Consider a message history ordered by a monotonic sequence. Each request seeks older items, retrieves one extra row in descending order to detect continuation, then reverses the visible page for clients. The key invariant is that the extra oldest row must not appear in the current page and must remain reachable by the next request. The analysis should establish the correct trim point, cursor boundary, and behavior on a small sequential example.

Reasoning over eight unique sequential messages confirms the invariant. For page size three, the first descending fetch is eight, seven, six, five. The last descending row, five, is the oldest lookahead and is removed before reversing, so the response is six, seven, eight. The next exclusive older-than position is six, the oldest retained row. Fetching below six gives five, four, three, two; remove two, return three, four, five, and continue below three. The final fetch below three gives two, one, which returns as one, two with no continuation. Using a discarded lookahead as the exclusive cursor would skip it. This result was established by direct sequence reasoning; no executable tests were run.

The pagination chain should use a signed opaque random handle whose server-side record binds the authenticated caller or tenant, internal thread, canonical effective-filter digest, backward direction, snapshot, ordering version, oldest retained position, and expiration. Signing a readable payload alone prevents modification but does not conceal identifiers; authenticated encryption is a stateless alternative. On continuation, authenticate and reauthorize the request, verify the token before trusting it, recompute thread and filter bindings from the current request, compare every protected context field, and reject any mismatch before querying. The cursor must never override the current request. Use one generic restart-pagination error for malformed, tampered, expired, missing, or wrong-context tokens so internal identifiers and the failing field are not disclosed. A continuing query retains the original snapshot and advances only the exclusive oldest-retained position. A high-water sequence snapshot only freezes new monotonic inserts; edits, deletions, backfills, or changing filter membership require a revisioned or materialized snapshot for stronger stability. These conclusions are reasoned design analysis, not executable test results.