@@ -38,6 +38,42 @@
  *   `POST /admin/has-permission`         → its own platform-admin branch read
  * Each body is one the door answers right after its read, so no second session
  * read follows the one under test.
+ *
+ * ## [#22398] The doors whose in-process read is not a `getSession` call
+ *
+ * The same split happened at doors that read the session through better-auth
+ * by another route, so the `getSession` rule could not reach them:
+ *
+ *   - a RE-DISPATCH through the better-auth handler — a `/get-session` lookup
+ *     whose response the door keeps only the JSON of, or a bridge's forward to a
+ *     better-auth route behind `sessionMiddleware` whose status and body are all
+ *     it keeps. Each now carries `disableRefresh` in its URL for a cookie
+ *     request (`in-process-redispatch.ts`);
+ *   - an in-process VENDOR ENDPOINT call carrying the request's headers, whose
+ *     session middleware reads the session and stages the renewed cookie on a
+ *     response that is dropped. Each now takes `inProcessSessionReadInput`'s
+ *     input, which better-auth's `getSessionFromCtx` spreads into that read.
+ *
+ * Doors and the in-process reads each one makes after the mount's own gate:
+ *   `POST /admin/sso/register`             → `/get-session` re-dispatch, then the
+ *                                            inner `/sso/register` (its ADR-0135
+ *                                            D6 before-hook reads the actor)
+ *   `POST /admin/sso/register-saml`        → the same pair, SAML bridge
+ *   `POST /admin/sso/request-domain-verification`,
+ *   `POST /admin/sso/verify-domain`        → the inner route (`sessionMiddleware`)
+ *   `POST /send-verification-email`        → `/get-session` re-dispatch (no email
+ *                                            in the body), then the inner route
+ *   `POST /organization/add-member`        → `authApi.addMember`
+ *   `POST /set-initial-password`           → `authApi.setPassword`
+ *   `POST /sys-oauth-application/register` → `authApi.createOAuthClient`
+ * Each answer below is the one the door gives right after the LAST of its reads
+ * ran, so it proves every read under test happened (the comment on
+ * `RE_DISPATCH_AND_VENDOR_DOORS` says how).
+ *
+ * The fixture turns on what those reads need — SSO with domain verification,
+ * the OIDC provider, email verification — and nothing reaches the network: the
+ * SSO and domain-verification answers are refusals the vendor gives before any
+ * discovery fetch or DNS lookup.
  */
 
 import { describe, it, expect, vi, beforeAll, afterAll } from 'vitest';
@@ -54,6 +90,8 @@ const ORIGIN = 'http://localhost:3000';
 const BASE = '/api/v1/auth';
 const ADMIN_EMAIL = 'admin.22258@example.com';
 const MEMBER_EMAIL = 'member.22258@example.com';
+/** [#22398] An SSO provider the MEMBER registered — the admin may not manage it. */
+const MEMBER_IDP = 'pin-22398-member-idp';
 /** Clock slack between the server's `now` and this file's, in ms. */
 const SLACK_MS = 5_000;
 
@@ -141,7 +179,9 @@ beforeAll(async () => {
     secret: SECRET,
     baseUrl: ORIGIN,
     dataEngine: engine,
-    plugins: { admin: true },
+    // [#22398] The #22398 doors reach their in-process reads only with these on.
+    plugins: { admin: true, sso: true, ssoDomainVerification: true, oidcProvider: true },
+    emailVerification: {},
   } as any);
 
   const direct = (path: string, body: unknown) =>
@@ -169,6 +209,20 @@ beforeAll(async () => {
   // The legacy scalar `isPlatformAdminUser` accepts as its documented
   // back-compat signal — every door below admits this caller.
   users.find((r) => r.email === ADMIN_EMAIL)!.role = 'admin';
+  // [#22398] A verified address: `/send-verification-email` then answers 400
+  // EMAIL_ALREADY_VERIFIED right after its session read, with no transport.
+  users.find((r) => r.email === ADMIN_EMAIL)!.email_verified = true;
+  // [#22398] Org-less and the member's: `checkProviderAccess` refuses the admin
+  // 403 right after `sessionMiddleware` read the session.
+  await engine.insert('sys_sso_provider', {
+    id: 'ssop_pin_22398',
+    provider_id: MEMBER_IDP,
+    issuer: 'https://idp.pin-22398.example.com',
+    domain: 'pin-22398.example.com',
+    user_id: memberId,
+    organization_id: null,
+    domain_verified: false,
+  });
 
   // The version this package pins, read off the running instance — never assumed.
   const authContext: any = await manager.getAuthContext();
@@ -263,6 +317,120 @@ describe('[#22258] each admin door leaves cookie and session expiry aligned', ()
   }
 });
 
