Backward keyset pagination with chronological page output

The invariant is to detect overflow while rows are still in descending query order, remove the final row because it is the oldest lookahead, and derive the continuation position from the oldest retained row. The next query uses a strict older-than predicate, so the lookahead is fetched again rather than skipped. Only the retained rows are reversed for chronological presentation. With sequences one through eight and a page size of three, the pages are six through eight with cursor six, three through five with cursor three, then one through two with no cursor. This is a reasoning result; no runtime tests were executed.

The cursor must authenticate the whole continuation contract, not only the keyset position. Canonicalize the endpoint, current authorization boundary, requested resource, filters, direction, and sort policy into a context binding; carry the initial snapshot and complete exclusive position unchanged except for advancing the position. On continuation, authenticate and decrypt the opaque token before trusting claims, reauthorize the requested resource, recompute and compare every binding, then apply the saved snapshot and exclusive position. A readable signed payload protects integrity but exposes claims, so use authenticated encryption or a signed random server-side handle. Return the same generic invalid-cursor response for malformed, expired, mismatched, unavailable-snapshot, and unauthorized cases, without echoing tokens or identifiers. A committed insertion watermark can freeze append-only visibility, while edits, deletes, or late-visible older rows require an as-of snapshot or materialized result. This is reasoned design only; no runtime tests were executed.