@@ -3164,7 +3164,10 @@ export class AuthPlugin implements Plugin {
         // Forward request headers so better-auth can resolve the caller's
         // session (sessionMiddleware on /oauth2/create-client). Without
         // the session the row would lack `user_id` and never appear in
-        // the My Applications view.
+        // the My Applications view. [#22398] That read is in-process, so it
+        // takes the `getSession` reader's input: a cookie request reads
+        // without renewal (its cookie would be staged on a response nobody
+        // sends); a bearer-only one renews as before.
         let result: any;
         try {
           result = await authApi.createOAuthClient({
@@ -3173,7 +3176,7 @@ export class AuthPlugin implements Plugin {
               redirect_uris: redirectUris,
               type: safeType,
             },
-            headers: c.req.raw.headers,
+            ...inProcessSessionReadInput(c.req.raw.headers),
           });
         } catch (err: any) {
           const status = typeof err?.status === 'number' ? err.status : 500;
 
@@ -0,0 +1,53 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The URL for a request this plugin RE-DISPATCHES through the better-auth
+ * universal handler on the caller's behalf: the in-process `/get-session`
+ * lookups and the bridges that reshape a body and forward it to a better-auth
+ * route (`register-sso-provider.ts`, `send-verification-email.ts`).
+ *
+ * ## Why a re-dispatch needs a rule (#22398)
+ *
+ * Every better-auth session read renews a session older than `updateAge` — it
+ * moves `sys_session.expires_at` to `now + expiresIn` — and stages the renewed
+ * cookie on THAT read's response. A re-dispatched `/get-session` answers that
+ * response to this plugin, which keeps only its JSON; a re-dispatched route
+ * behind `sessionMiddleware` does the same read, and the bridge keeps only its
+ * status and body. So the renewal lands in the database and its cookie is
+ * thrown away: the browser keeps its old cookie and its old `Max-Age`, and the
+ * session splits exactly as `inProcessSessionReadInput` (`@objectstack/types`)
+ * describes for an in-process `getSession` call.
+ *
+ * ## The rule — the same one, spelled for a URL
+ *
+ * A request carrying a session cookie is re-dispatched with
+ * `disableRefresh=true` in its query, so no in-process read renews it: the
+ * session renews only where its cookie is re-issued, the browser-facing
+ * `/get-session`. A bearer-only request is re-dispatched unchanged and keeps
+ * renewing — there is no cookie to fall behind.
+ *
+ * better-auth reads the flag from the query on both kinds of re-dispatch
+ * (1.7.3, measured by `in-process-session-renewal.pin.test.ts`): the
+ * `/get-session` route declares it (`getSessionQuerySchema`, coerced), and
+ * `getSessionFromCtx` — which `sessionMiddleware` and this plugin's own
+ * before-hooks call — spreads the route's `ctx.query` into the read it makes,
+ * so a route that declares no query schema of its own passes the flag through.
+ *
+ * ⛔ The rule only ever ADDS `disableRefresh`. It never sets or forwards a
+ * cookie, and the request's headers — which session it resolves — are not
+ * touched.
+ */
+
+import { carriesSessionCookie } from '@objectstack/types';
+
+/**
+ * `url` with `disableRefresh=true` in its query when `headers` (the caller's
+ * own, as forwarded on the re-dispatch) carry a session cookie; `url` itself
+ * otherwise.
+ */
+export function inProcessRedispatchUrl(url: string, headers: unknown): string {
+  if (!carriesSessionCookie(headers)) return url;
+  const target = new URL(url);
+  target.searchParams.set('disableRefresh', 'true');
+  return target.href;
+}
@@ -70,6 +70,7 @@
  * `organization-add-member-team-fallback.test.ts`.
  */
 
+import { inProcessSessionReadInput } from '@objectstack/types';
 import { mapAuthApiError, type EndpointResult } from './admin-user-endpoints.js';
 
 /** Minimal better-auth server-api surface this route drives. */
@@ -82,6 +83,8 @@ export interface AddMemberCapableApi {
       teamId?: string;
     };
     headers?: Headers;
+    /** `disableRefresh` for a cookie request (#22398, see the call below). */
+    query?: { disableRefresh: true };
   }): Promise<Record<string, unknown> | null>;
 }
 