+/** The error code a door answered with: the envelope's, or better-auth's native body's. */
+const codeOf = (json: any): string | undefined => json?.error?.code ?? json?.code;
+
+/**
+ * [#22398] Each door, and the answer that proves its last in-process read ran:
+ *
+ *   - `/admin/sso/register(-saml)`: 403 with the bridge's own code. The inner
+ *     `/sso/register` before-hook resolved the actor and refused it (the
+ *     legacy `role` admits at the mount's gate, not at the ADR-0068 D4 hook) —
+ *     an unresolved session would have been the vendor's 401;
+ *   - the domain-verification bridges: 403 — `checkProviderAccess` refused a
+ *     provider the admin does not own, after `sessionMiddleware` resolved the
+ *     admin;
+ *   - `/send-verification-email`: better-auth's own 400 EMAIL_ALREADY_VERIFIED,
+ *     which needs the session's user (with no email in the body, that email
+ *     came from the `/get-session` re-dispatch);
+ *   - add-member: the vendor's 400 ORGANIZATION_NOT_FOUND, read after its
+ *     session; set-initial-password: 409 PASSWORD_ALREADY_SET, read after
+ *     `sensitiveSessionMiddleware`; the OAuth register: 200, the client minted
+ *     for the session's user.
+ */
+const RE_DISPATCH_AND_VENDOR_DOORS: Array<{
+  label: string;
+  path: string;
+  body: () => unknown;
+  answers: { status: number; code?: string };
+}> = [
+  {
+    label: 'POST /admin/sso/register (get-session re-dispatch + inner /sso/register)',
+    path: '/admin/sso/register',
+    body: () => ({ providerId: 'pin-22398-oidc', issuer: 'https://idp.pin-22398.example.com', domain: 'pin-22398.example.com', clientId: 'cid', clientSecret: 'csecret' }),
+    answers: { status: 403, code: 'SSO_REGISTER_FAILED' },
+  },
+  {
+    label: 'POST /admin/sso/register-saml (get-session re-dispatch + inner /sso/register)',
+    path: '/admin/sso/register-saml',
+    body: () => ({ providerId: 'pin-22398-saml', issuer: 'https://idp.pin-22398.example.com', domain: 'pin-22398.example.com', entryPoint: 'https://idp.pin-22398.example.com/sso', cert: 'MIIBpin22398' }),
+    answers: { status: 403, code: 'SAML_REGISTER_FAILED' },
+  },
+  {
+    label: 'POST /admin/sso/request-domain-verification (inner re-dispatch)',
+    path: '/admin/sso/request-domain-verification',
+    body: () => ({ providerId: MEMBER_IDP }),
+    answers: { status: 403 },
+  },
+  {
+    label: 'POST /admin/sso/verify-domain (inner re-dispatch)',
+    path: '/admin/sso/verify-domain',
+    body: () => ({ providerId: MEMBER_IDP }),
+    answers: { status: 403 },
+  },
+  {
+    label: 'POST /send-verification-email, no email (get-session re-dispatch + inner route)',
+    path: '/send-verification-email',
+    body: () => ({}),
+    answers: { status: 400, code: 'EMAIL_ALREADY_VERIFIED' },
+  },
+  {
+    label: 'POST /send-verification-email, explicit email (inner route)',
+    path: '/send-verification-email',
+    body: () => ({ email: ADMIN_EMAIL }),
+    answers: { status: 400, code: 'EMAIL_ALREADY_VERIFIED' },
+  },
+  {
+    label: 'POST /organization/add-member (authApi.addMember)',
+    path: '/organization/add-member',
+    body: () => ({ userId: memberId, role: 'member', organizationId: 'org_pin_22398_absent' }),
+    answers: { status: 400, code: 'ORGANIZATION_NOT_FOUND' },
+  },
+  {
+    label: 'POST /set-initial-password (authApi.setPassword)',
+    path: '/set-initial-password',
+    body: () => ({ newPassword: 'Another!Passw0rd-22398' }),
+    answers: { status: 409, code: 'PASSWORD_ALREADY_SET' },
+  },
+  {
+    label: 'POST /sys-oauth-application/register (authApi.createOAuthClient)',
+    path: '/sys-oauth-application/register',
+    body: () => ({ name: 'pin-22398', redirectURLs: 'https://app.pin-22398.example.com/callback' }),
+    answers: { status: 200 },
+  },
+];
+
+/** The door gave the answer that proves its last in-process read ran. */
+async function expectAnswered(door: (typeof RE_DISPATCH_AND_VENDOR_DOORS)[number], res: Response) {
+  const json: any = await res.clone().json().catch(() => null);
+  expect(res.status, `${door.label} answered ${res.status}: ${JSON.stringify(json)}`).toBe(door.answers.status);
+  if (door.answers.code) expect(codeOf(json), `${door.label}: ${JSON.stringify(json)}`).toBe(door.answers.code);
+}
+
+describe('[#22398] each re-dispatch and vendor-call door leaves cookie and session expiry aligned', () => {
+  for (const door of RE_DISPATCH_AND_VENDOR_DOORS) {
+    it(`${door.label} — by cookie: no renewal, no cookie`, async () => {
+      const aged = ageSession();
+      const res = await fire(door.path, door.body(), asCookie());
+      await expectAnswered(door, res);
+      const after = storedExpiry();
+      expectAligned(door.label, aged, after, res);
+      expect(after, `${door.label}: a cookie request renewed in-process`).toBe(aged);
+    });
+
+    it(`${door.label} — bearer only: renews as before, sets no cookie`, async () => {
+      const aged = ageSession();
+      const res = await fire(door.path, door.body(), asBearer());
+      await expectAnswered(door, res);
+      const after = storedExpiry();
+      expect(after, `${door.label}: a bearer-only read no longer renews`).toBeGreaterThan(aged);
+      expect(Math.abs(after - (Date.now() + expiresInSec * 1000)), `${door.label}: the renewal is not to now + expiresIn`)
+        .toBeLessThan(SLACK_MS);
+      expect(sessionCookieOf(res), `${door.label}: a cookie was set on a response to a request that sent none`).toBeNull();
+    });
+  }
+});
+
 describe('[#22258] control — the browser-facing get-session still renews and re-issues', () => {
   it('renews an aged session and re-issues the cookie with Max-Age = expiresIn', async () => {
     const aged = ageSession();