Apple ID sign-in no longer dies with HTTP 503 from GsService2 before 2FA.
Apple's GrandSlam edge returns that HTML 503 for two independent reasons: a keep-alive connection is spent after two requests (sign-in is three), and any X-MMe-Client-Info whose client token is com.apple.dt.Xcode is dropped at the edge. iPASide now uses a throwaway HTTP session per GSA request and presents com.apple.akd/1.0. Accounts that get an SMS code instead of a trusted-device prompt can submit it.
Verified: live GrandSlam sign-in against gsa.apple.com through 2FA and apptokens (HTTP 200 plists, not HTML 503). CI on windows-latest: engine pytest, Flutter analyze + tests, installer build.
The installer is unsigned, so SmartScreen will warn — the SHA-256 is in SHA256SUMS.txt.