The deploy-time own-sent copy repair recomputed each thread's unread flag purely from the last message direction, ignoring per-member readByMemberIds. After a restart this could bounce an already-read thread back to unread. It now only marks an inbound thread unread when no member has read it, via a testable unreadAfterReclassify helper.