surface.replaceGeneration gets its direct-access test (the getter folds a pending delta itself, not only via a nodes read); the reconstruction theorem drives maxTokens and stop through the config waterfall; the compact-basic envelope drops a dead conditional — config.maxTokens is required and validated positive, so this backend's envelope always carries the cap (the return type's optionality exists for overriding subclasses).