@@ -165,14 +168,19 @@ export async function runOrganizationAddMember(
     // admin's ACTIVE organization (the action metadata's documented
     // behaviour). The vendor endpoint is server-only and does no
     // authorization of its own — the mount's platform-admin gate already ran.
+    // [#22398] The vendor reads the session from those headers in-process, and
+    // a renewal would stage its cookie on a response nobody sends; so the call
+    // takes the same input a `getSession` reader does (better-auth's
+    // `getSessionFromCtx` spreads the call's `query` into that read). A cookie
+    // request does not renew here; a bearer-only one does, as before.
     const member = await authApi.addMember({
       body: {
         userId,
         role,
         ...(organizationId ? { organizationId } : {}),
         ...(teamId ? { teamId } : {}),
       },
-      headers: request.headers,
+      ...inProcessSessionReadInput(request.headers),
     });
     return { status: 200, body: { success: true, data: { member: member ?? null } } };
   } catch (error) {
 
@@ -138,8 +138,11 @@ describe('runRegisterSamlProviderFromForm (ADR-0069 P3)', () => {
     expect(res.body.success).toBe(true);
     expect(res.body.acsUrl).toBe('http://localhost:3000/api/v1/auth/sso/saml2/sp/acs/acme-saml');
     expect(res.body.spMetadataUrl).toBe('http://localhost:3000/api/v1/auth/sso/saml2/sp/metadata?providerId=acme-saml');
-    // re-dispatched to the real /sso/register with the nested shape
-    expect(dispatched!.url).toBe('http://localhost:3000/api/v1/auth/sso/register');
+    // re-dispatched to the real /sso/register with the nested shape — with
+    // `disableRefresh`, because this request carries a session cookie (#22398:
+    // the inner read must not renew a session whose cookie this bridge never
+    // sends back; `in-process-session-renewal.pin.test.ts` measures it).
+    expect(dispatched!.url).toBe('http://localhost:3000/api/v1/auth/sso/register?disableRefresh=true');
     expect(dispatched!.body).toMatchObject({
       providerId: 'acme-saml',
       issuer: 'https://idp.acme.com/entity',
 
@@ -22,6 +22,8 @@
  * (per-environment runtime) — mirroring `runSetInitialPassword`.
  */
 
+import { inProcessRedispatchUrl } from './in-process-redispatch.js';
+
 export interface RegisterSsoFormResult {
   /** HTTP status to return to the caller. */
   status: number;
@@ -57,7 +59,9 @@ async function resolveActiveOrganizationId(
     if (cookie) h.set('cookie', cookie);
     const authz = headers.get('authorization');
     if (authz) h.set('authorization', authz);
-    const resp = await handle(new Request(sessionUrl, { method: 'GET', headers: h }));
+    // [#22398] A cookie request reads without renewal: this response's cookie
+    // is never sent (`in-process-redispatch.ts`).
+    const resp = await handle(new Request(inProcessRedispatchUrl(sessionUrl, h), { method: 'GET', headers: h }));
     if (!resp.ok) return undefined;
     const data: any = await resp.json().catch(() => null);
     const org = data?.session?.activeOrganizationId ?? data?.activeOrganizationId;
@@ -201,7 +205,9 @@ export async function runRegisterSsoProviderFromForm(
   // regression) when no active org is set.
   const organizationId = await resolveActiveOrganizationId(handle, innerUrl, headers);
 
-  const innerReq = new Request(innerUrl, {
+  // [#22398] `/sso/register` reads the session too (the ADR-0135 D6 before-hook
+  // and `sessionMiddleware`), and only status and body come back from here.
+  const innerReq = new Request(inProcessRedispatchUrl(innerUrl, headers), {
     method: 'POST',
     headers,
     body: JSON.stringify({ providerId, issuer, domain, oidcConfig, ...(organizationId ? { organizationId } : {}) }),
@@ -298,7 +304,8 @@ export async function runRegisterSamlProviderFromForm(
   // can manage the provider — see the OIDC helper above.
   const organizationId = await resolveActiveOrganizationId(handle, innerUrl, headers);
 
-  const innerReq = new Request(innerUrl, {
+  // [#22398] Same rule as the OIDC bridge's inner `/sso/register`.
+  const innerReq = new Request(inProcessRedispatchUrl(innerUrl, headers), {
     method: 'POST',
     headers,
     body: JSON.stringify({ providerId, issuer, domain, samlConfig, ...(organizationId ? { organizationId } : {}) }),
@@ -401,7 +408,9 @@ export async function runRequestDomainVerification(
   if (!rw) return { status: 400, body: { success: false, error: { code: 'INVALID_REQUEST', message: 'Bad request URL' } } };
   const headers = forwardAuthHeaders(request, rw.origin);
 
