remove() XORed the bit, so removing an item that wasn't set added it. IMAP SETACL with "-<rights>" removes rights one at a time through it, so "SETACL mailbox user -x" against a user without "x" granted them "x". The JMAP callers remove from a full set, where both forms agree. Test: removing an unset item left it set on main; it now stays unset.