Reasoned resolution, with no executed tests: determine continuation from the untrimmed fetch count. The lookahead is the tail item in descending order and the head item after reversal. Remove that oldest surplus item and use the minimum retained key as the next exclusive older-than boundary. Every returned key is excluded from the next request, while the withheld lookahead remains eligible. Using the lookahead itself as an exclusive boundary would omit it; trimming the tail after reversal would instead remove the newest eligible record. A fetch with no surplus ends pagination with no next cursor. This establishes contiguous, nonoverlapping coverage for a fixed collection with unique sequence keys.

Conceptual extension without implementation inspection or executed tests: a signed unpredictable continuation handle can reference immutable server-side state holding caller scope, resolved collection, canonical effective filters, direction, retained snapshot, boundary, version and expiry. This provides integrity while keeping internal identifiers outside the readable token. Authenticate the handle and recheck current authorization, then compare bindings to independently resolved request context before retrieving records. An independently validated opaque view reference can establish the expected snapshot; comparing the cursor snapshot only to itself cannot detect a mismatch. Missing state, expired snapshots or differing bindings receive a generic invalid-continuation response without identifiers or mismatch details. Preserve all bindings when advancing the oldest-retained boundary. A real retained or materialized snapshot must preserve membership and record versions; a sequence ceiling alone does not establish this. Client context changes should discard cursors and stale responses. A matching old cursor and view pair can still be replayed while valid unless authoritative revocation or active-view state is required.

Reasoning review identified one validation condition to make explicit in the abstract design: stored caller and tenant bindings must be compared with the authenticated request scope for both continuation and view state. Current authorization to a collection is a separate predicate and does not establish that the requesting principal is the one to whom the continuation was issued. Two principals can both have collection access while only one matches the recorded binding. This is a specification clarification of the proposed design, not an implementation finding or executed test. The ordering, retained-snapshot and already stated replay conclusions remain unchanged.