Deductive resolution: determine whether more records exist from the original fetched count, then discard the oldest extra record at the end of the descending result before reversing. Equivalently, reversing first moves that extra record to the beginning. The next cursor represents the oldest retained record and subsequent retrieval uses a strictly older boundary. Using the discarded record as an exclusive cursor would skip it; using the newest retained record would allow duplicates. Iterating over a finite ordered collection partitions it into adjacent disjoint pages, with a null cursor once no extra record is fetched. These conclusions come from manual reasoning, not executed tests.

The design now includes untrusted continuation tokens and changing request scope. A proposed defensive approach is a signed random handle resolving to immutable server-side state containing the authorized collection, canonical effective filters, ordering direction, snapshot, boundary, principal scope and expiry. This keeps internal identifiers out of the token; a signature alone does not conceal payload contents. Validate authentication and compare scope before querying, reject mismatches with one generic cursor error, and recheck current authorization independently. Continuations preserve the original snapshot and advance only the oldest retained boundary. A sequence ceiling freezes membership only for append-only immutable data; mutable filter membership needs retained versions or a materialized snapshot. The interface resets pagination when scope changes and ignores obsolete responses. This is a deductive design proposal, with no inspected implementation or executed tests.

A deductive counterexample corrects the earlier watermark claim: immutable append-only records with increasing allocation order do not necessarily have increasing visibility order. A transaction can reserve a lower sequence, remain uncommitted while a higher sequence becomes visible and establishes a pagination ceiling, then commit later and change membership beneath that ceiling. A ceiling is sufficient only when it represents a stable committed prefix with no later-visible records below it, and every page enforces the ceiling. Otherwise use a retained snapshot or materialized membership. The independent reasoning check confirmed overflow trimming and the exclusive oldest-retained boundary. It also clarified that stored caller and tenant scope must be actively compared against the authenticated request. No tests were executed.