@@ -447,7 +447,7 @@ chaquopy {
             // wheel for desktop platforms and a pure-Python `py3-none-any` one as well.
             // There is no Android wheel, so pip falls back to the pure-Python build - which
             // is correct but markedly slower. The messages here are small enough not to care.
-            install("git+https://github.com/parawanderer/FindMy.py@7969003ca785658369b650f75d9e7ca519566bf6")
+            install("git+https://github.com/parawanderer/FindMy.py@00fd962a0e8ec9f5601fe0b9db3f16ccea252a3c")
 
             install("NSKeyedUnArchiver==1.5")
 
 
@@ -11,6 +11,7 @@
 import static androidx.test.espresso.intent.matcher.IntentMatchers.hasComponent;
 import static androidx.test.espresso.matcher.ViewMatchers.isDisplayed;
 import static androidx.test.espresso.matcher.ViewMatchers.withId;
+import static androidx.test.espresso.matcher.ViewMatchers.withText;
 import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
 import static org.hamcrest.Matchers.not;
 import static org.junit.Assert.assertEquals;
@@ -169,6 +170,29 @@ public void theRetryGoesThroughTheServerAndIsRecordedAsRemote() {
                 UserSettings.ANISETTE_REMOTE, storedSettings().getAnisetteMode());
     }
 
+    /**
+     * Issue #248: refused before the password was used, on a device whose local Anisette works.
+     *
+     * <p>The button appears, and the sentence says the password is not the problem while keeping
+     * Apple's text, which carries the {@code ec} a report needs.
+     */
+    @Test
+    public void aRefusalBeforeThePasswordOffersTheRemoteServer() {
+        AppDependencies.replaceAuthService(
+                this.apple = FakeAppleAuthService.refusesBeforeThePasswordOnceThenSignsIn());
+
+        launch();
+        signInExpectingAnotherLoginCall();
+
+        Eventually.check(() -> onView(withId(R.id.login_error_try_remote_anisette))
+                .perform(scrollTo()).check(matches(isDisplayed())));
+
+        final String expected = getInstrumentation().getTargetContext().getString(
+                R.string.login_failed_refused_before_password,
+                "Email verification failed (ec=-1): This action cannot be completed at this time.");
+        onView(withId(R.id.login_error_message_text)).check(matches(withText(expected)));
+    }
+
     /**
      * A wrong password does not offer it: a different Anisette identity would not fix a bad
      * credential, and saying otherwise sends people to change a setting that cannot help.
 
@@ -121,6 +121,21 @@ public static FakeAppleAuthService declinesOnceThenSignsIn() {
         return fake;
     }
 
+    /**
+     * Apple refuses the first step of the sign-in, before the password is used, then serves the
+     * next - issue #248's shape, followed by the retry through a server getting past it.
+     *
+     * <p>Fails as {@code REFUSED_BEFORE_PASSWORD}, which the remote-server button is also gated on.
+     */
+    public static FakeAppleAuthService refusesBeforeThePasswordOnceThenSignsIn() {
+        final FakeAppleAuthService fake = new FakeAppleAuthService(LOGIN_STATE.LOGGED_IN, null);
+        fake.loginFailsWith = new PythonAccountLoginException(
+                "Email verification failed (ec=-1): This action cannot be completed at this time.",
+                PythonAccountLoginException.REASON_REFUSED_BEFORE_PASSWORD);
+        fake.loginFailuresRemaining = 1;
+        return fake;
+    }
+
     /** The password is wrong, or Apple is unreachable. */
     public static FakeAppleAuthService rejectsTheSignIn(final String message) {
         final FakeAppleAuthService fake =
 
@@ -747,15 +747,18 @@ private void showLoginFailure(final Throwable error) {
         ((TextView) this.findViewById(R.id.login_error_message_text))
                 .setText(this.describeLoginFailure(error));
 
-        // Offer the server route only when Apple itself refused the sign-in - a 429 or 503 -
-        // and not for a wrong password or a dead network, where a different Anisette identity
-        // changes nothing. That is the one failure where local Anisette worked and Apple still
-        // said no, so switching the machine identity a server presents is the thing left to try.
+        // Offer the server route only when Apple itself refused the sign-in - a 429 or 503, or
+        // a refusal before the password was used (#248) - and not for a wrong password or a dead
+        // network, where a different Anisette identity changes nothing. Those are the failures
+        // where local Anisette worked and Apple still said no, so switching the machine identity
+        // a server presents is the thing left to try.
         final String reason = error instanceof PythonAccountLoginException
                 ? ((PythonAccountLoginException) error).getReason()
                 : PythonAccountLoginException.REASON_UNKNOWN;
+        final boolean appleRefused = PythonAccountLoginException.REASON_APPLE_DECLINED.equals(reason)
+                || PythonAccountLoginException.REASON_REFUSED_BEFORE_PASSWORD.equals(reason);
         this.findViewById(R.id.login_error_try_remote_anisette).setVisibility(
-                PythonAccountLoginException.REASON_APPLE_DECLINED.equals(reason) ? VISIBLE : GONE);
+                appleRefused ? VISIBLE : GONE);
     }
 