-  const resp = await handle(new Request(rw.innerUrl, { method: 'POST', headers, body: JSON.stringify({ providerId }) }));
+  // [#22398] The inner route reads the session (`sessionMiddleware`); only its
+  // status and body come back from here.
+  const resp = await handle(new Request(inProcessRedispatchUrl(rw.innerUrl, headers), { method: 'POST', headers, body: JSON.stringify({ providerId }) }));
   let parsed: any = {};
   try { const t = await resp.text(); parsed = t ? JSON.parse(t) : {}; } catch { parsed = {}; }
   if (!resp.ok) {
@@ -451,7 +460,9 @@ export async function runVerifyDomain(
   if (!rw) return { status: 400, body: { success: false, error: { code: 'INVALID_REQUEST', message: 'Bad request URL' } } };
   const headers = forwardAuthHeaders(request, rw.origin);
 
-  const resp = await handle(new Request(rw.innerUrl, { method: 'POST', headers, body: JSON.stringify({ providerId }) }));
+  // [#22398] The inner route reads the session (`sessionMiddleware`); only its
+  // status and body come back from here.
+  const resp = await handle(new Request(inProcessRedispatchUrl(rw.innerUrl, headers), { method: 'POST', headers, body: JSON.stringify({ providerId }) }));
   let parsed: any = {};
   try { const t = await resp.text(); parsed = t ? JSON.parse(t) : {}; } catch { parsed = {}; }
   if (resp.ok) {
 
@@ -30,6 +30,7 @@
  */
 
 import type { AuthRequestHandler } from './register-sso-provider.js';
+import { inProcessRedispatchUrl } from './in-process-redispatch.js';
 
 export interface ResendVerificationEmailResult {
   /** HTTP status to return to the caller. */
@@ -60,7 +61,9 @@ async function resolveSessionEmail(
     if (cookie) h.set('cookie', cookie);
     const authz = headers.get('authorization');
     if (authz) h.set('authorization', authz);
-    const resp = await handle(new Request(sessionUrl, { method: 'GET', headers: h }));
+    // [#22398] A cookie request reads without renewal: this response's cookie
+    // is never sent (`in-process-redispatch.ts`).
+    const resp = await handle(new Request(inProcessRedispatchUrl(sessionUrl, h), { method: 'GET', headers: h }));
     if (!resp.ok) return undefined;
     const data: any = await resp.json().catch(() => null);
     // customSession shapes the payload as `{ user, session }`; be tolerant of
@@ -127,7 +130,9 @@ export async function runResendVerificationEmail(
 
   // Re-dispatch to the real better-auth route (the universal handler bypasses
   // this wrapper, so there is no recursion) with the resolved email.
-  const innerReq = new Request(sendUrl, {
+  // [#22398] The real route reads the session as well, and only its status and
+  // body come back from here — the same rule as the lookup above.
+  const innerReq = new Request(inProcessRedispatchUrl(sendUrl, headers), {
     method: 'POST',
     headers,
     body: JSON.stringify({ email, ...(callbackURL ? { callbackURL } : {}) }),
 
@@ -21,9 +21,14 @@
  * route on one path but not the other).
  */
 
-/** Minimal shape of the better-auth server API we depend on. */
+import { inProcessSessionReadInput } from '@objectstack/types';
+
+/**
+ * Minimal shape of the better-auth server API we depend on. `query` carries
+ * `disableRefresh` for a cookie request (#22398, see the call below).
+ */
 export interface SetPasswordCapableApi {
-  setPassword(opts: { body: { newPassword: string }; headers: Headers }): Promise<unknown>;
+  setPassword(opts: { body: { newPassword: string }; headers: Headers; query?: { disableRefresh: true } }): Promise<unknown>;
 }
 
 export interface SetInitialPasswordResult {
@@ -62,7 +67,13 @@ export async function runSetInitialPassword(
   try {
     // better-auth's session middleware reads the session from `headers`;
     // length checks + the "already set" guard happen inside setPassword.
-    await authApi.setPassword({ body: { newPassword }, headers: request.headers });
+    // [#22398] That read is an in-process session read whose renewed cookie
+    // would be staged on a response nobody sends, so it takes the same input
+    // a `getSession` reader does: better-auth's `getSessionFromCtx` spreads
+    // the call's `query` into the read, and the endpoint declares no query
+    // schema that would strip it. A cookie request does not renew here; a
+    // bearer-only one does, as before.
+    await authApi.setPassword({ body: { newPassword }, ...inProcessSessionReadInput(request.headers) });
     return { status: 200, body: { success: true } };
   } catch (error) {
     return mapSetPasswordError(error);