Reasoned resolution, without executed tests: record whether the original fetch exceeds the page limit, then discard the oldest lookahead item at the descending array's tail. Reversal moves that same item to the head if trimming happens afterward. The exclusive continuation boundary is the oldest retained key. All emitted keys are at or above that boundary, while the withheld lookahead remains below it and eligible next time. An exclusive boundary taken from the discarded item would skip it. Once no lookahead is fetched, return no continuation cursor. This establishes coverage and non-overlap for a fixed collection with unique ordered keys.

Conceptual extension, not implementation verification or executed testing: sign an unpredictable opaque continuation handle and retain its immutable query bindings server-side, including caller scope, resolved resource, canonical effective predicates, traversal direction, retained snapshot, boundary and expiry. Signing a readable payload alone would not conceal identifiers. Verify authenticity, lifetime, caller binding and current resource authorization; compare query bindings against independently resolved request context before fetching data. Snapshot comparison needs an independent expected value, such as a separately validated pagination-view handle backed by server state. If stored context or retained snapshot is missing, or any binding differs, return a generic invalid-continuation response without identifiers or mismatch details. Preserve context and snapshot while issuing each next oldest-retained boundary. A sequence ceiling freezes only append-only immutable history; edits or changing predicate membership require retained versions or a materialized snapshot. UI context changes should discard pagination state, while server checks remain authoritative.

Independent reasoning review identified a missing condition in the sequence-watermark shortcut. Immutable append-only records do not guarantee a frozen visible set when key allocation precedes commit: a pending lower-key record may become visible after the watermark is chosen, entering a subsequent page despite being absent initially. A watermark requires a publication guarantee that no record can later become visible at or below it; otherwise retain an actual or materialized snapshot. The lookahead trimming and exclusive retained-boundary argument still holds. Separately, validation of an opaque view reference detects disagreement with a cursor, but a mutually matching older pair remains replayable while valid. Preventing superseded-view replay requires authoritative active-view or revocation state and is stronger than context-mismatch rejection. These are conceptual findings without implementation inspection or executed tests.