@@ -0,0 +1,12 @@
+---
+'@objectstack/plugin-auth': minor
+---
+
+With SSO domain verification on, `POST /api/v1/auth/admin/sso/request-domain-verification` and `POST /api/v1/auth/admin/sso/verify-domain` answer an unknown `providerId` with `404 RESOURCE_NOT_FOUND`, no longer with `400 DOMAIN_VERIFICATION_DISABLED`
+
+Clause-②: yes (widening)
+
+- **Before.** With `OS_SSO_DOMAIN_VERIFICATION` on, a platform admin who sent a `providerId` that does not exist got `400 DOMAIN_VERIFICATION_DISABLED`, "Domain verification is not enabled for this environment (set OS_SSO_DOMAIN_VERIFICATION)": an instruction to turn on a feature that was already on. `@better-auth/sso` answers both an unmounted route (feature off) and an unknown provider (feature on) with a `404` that carries no `code`, and both bridges mapped every such `404` to the feature-off answer.
+- **Now.** The two mounts hand each bridge the environment's own setting (`AuthManager.isSsoDomainVerificationEnabled()`). Off: `400 DOMAIN_VERIFICATION_DISABLED`, as before, and the vendor is no longer called. On: a code-less vendor `404` is the provider lookup missing, answered `404 RESOURCE_NOT_FOUND` with a message naming the provider id. The decision never reads the vendor's `404` wording.
+- **Unchanged.** The platform-admin gate answers first, on or off (an anonymous caller gets `401`). A missing `providerId` is still `400 INVALID_REQUEST`. With the feature on, an existing provider still gets the vendor's own answer: the DNS record, `NO_PENDING_VERIFICATION`, `DOMAIN_VERIFICATION_FAILED`, a `403` for a provider the caller may not manage.
+- **The exported bridges.** `runRequestDomainVerification` and `runVerifyDomain` take an optional third argument, `{ domainVerificationEnabled?: boolean }`. A caller that omits it keeps the earlier mapping: a code-less `404` is answered `400 DOMAIN_VERIFICATION_DISABLED`, byte for byte. A host that mounts these helpers itself passes the environment's setting to get the not-found answer.
@@ -87,8 +87,10 @@ const mockCtx = (): PluginContext =>
 /**
  * Mount the plugin's REAL route registration on a real Hono app (the
  * auth-catchall-fallthrough.test.ts harness), with the auth manager reduced to
- * the two seams the bridges read: `getApi().getSession` (what the gate judges)
- * and `handleRequest` (where the bridge delegates).
+ * the seams the bridges read: `getApi().getSession` (what the gate judges),
+ * `handleRequest` (where the bridge delegates) and, after the gate, the two
+ * domain-verification mounts' `isSsoDomainVerificationEnabled()` [#22463] —
+ * ON here, as in `makeSsoVendor` below.
  */
 async function mountBridges(deps: {
   getSession: (headers: Headers) => unknown | Promise<unknown>;
@@ -110,6 +112,7 @@ async function mountBridges(deps: {
     getApi: async () => ({
       getSession: async ({ headers }: { headers: Headers }) => deps.getSession(headers),
     }),
+    isSsoDomainVerificationEnabled: () => true,
   };
   (plugin as any).registerAuthRoutes({ getRawApp: () => app, getPort: () => 0 }, ctx);
   return app;
 
