@@ -173,9 +173,12 @@ describe('every new APIError( in plugin-auth/src carries an ADR-0112 code (#2424
     // 24, `objectql-adapter.ts` 3, `impersonation-bearer-rotation.ts` 2,
     // `admin-impersonate-endpoint.ts` 1). A floor, not an exact count, so a new
     // throw does not have to edit this line; only losing them does.
+    // [#25224] `AuthManager`'s throws are counted over the files its methods'
+    // bodies live in: `auth-manager.ts` and the bodies moved out of it whole.
+    const authManagerFiles = ['auth-manager.ts', 'auth-manager-actor-guards.ts'];
     expect(sites.length).toBeGreaterThanOrEqual(30);
     expect(new Set(sites.map((s) => s.file)).size).toBeGreaterThanOrEqual(4);
-    expect(perFile.find((f) => f.file === 'auth-manager.ts')?.sites.length ?? 0).toBeGreaterThanOrEqual(24);
+    expect(perFile.filter((f) => authManagerFiles.includes(f.file)).reduce((n, f) => n + f.sites.length, 0)).toBeGreaterThanOrEqual(24);
   });
 
   it('the textual control agrees with the walk in every file', () => {
 
@@ -319,7 +319,11 @@ function betterAuthPluginSet(): unknown[] {
  * they declare no schema.
  */
 function authManagerPluginFactories(): string[] {
-  const source = readFileSync(join(PKG, 'src', 'auth-manager.ts'), 'utf8');
+  // [#25224] The auth manager's source: `auth-manager.ts` and the method
+  // bodies moved out of it whole. A factory imported in either is one it loads.
+  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts']
+    .map((file) => readFileSync(join(PKG, 'src', file), 'utf8'))
+    .join('\n');
   const found = new Set<string>();
   const pattern =
     /const\s*\{\s*([A-Za-z0-9_]+)\s*\}\s*=\s*await import\('((?:better-auth\/plugins|@better-auth\/)[^']*)'\)/g;
 
@@ -629,7 +629,11 @@ function findCollisions(
  * they declare no schema.
  */
 function authManagerPluginFactories(): string[] {
-  const source = readFileSync(join(HERE, 'auth-manager.ts'), 'utf8');
+  // [#25224] The auth manager's source: `auth-manager.ts` and the method
+  // bodies moved out of it whole. A factory imported in either is one it loads.
+  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts']
+    .map((file) => readFileSync(join(HERE, file), 'utf8'))
+    .join('\n');
   const found = new Set<string>();
   const pattern =
     /const\s*\{\s*([A-Za-z0-9_]+)\s*\}\s*=\s*await import\('((?:better-auth\/plugins|@better-auth\/)[^']*)'\)/g;
 
@@ -154,6 +154,21 @@ function recordAttemptedWrites(engine: ObjectQL): string[] {
   return attempted;
 }
 
+/**
+ * The first `AuthManager` method on `stack`: an `AuthManager.<method>` frame,
+ * or [#25224] a frame of a method's body moved whole into
+ * `auth-manager-actor-guards.ts`, which runs under the method's own name (a
+ * helper of that module that is no method of the class does not count).
+ */
+function firstAuthManagerMethod(stack: string): string | undefined {
+  const methods = new Set(Object.getOwnPropertyNames(AuthManager.prototype));
+  for (const match of stack.matchAll(/AuthManager\.(\w+)|at (?:async )?(?:Object\.)?(\w+) \([^)\n]*auth-manager-actor-guards\.ts:/g)) {
+    if (match[1] !== undefined) return match[1];
+    if (methods.has(match[2])) return match[2];
+  }
+  return undefined;
+}
+
 /** The current stack, deep enough to reach the request's frames (V8 keeps ten by default). */
 function deepStack(): string {
   const limit = Error.stackTraceLimit;
@@ -191,7 +206,7 @@ function failAdmissionRead(engine: ObjectQL, read: AdmissionRead) {
     const real = target[method].bind(engine);
     return vi.spyOn(target, method).mockImplementation(async (name: string, ...rest: unknown[]) => {
       const stack = deepStack();
-      const first = /AuthManager\.(\w+)/.exec(stack)?.[1];
+      const first = firstAuthManagerMethod(stack);
       if (fired < times && name === object && stack.includes('assertOrganizationDeletable') && stack.includes(frame) && first === caller) {
         fired += 1;
         throw new Error(`${object} store unavailable (injected)`);
 
@@ -434,7 +434,8 @@ export const UNREGISTERED_CODE_SITES: readonly UnregisteredCodeSite[] = [
     },
     {
         code: 'YOU_ARE_NOT_ALLOWED_TO_DELETE_THIS_MEMBER',
-        file: 'packages/plugins/plugin-auth/src/auth-manager.ts',
+        // [#25224] The stamp moved with `assertRemoveMemberPermitted`'s body.
+        file: 'packages/plugins/plugin-auth/src/auth-manager-actor-guards.ts',
         shape: 'objlitconst',
         door: 'none',
         verdict: 'foreign-vocabulary',