOUVERAINE_` versions. The setup wizard also discovers `~/.letta` agents.
+
+**Action:**
+- Check if any external tooling still references `LETTA_*` vars
+- If not, remove the aliases and the `discover_letta_agents()` function
+- If yes, document why they're kept
+
+### 3. Unused imports from dual-engine setup
+
+The codebase has 289 compiler warnings, mostly unused imports from the ratatui/tuie dual-engine setup.
+
+**Action:**
+- Run `cargo fix --bin "souveraine" -p souveraine --tests --allow-dirty`
+- Review and commit the auto-fixed imports
+- Manual review for any remaining warnings
+
+### 4. `animation.rs` ratatui `bloom` module
+
+`src/ui/animation.rs:132-427` has a `pub mod bloom` that uses `ratatui::buffer::Buffer` — this is the old ratatui bloom renderer. The tuie version lives in `src/ui/screens/splash.rs`.
+
+**Action:**
+- Verify nothing imports `animation::bloom`
+- If unused, remove the entire module
+- Keep the `Animator` struct and utility functions (gradient, hsl_to_rgb, etc.)
+
+## Acceptance Criteria
+
+- [ ] `cargo test` passes with fewer warnings
+- [ ] No functional regressions
+- [ ] Each removal is a separate commit for easy revert
+- [ ] Comments explain any kept legacy items

docs/tasks/numeric-cast-safety.md

@@ -0,0 +1,57 @@
+# Task: Add Numeric Cast Safety Helpers
+
+**Priority:** Low
+**Effort:** 2-4 hours
+**Files:** New `src/ui/cast.rs` or `src/core/cast.rs`, plus updates across `src/`
+
+## Context
+
+The codebase has hundreds of numeric casts (`as u16`, `as usize`, `as i32`, `as u64`). Many are safe (values are known to fit), but some could panic in debug mode or wrap silently in release mode.
+
+Current patterns:
+- `(f32_value) as u16` — panics if negative in debug, wraps in release
+- `(expr) as usize` — silently wraps on 32-bit if value exceeds 2^32
+- No consistent approach across the codebase
+
+## Requirements
+
+### 1. Create a `cast` utility module
+
+```rust
+/// Saturating cast from f32 to u16. Returns 0 for negative, u16::MAX for overflow.
+pub fn f32_to_u16(v: f32) -> u16 {
+    v.max(0.0).min(u16::MAX as f32) as u16
+}
+
+/// Saturating cast from f32 to usize.
+pub fn f32_to_usize(v: f32) -> usize {
+    v.max(0.0) as usize  // f32 can't exceed usize::MAX on 64-bit
+}
+
+/// Saturating cast from usize to u16.
+pub fn usize_to_u16(v: usize) -> u16 {
+    v.min(u16::MAX as usize) as u16
+}
+```
+
+### 2. Apply to worst offenders
+
+Priority files:
+- `src/ui/animation.rs` — bloom renderer (already partially fixed)
+- `src/ui/screens/splash.rs` — tuie bloom renderer
+- `src/ui/cockpit_panel.rs` — pressure/percentage rendering
+- `src/ui/presence.rs` — jitter calculations
+
+### 3. Pattern for adoption
+
+- Use the helpers where the input range is genuinely uncertain
+- Keep raw `as` casts where the value is provably in range (e.g., loop indices, enum discriminants)
+- Add a comment explaining why a raw cast is safe when keeping one
+
+## Acceptance Criteria
+
+- [ ] `cast` module exists with documented helper functions
+- [ ] Worst offenders use the helpers instead of raw casts
+- [ ] No behavior change for valid inputs
+- [ ] Edge cases (negative, overflow) saturate instead of panic/wrap
+- [ ] Tests cover boundary values for each helper

docs/tasks/remote-conversation-loading.md

@@ -0,0 +1,47 @@
+# Task: Implement Remote Conversation Listing and Loading
+
+**Priority:** Medium
+**Effort:** 2-4 hours
+**Files:** `src/backend/remote.rs`
+
+## Context
+
+The `RemoteBackend` has two stub methods:
+
+```rust
+async fn list_conversations(&self, _agent_id: &str) -> Result<Vec<ConversationInfo>> {
+    Ok(Vec::new()) // TODO
+}
+
+async fn load_conversation(&self, _conversation_id: &str) -> Result<Vec<ConversationMessage>> {
+    anyhow::bail!("Remote conversation loading not yet implemented")
+}
+```
+
+Anyone using the remote backend gets empty conversation history and an error on load.
+
+## Requirements
+
+1. **list_conversations** — Implement `GET /v1/agents/:id/conversations`:
+   - Deserialize response into `Vec<ConversationInfo>`
+   - Handle pagination if the API supports it
+   - Return empty vec on 404 (agent has no conversations yet)
+
+2. **load_conversation** — Implement `GET /v1/conversations/:id/messages`:
+   - Deserialize response into `Vec<ConversationMessage>`
+   - Handle SSE streaming if the API streams messages
+   - Return clear error if conversation doesn't exist
+
+## API Design Notes
+
+- Check `src/server/conversation.rs` for the server-side endpoints
+- The server may already implement these — just wire the client
+- Use the existing `auth_req()` pattern for bearer token injection
+- Follow the `send()` method's SSE parsing pattern if streaming is needed
+
+## Acceptance Criteria
+
+- [ ] `list_conversations` returns real data from the server
+- [ ] `load_conversation` returns full message history
+- [ ] Both methods handle errors gracefully (network, 404, auth)
+- [ ] Tests cover happy path and error cases

docs/tasks/settings-error-display.md

@@ -0,0 +1,35 @@
+# Task: Wire Settings Validation Errors to Footer Display
+
+**Priority:** Low
+**Effort:** 1-2 hours
+**Files:** `src/ui/screens/settings/mod.rs`
+
+## Context
+
+Settings validation errors are currently swallowed:
+
+```rust
+// TODO: show error in footer
+```
+
+When a user enters invalid config (bad URL, empty required field, etc.), the error is lost.
+
+## Requirements
+
+1. **Error state** — Add an `error_message: Option<String>` field to `SettingsScreen`
+2. **Timeout** — Auto-clear the error after ~5 seconds or on next valid input
+3. **Display** — Show the error in the footer area with a distinct color (red/orange)
+4. **Integration** — Hook into the existing validation paths that currently log or ignore errors
+
+## Design Notes
+
+- The footer already renders keybind hints — the error should appear above or replace them temporarily
+- Use `palette.compaction` (red-ish) for error text
+- Consider a `Cell<Instant>` for tracking when to auto-clear
+
+## Acceptance Criteria
+
+- [ ] Invalid settings input shows a visible error in the footer
+- [ ] Error clears automatically after timeout or on next action
+- [ ] Error text is readable and styled distinctly from normal UI
+- [ ] No regressions in existing settings navigation