One APM session, Multiple VIPS

Still sounds like SAML. ;)

You'd basically have n+1 VIPs: one VIP is the "IdP" - the one responsible for requesting client cert, and then separate "SP" VIPs for each application. A user accesses an app VIP the first time, gets redirected to the IdP for cert authentication, and that VIP redirects back to the SP with an assertion that can contain arbitrary information that the SP's policy can use for additional evaluation (queries, SSO, etc.). When the user accesses a different app VIP, they're again redirected to the IdP, but this time they have an existing session so it's immediately redirected back with appropriate assertion without re-challenging the user.

Does that sound like it'll work for you?