     /**
@@ -825,6 +828,13 @@ private String describeLoginFailure(final Throwable error) {
             return this.getString(R.string.login_failed_apple_declined);
         }
 
+        // Refused before the password was used (#248), so the sentence says that retyping it
+        // will not help. Apple's own text follows, because it carries the ec a report needs.
+        if (PythonAccountLoginException.REASON_REFUSED_BEFORE_PASSWORD.equals(reason)) {
+            return this.getString(R.string.login_failed_refused_before_password,
+                    error.getLocalizedMessage());
+        }
+
         // Apple took the password and the code, then would not open iCloud for the account. Kept
         // apart from the terms sentence because the remedy is elsewhere entirely, and apart from
         // "Apple declined" because that one says to wait - see REASON_ICLOUD_REFUSED.
 
@@ -60,6 +60,17 @@ public class PythonAccountLoginException extends RuntimeException {
      */
     public static final String REASON_APPLE_DECLINED = "apple_declined";
 
+    /**
+     * Apple refused the first step of the sign-in, before the password was used. Matches
+     * {@code REASON_REFUSED_BEFORE_PASSWORD}.
+     *
+     * <p>Issue #248: shown verbatim as "Email verification failed", which reads as a typo in the
+     * Apple ID or password and is neither. Like {@link #REASON_APPLE_DECLINED} it offers the
+     * remote-server route, because local Anisette worked and Apple still said no - so the machine
+     * identity is the thing left to change. Unlike it, nothing here says to wait.
+     */
+    public static final String REASON_REFUSED_BEFORE_PASSWORD = "refused_before_password";
+
     /** Anything not recognised. The detail is shown as-is rather than guessed at. */
     public static final String REASON_UNKNOWN = "unknown";
 
 
@@ -10,7 +10,7 @@
 import NSKeyedUnArchiver
 
 from findmy import FindMyAccessory, MobileMeDelegateError
-from findmy.errors import AppleServiceUnavailableError
+from findmy.errors import AppleServiceUnavailableError, GrandSlamRefusedError
 from findmy.accessory import FixedRollingKeyPairAccessory
 from findmy.keys import KeyPairType
 from findmy.reports import (
@@ -511,6 +511,25 @@ def assertAnisetteIsSupported(serializedAccountData: str) -> str | None:
 end is wasted effort.
 """
 
+REASON_REFUSED_BEFORE_PASSWORD = "refused_before_password"
+"""
+Grand Slam refused the first step of the sign-in, which carries the username and the Anisette
+headers and no password.
+
+**So the password is not the problem, and the screen must not suggest it is.** This arrived as
+an `InvalidCredentialsError` reading "Email verification failed", shown verbatim, on a device
+whose local Anisette was working - OpenTagViewer#248. What is left is the account itself, or the
+machine identity the Anisette data presents, and the second is the one thing this app can change:
+the screen offers the remote-server route for it, as it does for :data:`REASON_APPLE_DECLINED`.
+
+**Which `ec` means what is not established.** Apple's text here is generic, and the code was not
+kept until the fork started carrying it, so nothing branches on a value. The detail keeps the
+code, so a report carries it.
+
+**A wrong password is not this.** That is refused at the second step, `complete`, and stays
+:data:`REASON_UNKNOWN` - a different Anisette identity cannot fix a bad credential.
+"""
+
 REASON_UNKNOWN = "unknown"
 """Anything else. The detail is shown as-is, because a wrong guess is worse than raw text."""
 
@@ -557,6 +576,11 @@ def classifyLoginFailure(error: BaseException) -> str:
     if isinstance(error, AppleServiceUnavailableError):
         return REASON_APPLE_DECLINED
 
+    # Only the first step. The same type reports a wrong password at the second, and that one
+    # must not offer a different Anisette server as though it could help.
+    if isinstance(error, GrandSlamRefusedError) and error.before_password:
+        return REASON_REFUSED_BEFORE_PASSWORD
+
     if isinstance(error, (asyncio.TimeoutError, asyncio.CancelledError)):
         return REASON_NETWORK
     if isinstance(error, _NETWORK_ERRORS):
 
