diff --git a/e2e/ci-selection.ts b/e2e/ci-selection.ts
index 85d7bbd01f..2f200339d1 100644
--- a/e2e/ci-selection.ts
+++ b/e2e/ci-selection.ts
@@ -591,6 +591,7 @@ const suiteConfigs: Record<string, () => Promise<unknown>> = {
   "export-public.config.ts": () => import("./export-public.config.ts"),
   "docker-release.config.ts": () => import("./docker-release.config.ts"),
   "self-host-native.config.ts": () => import("./self-host-native.config.ts"),
+  "self-host-root-inspection.config.ts": () => import("./self-host-root-inspection.config.ts"),
   "installer.config.ts": () => import("./installer.config.ts"),
   "local-bootstrap.config.ts": () => import("./local-bootstrap.config.ts"),
   "npm-launcher.config.ts": () => import("./npm-launcher.config.ts"),
diff --git a/e2e/docker-release.config.ts b/e2e/docker-release.config.ts
index d0303c8b6f..7cb3e89079 100644
--- a/e2e/docker-release.config.ts
+++ b/e2e/docker-release.config.ts
@@ -12,6 +12,7 @@ export default defineConfig({
       "e2e/tests/docker-release-watchdog.spec.ts",
       "e2e/tests/docker-release-app-isolation.spec.ts",
       "e2e/tests/docker-oauth-renewal.spec.ts",
+      "e2e/tests/docker-release-sso-admission.spec.ts",
       "e2e/tests/workflow-engine.spec.ts",
     ],
     testTimeout: 180_000,
diff --git a/e2e/self-host-root-inspection.config.ts b/e2e/self-host-root-inspection.config.ts
new file mode 100644
index 0000000000..409fa31205
--- /dev/null
+++ b/e2e/self-host-root-inspection.config.ts
@@ -0,0 +1,6 @@
+import { defineConfig } from "vitest/config";
+
+/** The offline self-host root gate, run as a separate process over synthetic PGlite archives. */
+export default defineConfig({
+  test: { include: ["e2e/tests/self-host-root-inspection.spec.ts"], testTimeout: 60_000 },
+});
diff --git a/e2e/test-plan.ts b/e2e/test-plan.ts
index 396ba1f38f..5ede864484 100644
--- a/e2e/test-plan.ts
+++ b/e2e/test-plan.ts
@@ -227,6 +227,39 @@ export const scenarios = plan({
       local: na("Local has no hosted organizations."),
     },
   },
+  selfHostSetupRace: {
+    legacyStorage: true,
+    file: "self-host-setup-integrity.spec.ts",
+    title:
+      "five callers racing to set up a fresh self-host leave one owner, one organization and one root record",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud has no instance setup."),
+      local: na("Local has no hosted organizations."),
+    },
+  },
+  selfHostSetupRollback: {
+    legacyStorage: true,
+    file: "self-host-setup-integrity.spec.ts",
+    title:
+      "a self-host setup that fails partway leaves no account, organization or root record, and a retry succeeds",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud has no instance setup."),
+      local: na("Local has no hosted organizations."),
+    },
+  },
+  selfHostOrganizationCreationForgedCallers: {
+    fixtures: "actors",
+    file: "self-host-organization-creation.spec.ts",
+    title:
+      "self-host organization creation ignores a body naming the owner and refuses the owner's own API key and OAuth token",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud lets every signed-in account create a team; its onboarding decides."),
+      local: na("Local has no hosted organizations."),
+    },
+  },
   selfHostOrganizationSwitcher: {
     fixtures: "actors",
     file: "self-host-organization-switcher.spec.ts",
@@ -240,6 +273,19 @@ export const scenarios = plan({
       local: na("Local has no hosted organizations."),
     },
   },
+  selfHostOrganizationSwitcherCapabilityUnavailable: {
+    fixtures: "actors",
+    file: "self-host-organization-switcher.spec.ts",
+    title:
+      "the self-host switcher offers no creation while the capability answer is pending or failed, and recovers on reload",
+    targets: {
+      "self-host": scheduled,
+      cloud: na(
+        "Cloud offers creation to every signed-in account; its switcher has its own scenarios.",
+      ),
+      local: na("Local has no hosted organizations."),
+    },
+  },
   selfHostOrganizationCreationBootstrap: {
     legacyStorage: true,
     file: "self-host-organization-creation.spec.ts",
diff --git a/e2e/tests/docker-release-sso-admission.spec.ts b/e2e/tests/docker-release-sso-admission.spec.ts
new file mode 100644
index 0000000000..a6a0f93cf2
--- /dev/null
+++ b/e2e/tests/docker-release-sso-admission.spec.ts
@@ -0,0 +1,332 @@
+/**
+ * The self-host image admits only invited members through SSO. The synthetic OpenID provider runs
+ * on the runner. A sidecar owns the container network: it publishes the product's port and
+ * forwards the provider's HTTPS address, so the image reads discovery from the same
+ * `https://127.0.0.1` issuer and trusts its certificate through `NODE_EXTRA_CA_CERTS`, without
+ * disabling TLS checks. The sign-in flow runs over HTTP exactly as a browser follows it.