@@ -3073,7 +3073,9 @@ export class AuthPlugin implements Plugin {
     // verify-domain} (so the per-provider admin gate runs) and reshape into the
     // `{ success, data }` envelope the action `resultDialog` / toast reads:
     // request returns the ready-to-paste DNS TXT record, verify returns a clear
-    // success/error. A 404 from the inner endpoint = feature OFF for this env.
+    // success/error. [#22463] Each hands the bridge this environment's own
+    // setting, so a feature-off answer and an unknown provider's are told apart
+    // (the vendor answers both with a code-less 404).
     rawApp.post(`${basePath}/admin/sso/request-domain-verification`, async (c: any) => {
       try {
         // #9653 — same ADR-0068 D4 platform-admin gate as /admin/sso/register
@@ -3084,6 +3086,7 @@ export class AuthPlugin implements Plugin {
         const { status, body } = await runRequestDomainVerification(
           (req) => this.authManager!.handleRequest(req),
           c.req.raw,
+          { domainVerificationEnabled: this.authManager!.isSsoDomainVerificationEnabled() },
         );
         return c.json(body, status as any);
       } catch (error) {
@@ -3101,6 +3104,7 @@ export class AuthPlugin implements Plugin {
         const { status, body } = await runVerifyDomain(
           (req) => this.authManager!.handleRequest(req),
           c.req.raw,
+          { domainVerificationEnabled: this.authManager!.isSsoDomainVerificationEnabled() },
         );
         return c.json(body, status as any);
       } catch (error) {
 
@@ -335,13 +335,54 @@ export async function runRegisterSamlProviderFromForm(
 // through the real endpoints (so the per-provider admin gate runs) and reshape
 // the response into the `{ success, data }` envelope the action `resultDialog`
 // reads — request returns the ready-to-paste DNS record; verify returns a
-// friendly success/error message. A `404` from the inner endpoint means the
-// feature is OFF for this env (endpoints unmounted) → surfaced as such, not a
-// bare "not found".
+// friendly success/error message.
+//
+// [#22463] The vendor answers two different `404`s, neither with a `code`: the
+// feature OFF (the inner route is not mounted, empty body) and, with it ON, an
+// unknown `providerId` (`checkProviderAccess`). The bridge does not tell them
+// apart by the body — its wording is the vendor's, not a contract — but by the
+// environment's own setting, which the caller hands in
+// (`AuthManager.isSsoDomainVerificationEnabled()`, the decision
+// `buildPluginList` makes for `sso({ domainVerification })`):
+//   • `false` → `400 DOMAIN_VERIFICATION_DISABLED`, without calling the vendor;
+//   • `true`  → the inner route exists, so a code-less `404` is the provider
+//               lookup missing → `404 RESOURCE_NOT_FOUND`;
+//   • omitted → the two cannot be told apart, and both keep the earlier answer,
+//               `400 DOMAIN_VERIFICATION_DISABLED` (a caller that hands no flag,
+//               such as the cloud auth proxy, sees no change).
 
 /** @better-auth/sso default verification token prefix (we don't override `tokenPrefix`). */
 const SSO_DOMAIN_TOKEN_PREFIX = 'better-auth-token';
 
+/** What the caller knows about this environment's domain-verification setting. */
+interface SsoDomainVerificationBridgeOptions {
+  /**
+   * Whether `@better-auth/sso` mounted the inner domain-verification routes on
+   * this environment. Omitted: the bridge cannot tell a feature-off `404` from
+   * an unknown provider's, and answers both as `DOMAIN_VERIFICATION_DISABLED`.
+   */
+  domainVerificationEnabled?: boolean;
+}
+
+type DomainVerificationBridgeResult = RegisterSsoFormResult & { body: RegisterSsoFormResult['body'] & { data?: any } };
+
+/** The feature is off on this environment — one answer for both routes (#10859). */
+function domainVerificationDisabled(): DomainVerificationBridgeResult {
+  return { status: 400, body: { success: false, error: { code: 'DOMAIN_VERIFICATION_DISABLED', message: 'Domain verification is not enabled for this environment (set OS_SSO_DOMAIN_VERIFICATION).' } } };
+}
+
+/**
+ * The answer to a vendor `404` that carries no `code` (see the block above).
+ * Only a caller that says the feature is on gets the not-found answer; with no
+ * flag the earlier mapping stands.
+ */
+function codelessVendorNotFound(providerId: string, options: SsoDomainVerificationBridgeOptions): DomainVerificationBridgeResult {
+  if (options.domainVerificationEnabled === true) {
+    return { status: 404, body: { success: false, error: { code: 'RESOURCE_NOT_FOUND', message: `SSO provider "${providerId}" was not found.` } } };
+  }
+  return domainVerificationDisabled();
+}
+
 /**
  * Strip protocol / path / port so `https://acme.com/` → `acme.com` for the DNS
  * record. Regex-free on purpose — `domain` is request-controlled input, so a
@@ -390,11 +431,15 @@ function forwardAuthHeaders(request: Request, origin: string): Headers {
  * return the ready-to-paste DNS record (for a one-shot `resultDialog`).
  *
  * Body: `{ providerId, domain? }` (domain only shapes the displayed record name).
+ *
+ * @param options `domainVerificationEnabled` — the environment's own setting
+ *                (see the block above); omitted keeps the earlier mapping.
  */
 export async function runRequestDomainVerification(
   handle: AuthRequestHandler,
   request: Request,
-): Promise<RegisterSsoFormResult & { body: RegisterSsoFormResult['body'] & { data?: any } }> {
+  options: SsoDomainVerificationBridgeOptions = {},
+): Promise<DomainVerificationBridgeResult> {
   let body: any;
   try { body = await request.json(); } catch { body = {}; }
   const str = (v: unknown): string => (typeof v === 'string' ? v.trim() : '');
@@ -406,6 +451,8 @@ export async function runRequestDomainVerification(
 