@@ -393,4 +393,5 @@ Wenn Apple die Anfrage lediglich abgelehnt hat, lohnt es sich, zu warten und es
     <string name="anisette_login_crashes_here">Apples Anmeldebibliothek stürzt auf diesem Handy ab, daher übernimmt ein Server diesen Schritt. Alles andere funktioniert normal. Warum das auf manchen Handys passiert, wissen wir noch nicht – ein Bericht mit deinem Modell hilft.</string>
     <string name="anisette_report_crash">Dieses Handy melden</string>
     <string name="anisette_crash_report_body">Apples Anmeldebibliothek stürzt auf diesem Handy ab, sobald sie geladen wird. Auf den meisten Handys funktioniert sie, und wir wissen noch nicht, was die betroffenen gemeinsam haben.\n\nOpenTagViewer nutzt für diesen Schritt jetzt einen Server, du kannst dich also anmelden und die App normal verwenden. Ein Bericht mit den Angaben unten hilft uns, die Ursache zu finden.</string>
+    <string name="login_failed_refused_before_password">Apple hat die Anmeldung mit dieser Apple-ID abgelehnt, bevor dein Passwort geprüft wurde. Es erneut einzugeben hilft also nicht. Prüfe, ob du dich auf account.apple.com anmelden kannst und ob Apple dort etwas von dir verlangt. Ein Remote-Server stellt sich Apple als anderes Gerät vor, einen Versuch ist das wert. Apple meldete: %1$s</string>
 </resources>
@@ -393,4 +393,5 @@ If Apple simply refused the request, waiting and trying again is worth doing fir
     <string name="anisette_login_crashes_here">Apple\'s sign-in library crashes on this phone, so a server does this step instead. Everything else works normally. We don\'t know why it happens on some phones yet, and a report naming yours helps.</string>
     <string name="anisette_report_crash">Report this phone</string>
     <string name="anisette_crash_report_body">Apple\'s sign-in library crashes as soon as it loads on this phone. It works on most phones, and we do not know yet what the affected ones have in common.\n\nOpenTagViewer now uses a server for that step, so you can sign in and use the app normally. A report with the details below is what helps us find the cause.</string>
+    <string name="login_failed_refused_before_password">Apple refused to start signing in to this Apple ID before your password was checked, so retyping it will not help. Check that you can sign in at account.apple.com and whether Apple asks anything of you there. Trying a remote server presents Apple with a different device, which is worth a try. Apple said: %1$s</string>
 </resources>
@@ -393,4 +393,5 @@ Si Apple a simplement refusé la requête, il vaut mieux attendre et réessayer.
     <string name="anisette_login_crashes_here">La bibliothèque de connexion d\'Apple plante sur ce téléphone, un serveur se charge donc de cette étape. Tout le reste fonctionne normalement. Nous ne savons pas encore pourquoi cela arrive sur certains téléphones : un rapport indiquant le vôtre nous aide.</string>
     <string name="anisette_report_crash">Signaler ce téléphone</string>
     <string name="anisette_crash_report_body">La bibliothèque de connexion d\'Apple plante dès son chargement sur ce téléphone. Elle fonctionne sur la plupart des téléphones, et nous ne savons pas encore ce que les appareils concernés ont en commun.\n\nOpenTagViewer utilise désormais un serveur pour cette étape : vous pouvez vous connecter et utiliser l\'app normalement. Un rapport avec les informations ci-dessous nous aide à trouver la cause.</string>
+    <string name="login_failed_refused_before_password">Apple a refusé de commencer la connexion à cet identifiant Apple avant même de vérifier votre mot de passe : le saisir à nouveau ne changera rien. Vérifiez que vous pouvez vous connecter sur account.apple.com et si Apple vous y demande quelque chose. Un serveur distant présente un autre appareil à Apple, cela vaut la peine d\'essayer. Apple a répondu : %1$s</string>
 </resources>
@@ -393,4 +393,5 @@ Appleが要求を拒否しただけなら、少し待ってからもう一度お
     <string name="anisette_login_crashes_here">Apple のサインイン用ライブラリがこの端末ではクラッシュするため、この手順はサーバーが代わりに行います。その他の機能は通常どおり使えます。一部の端末で起きる原因はまだ分かっていません。お使いの機種を添えて報告していただけると助かります。</string>
     <string name="anisette_report_crash">この端末を報告</string>
     <string name="anisette_crash_report_body">この端末では、Apple のサインイン用ライブラリが読み込み直後にクラッシュします。ほとんどの端末では問題なく動作しており、影響を受ける端末の共通点はまだ分かっていません。\n\nOpenTagViewer はこの手順にサーバーを使うようになったため、サインインもアプリの利用も通常どおりできます。下の情報を添えて報告していただくと、原因の特定に役立ちます。</string>
+    <string name="login_failed_refused_before_password">Apple はパスワードを確認する前に、この Apple ID へのサインインの開始を拒否しました。パスワードを入力し直しても解決しません。account.apple.com にサインインできるか、そこで Apple から何か求められていないかを確認してください。リモートサーバーを使うと Apple には別のデバイスとして見えるので、試す価値があります。Apple の応答: %1$s</string>
 </resources>