+ */
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:net";
+import { expect, it } from "@effect/vitest";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { Config, Console, Effect, Exit, Schedule, Schema } from "effect";
+import { FetchHttpClient } from "effect/http";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { driver } from "../support/platform.ts";
+import { selfHostSsoIdp, type IdentityMode } from "../support/sso.ts";
+
+const password = "Synthetic-release-password-123!";
+const forwarder = `const net = require("node:net");
+const [port, host] = [Number(process.argv[1]), process.argv[2]];
+net.createServer((client) => {
+  const upstream = net.connect(port, host);
+  client.pipe(upstream).pipe(client);
+  client.on("error", () => upstream.destroy());
+  upstream.on("error", () => client.destroy());
+}).listen(port, "127.0.0.1");`;
+
+const freePort = driver(
+  "allocate port",
+  () =>
+    new Promise<number>((resolve, reject) => {
+      const listener = createServer();
+      listener.once("error", reject);
+      listener.listen(0, "127.0.0.1", () => {
+        const address = listener.address();
+        listener.close(() =>
+          address === null || typeof address === "string"
+            ? reject(new Error("No test port"))
+            : resolve(address.port),
+        );
+      });
+    }),
+);
+
+/** A cookie jar for one person's requests, following redirects by hand as a browser does. */
+const client = (origin: string) => {
+  const cookies = new Map<string, string>();
+  const send = (url: string, init: RequestInit = {}) =>
+    driver(`${init.method ?? "GET"} ${new URL(url).pathname}`, (signal) =>
+      fetch(url, {
+        ...init,
+        signal,
+        redirect: "manual",
+        headers: {
+          ...(new URL(url).origin === origin ? { origin } : {}),
+          ...(init.body === undefined ? {} : { "content-type": "application/json" }),
+          ...(cookies.size === 0 || new URL(url).origin !== origin
+            ? {}
+            : { cookie: [...cookies].map(([name, value]) => `${name}=${value}`).join("; ") }),
+        },
+      }),
+    ).pipe(
+      Effect.tap((response) =>
+        Effect.sync(() => {
+          if (new URL(url).origin !== origin) return;
+          for (const header of response.headers.getSetCookie()) {
+            const [pair = ""] = header.split(";");
+            const at = pair.indexOf("=");
+            const [name, value] = [pair.slice(0, at), pair.slice(at + 1)];
+            if (value === "" || /max-age=0/i.test(header)) cookies.delete(name);
+            else cookies.set(name, value);
+          }
+        }),
+      ),
+    );
+  const json = (path: string, data?: unknown) =>
+    send(
+      `${origin}${path}`,
+      data === undefined ? {} : { method: "POST", body: JSON.stringify(data) },
+    );
+  const read = (path: string) =>
+    json(path).pipe(Effect.flatMap((response) => driver(`read ${path}`, () => response.json())));
+  return { send, json, read, cookies };
+};
+
+/**
+ * Start the provider, the sidecar and the image under test with SSO configured, and set up the
+ * owner. Everything is removed when the scope closes.
+ */
+const ssoImage = Effect.gen(function* () {
+  const processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const image = yield* Config.String("EXECUTOR_E2E_DOCKER_IMAGE");
+  const docker = (args: readonly string[]) =>
+    processes.string(ChildProcess.make("docker", args, { extendEnv: true }));
+  const port = yield* freePort;
+  const origin = `http://127.0.0.1:${port}`;
+  const idp = yield* selfHostSsoIdp(origin);
+  const issuerPort = new URL(idp.issuer).port;
+  const name = `executor-sso-${randomBytes(6).toString("hex")}`;
+  yield* Effect.acquireRelease(
+    docker([
+      "run",
+      "--detach",
+      "--name",
+      `${name}-network`,
+      "--add-host",
+      "sso-idp.e2e.internal:host-gateway",
+      "--publish",
+      `127.0.0.1:${port}:8080`,
+      "node:24.22.1-bookworm-slim",
+      "node",
+      "-e",
+      forwarder,
+      issuerPort,
+      "sso-idp.e2e.internal",
+    ]),
+    () => docker(["rm", "--force", `${name}-network`]).pipe(Effect.orDie),
+  );
+  const environment = {
+    DO_NOT_TRACK: "1",
+    PORT: "8080",
+    BETTER_AUTH_URL: origin,
+    BETTER_AUTH_SECRET: randomBytes(32).toString("hex"),
+    EXECUTOR_ENCRYPTION_KEY: randomBytes(32).toString("hex"),
+    SSO_DISCOVERY_URL: idp.discoveryUrl,
+    SSO_CLIENT_ID: "synthetic-sso-client",
+    SSO_CLIENT_SECRET: "synthetic-sso-secret",
+    SSO_ALLOWED_DOMAINS: "sso.example.test",
+    NODE_EXTRA_CA_CERTS: "/run/sso-ca.pem",
+  };
+  yield* Effect.acquireRelease(
+    processes.string(
+      ChildProcess.make(
