Function surplus_must_not_exceed_threshold 

fn surplus_must_not_exceed_threshold(
    cfg: &SsaGeneratorConfig,
) -> Result<(), ValidationError>

Rejects a surplus larger than the threshold it insures.

The bound is deliberately loose — twice the emitted shares a polynomial needs — because the surplus is legitimately a deployment choice about return-path loss, and over-insuring a bad path is a reasonable thing to want. What it forbids is the case where the insurance costs more than the thing insured: since H5 the surplus travels in the negotiated PixParams and is billed on purchase rather than on claim, so a surplus above the threshold means an Entry paying for more redundancy than payload in every deposit.

This is a configuration bound, not a wire one. PixParams packs the surplus as a byte and accepts the whole range, and a peer offering an extravagant surplus is already caught where it should be — by the Exit’s quota_range, since the surplus inflates the quota.