Our maintenance switch is one boolean, and the rewrite that serves it cannot carry a 503

Maintenance mode in Munchable sorts every path into api, app or public. The API answers 503 with Retry-After, the signed-in pages render a notice at their own URL, and the marketing site never notices. The 200 on those pages is deliberate.