   const rw = rewriteSsoAdminUrl(request, /\/admin\/sso\/request-domain-verification$/, '/sso/request-domain-verification');
   if (!rw) return { status: 400, body: { success: false, error: { code: 'INVALID_REQUEST', message: 'Bad request URL' } } };
+  // [#22463] Off: the inner route is not mounted, so there is nothing to ask.
+  if (options.domainVerificationEnabled === false) return domainVerificationDisabled();
   const headers = forwardAuthHeaders(request, rw.origin);
 
   // [#22398] The inner route reads the session (`sessionMiddleware`); only its
@@ -414,9 +461,7 @@ export async function runRequestDomainVerification(
   let parsed: any = {};
   try { const t = await resp.text(); parsed = t ? JSON.parse(t) : {}; } catch { parsed = {}; }
   if (!resp.ok) {
-    if (resp.status === 404 && !parsed?.code) {
-      return { status: 400, body: { success: false, error: { code: 'DOMAIN_VERIFICATION_DISABLED', message: 'Domain verification is not enabled for this environment (set OS_SSO_DOMAIN_VERIFICATION).' } } };
-    }
+    if (resp.status === 404 && !parsed?.code) return codelessVendorNotFound(providerId, options);
     // ADR-0112: `parsed?.code` is better-auth's own code passing through — never
     // overwritten. The DEFAULT is ours, so it is the registered SCREAMING ledger
     // entry for this feature (`DOMAIN_VERIFICATION_FAILED`, @objectstack/plugin-auth)
@@ -443,11 +488,15 @@ export async function runRequestDomainVerification(
  * envelope so the action surfaces a clear toast.
  *
  * Body: `{ providerId }`.
+ *
+ * @param options `domainVerificationEnabled` — the environment's own setting
+ *                (see the block above); omitted keeps the earlier mapping.
  */
 export async function runVerifyDomain(
   handle: AuthRequestHandler,
   request: Request,
-): Promise<RegisterSsoFormResult & { body: RegisterSsoFormResult['body'] & { data?: any } }> {
+  options: SsoDomainVerificationBridgeOptions = {},
+): Promise<DomainVerificationBridgeResult> {
   let body: any;
   try { body = await request.json(); } catch { body = {}; }
   const str = (v: unknown): string => (typeof v === 'string' ? v.trim() : '');
@@ -458,6 +507,8 @@ export async function runVerifyDomain(
 
   const rw = rewriteSsoAdminUrl(request, /\/admin\/sso\/verify-domain$/, '/sso/verify-domain');
   if (!rw) return { status: 400, body: { success: false, error: { code: 'INVALID_REQUEST', message: 'Bad request URL' } } };
+  // [#22463] Off: the inner route is not mounted, so there is nothing to ask.
+  if (options.domainVerificationEnabled === false) return domainVerificationDisabled();
   const headers = forwardAuthHeaders(request, rw.origin);
 
