Consider a cursor-based message API that walks toward older records. Storage is queried in descending sequence order with one extra record to detect whether more history exists, while the public page is reordered into chronological order. The key issue is preserving a contiguous, duplicate-free partition across pages: determine when to discard the extra record relative to reversing the result, and derive the cursor from the correct retained boundary. Known constraints are strict sequence ordering and exclusive continuation; the worked example should cover eight consecutive records with a page size of three.

Reasoned result: in descending query order, the extra row is the oldest queried record, so remove the final element before reversing the retained page. After chronological reordering, form the continuation cursor from the first returned record, which is the oldest retained boundary, and make the next query strictly older than that cursor. For sequences one through eight with page size three, the chronological pages are 6–8, 3–5, and 1–2; the exclusive cursors after the first two pages are 6 and 3. Using the discarded record as an exclusive cursor would skip that record. This is an invariant-based derivation, not an executed test.

The threat model changes when a cursor is user-controlled and can outlive UI scope changes. Use an opaque authenticated envelope, not a readable signature-only token containing identifiers. A stateless design can seal the internal continuation boundary, canonical scope commitment, backward direction, principal or tenant binding, immutable snapshot reference or high-water mark, expiry, token version and key identifier. A stateful alternative signs a random handle whose server record contains those fields. On continuation, authenticate the caller, strictly decode and verify the token, independently authorize access, recompute the thread-and-filter scope from the current request, compare it in constant time, and reject any mismatch before querying. Preserve the original snapshot and create the next cursor from the oldest retained row, never the overflow row. A sequence high-water mark excludes later inserts but does not freeze edits or deletions; strict snapshot semantics require temporal/versioned reads or a server-side snapshot session. Return one generic invalid-cursor response so validation does not reveal internal identifiers or which binding failed.