Pagination counts ATTENDEES, not booking lines, so a grouped attendee row carries their complete listings list and never splits across a page boundary. listingIds decides WHICH attendees match, and the returned rows still cover all of a matched attendee's listings.

An order by id works because AUTOINCREMENT ids are unique and always rise. Each page is therefore deterministic. One extra attendee reports hasNext without a second count query. PII stays encrypted, so decrypt with decryptAttendees first.