   // [#22398] The inner route reads the session (`sessionMiddleware`); only its
@@ -468,18 +519,15 @@ export async function runVerifyDomain(
   if (resp.ok) {
     return { status: 200, body: { success: true, data: { providerId, verified: true, message: 'Domain ownership verified — this provider can now sign users in.' } } };
   }
-  // The feature is OFF for this env: `@better-auth/sso` never mounted the inner
-  // endpoint, so its `404` describes the INNER route. THIS route is mounted
-  // unconditionally, so passing that status through says "no such endpoint"
-  // about a resource that exists. Answer the sibling's answer instead — same
-  // condition, same code, same status (#10859). Before this, the branch
-  // rewrote only the `message` and let the code fall through to the generic
-  // default below, so the machine-readable field said "verification failed"
-  // while the human-readable one said "the feature is off"; a caller can only
-  // act on the first.
-  if (resp.status === 404 && !parsed?.code) {
-    return { status: 400, body: { success: false, error: { code: 'DOMAIN_VERIFICATION_DISABLED', message: 'Domain verification is not enabled for this environment (set OS_SSO_DOMAIN_VERIFICATION).' } } };
-  }
+  // A code-less `404`: with the feature on, the provider lookup missed; with no
+  // flag, the earlier answer (see the block above). When the feature is OFF,
+  // `@better-auth/sso` never mounted the inner endpoint, so its `404` describes
+  // the INNER route, while THIS route is mounted unconditionally: passing that
+  // status through would say "no such endpoint" about a resource that exists,
+  // so the off case answers the sibling's answer — same condition, same code,
+  // same status (#10859). A `404` that carries a code (`NO_PENDING_VERIFICATION`)
+  // is the vendor's own diagnosis and passes through below.
+  if (resp.status === 404 && !parsed?.code) return codelessVendorNotFound(providerId, options);
   // Friendlier copy for the expected failure modes.
   let message = parsed?.message || 'Domain verification failed';
   if (parsed?.code === 'NO_PENDING_VERIFICATION') {
 
@@ -27,7 +27,7 @@ import { describe, it, expect } from 'vitest';
 // root entry re-exports the schemas only. Reading it through the published
 // exports map (i.e. `dist`) is deliberate: this asserts against the surface a
 // consumer actually gets, not against a source file this test could reach.
-import { ERROR_CODE_LEDGER } from '@objectstack/spec/api';
+import { ERROR_CODE_LEDGER, HttpStatusErrorCodeMap } from '@objectstack/spec/api';
 import { runRequestDomainVerification, runVerifyDomain, type AuthRequestHandler } from './register-sso-provider.js';
 
 /** The default this package authors for both routes when the vendor gives no code. */
@@ -201,3 +201,106 @@ describe('#10859 the DISABLED condition gets ONE answer across both routes', ()
     expect(res.status).toBe(502);
   });
 });
+
+describe('[#22463] the environment’s own setting tells the two code-less 404s apart', () => {
+  /**
+   * The vendor answers two different 404s, neither with a `code`: the feature
+   * OFF (inner route unmounted, empty body) and, with it ON, an unknown
+   * provider (`checkProviderAccess`, `{"message":"Provider not found"}`). The
+   * bridges decide from the flag their caller hands in, never from the body:
+   * the vendor's wording is not a contract. The real-stack pins, through the
+   * mounted routes, are in `sso-domain-verification-unknown-provider.pin.test.ts`.
+   */
+  const ON = { domainVerificationEnabled: true } as const;
+  const OFF = { domainVerificationEnabled: false } as const;
+  const NOT_FOUND = 'RESOURCE_NOT_FOUND';
+  const DISABLED = 'DOMAIN_VERIFICATION_DISABLED';
+  /** A handle that records whether the vendor was asked at all. */
+  const counted = (status: number, body: unknown) => {
+    const calls: Request[] = [];
+    const inner = fakeHandle(status, body);
+    const handle: AuthRequestHandler = async (req) => {
+      calls.push(req);
+      return inner(req);
+    };
+    return { handle, calls };
+  };
+  const BRIDGES = [
+    { label: 'request-domain-verification', run: runRequestDomainVerification, url: REQUEST_URL },
+    { label: 'verify-domain', run: runVerifyDomain, url: VERIFY_URL },
+  ] as const;
+
+  it('the not-found answer is the envelope’s own code for 404 — reused, not invented', () => {
+    expect(HttpStatusErrorCodeMap[404]).toBe(NOT_FOUND);
+  });
+
+  for (const bridge of BRIDGES) {
+    it(`${bridge.label}: ON, the vendor’s code-less 404 → 404 RESOURCE_NOT_FOUND naming the provider`, async () => {
+      const { handle, calls } = counted(404, { message: 'Provider not found' });
+      const res = await bridge.run(handle, post(bridge.url), ON);
+
+      expect(calls).toHaveLength(1);
+      expect(res.body.success).toBe(false);
+      expect(res.body.error?.code).toBe(NOT_FOUND);
+      expect(res.status).toBe(404);
+      expect(res.body.error?.message).toContain('"p1"');
+      expect(res.body.error?.message).not.toContain('OS_SSO_DOMAIN_VERIFICATION');
+    });
+
+    it(`${bridge.label}: ON, the decision does not read the vendor’s 404 wording`, async () => {
+      // An empty body and a reworded one get the SAME answer as the measured
+      // body: a vendor upgrade that changes the copy changes nothing here.
+      for (const body of [undefined, { message: 'Unknown provider (reworded upstream)' }]) {
+        const res = await bridge.run(fakeHandle(404, body), post(bridge.url), ON);
+        expect(res.body.error?.code, JSON.stringify(body)).toBe(NOT_FOUND);
+        expect(res.status, JSON.stringify(body)).toBe(404);
+      }
+    });
+
+    it(`${bridge.label}: OFF → 400 DOMAIN_VERIFICATION_DISABLED, and the vendor is never asked`, async () => {
+      const { handle, calls } = counted(404, undefined);
+      const res = await bridge.run(handle, post(bridge.url), OFF);
+
+      expect(res.body.error?.code).toBe(DISABLED);
+      expect(res.status).toBe(400);
+      expect(res.body.error?.message).toContain('OS_SSO_DOMAIN_VERIFICATION');
+      expect(calls).toHaveLength(0);
+    });
+
+    it(`${bridge.label}: OFF still answers a missing providerId first, as before`, async () => {
+      const { handle, calls } = counted(404, undefined);
+      const req = new Request(bridge.url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+      const res = await bridge.run(handle, req, OFF);
+
+      expect(res.body.error?.code).toBe('INVALID_REQUEST');
+      expect(res.status).toBe(400);
+      expect(calls).toHaveLength(0);
+    });
+
+    it(`${bridge.label}: no flag (a caller such as the cloud proxy) → the earlier mapping, for both 404 shapes`, async () => {
+      for (const body of [undefined, { message: 'Provider not found' }]) {
+        const { handle, calls } = counted(404, body);
+        const res = await bridge.run(handle, post(bridge.url));
+        expect(res.body.error?.code, JSON.stringify(body)).toBe(DISABLED);
+        expect(res.status, JSON.stringify(body)).toBe(400);
+        expect(calls, JSON.stringify(body)).toHaveLength(1);
+      }
+    });
+  }
+
+  it('verify-domain: ON, a 404 that CARRIES a vendor code is still the vendor’s answer', async () => {
+    const res = await runVerifyDomain(fakeHandle(404, { code: VENDOR_CODE, message: 'vendor copy' }), post(VERIFY_URL), ON);
+
+    expect(res.body.error?.code).toBe(VENDOR_CODE);
+    expect(res.status).toBe(404);
+    expect(res.body.error?.message).toContain('Request Domain Verification');
+  });
+
+  it('request-domain-verification: ON, the vendor’s 201 still yields the DNS record', async () => {
+    const res = await runRequestDomainVerification(fakeHandle(201, { domainVerificationToken: 'tok' }), post(REQUEST_URL), ON);
+
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBe(true);
+    expect(res.body.data?.dnsRecordValue).toBe('_better-auth-token-p1=tok');
+  });
+});