+        "docker",
+        [
+          "run",
+          "--detach",
+          "--name",
+          name,
+          "--init",
+          "--network",
+          `container:${name}-network`,
+          "--volume",
+          `${idp.certificate}:/run/sso-ca.pem:ro`,
+          ...Object.keys(environment).flatMap((variable) => ["--env", variable]),
+          image,
+        ],
+        { env: environment, extendEnv: true },
+      ),
+    ),
+    () => docker(["rm", "--force", "--volumes", name]).pipe(Effect.orDie),
+  );
+  yield* Effect.addFinalizer((exit) =>
+    Exit.isFailure(exit)
+      ? docker(["logs", name]).pipe(Effect.flatMap(Console.error), Effect.ignore)
+      : Effect.void,
+  );
+  const owner = client(origin);
+  yield* owner.json("/health").pipe(
+    Effect.flatMap((response) =>
+      response.status === 200 ? Effect.void : Effect.fail("not ready"),
+    ),
+    Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 240 }),
+  );
+  const imageId = (yield* docker(["inspect", "--format", "{{.Image}}", name])).trim();
+  const build = (yield* owner.json("/")).headers.get("executor-build");
+  expect(
+    (yield* owner.json("/api/auth/self-host/setup", {
+      name: "SSO Owner",
+      email: "owner@sso.example.test",
+      password,
+      organizationName: "SSO root",
+    })).status,
+  ).toBe(200);
+  const [organization] = yield* owner
+    .read("/api/auth/organization/list")
+    .pipe(
+      Effect.flatMap(
+        Schema.decodeUnknownEffect(Schema.Array(Schema.Struct({ id: Schema.String }))),
+      ),
+    );
+  if (organization === undefined) return yield* Effect.die("Setup created no organization");
+  /**
+   * Follow one OAuth start (`/sign-in/social` or `/link-social`, as the dashboard calls them) through the provider and back to
+   * the product's callback, and return where the callback sends the browser.
+   */
+  const ssoFlow = (
+    person: ReturnType<typeof client>,
+    email: string,
+    mode: IdentityMode,
+    start: "/api/auth/sign-in/social" | "/api/auth/link-social",
+  ) =>
+    Effect.gen(function* () {
+      yield* idp.configure(email, mode);
+      const started = yield* person
+        .json(
+          start,
+          start === "/api/auth/sign-in/social"
+            ? { provider: "sso", callbackURL: "/", errorCallbackURL: "/login" }
+            : {
+                provider: "sso",
+                callbackURL: "/account/security",
+                errorCallbackURL: "/account/security",
+              },
+        )
+        .pipe(
+          Effect.flatMap((response) =>
+            driver("read OAuth start", () => response.text()).pipe(
+              Effect.map((text) => ({ status: response.status, text })),
+            ),
+          ),
+        );
+      const { url } = yield* Schema.decodeUnknownEffect(
+        Schema.fromJsonString(Schema.Struct({ url: Schema.String })),
+      )(started.text).pipe(
+        Effect.mapError(
+          () => new Error(`${start} answered ${started.status}: ${started.text.slice(0, 300)}`),
+        ),
+      );
+      // The browser cannot trust the synthetic certificate; it reaches the same sign-in page on
+      // the provider's loopback HTTP listener, as the browser scenarios route it.
+      const authorize = new URL(url);
+      const provider = yield* person.send(`${idp.origin}${authorize.pathname}${authorize.search}`);
+      const callback = provider.headers.get("location");
+      if (callback === null) return yield* Effect.die("The provider did not redirect back");
+      const answered = yield* person.send(callback);
+      return new URL(answered.headers.get("location") ?? "/", origin);
+    });
+  const session = (person: ReturnType<typeof client>) =>
+    person
+      .read("/api/auth/get-session")
+      .pipe(
+        Effect.flatMap(
+          Schema.decodeUnknownEffect(
+            Schema.NullOr(Schema.Struct({ user: Schema.Struct({ email: Schema.String }) })),
+          ),
+        ),
+      );
+  return { origin, owner, organization, ssoFlow, session, imageId, build };
+});
+
+const signIn = (
+  sso: Effect.Success<typeof ssoImage>,
+  person: ReturnType<typeof client>,
+  email: string,
+  mode: IdentityMode,
+) => sso.ssoFlow(person, email, mode, "/api/auth/sign-in/social");
+
+it.live("the self-host image refuses SSO for anyone without a membership and says why", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const sso = yield* ssoImage;
+      yield* Console.log(`image ${sso.imageId} build ${sso.build}`);
+      const expectRefused = (email: string, mode: IdentityMode, code: string) =>
+        Effect.gen(function* () {
+          const person = client(sso.origin);
+          const landed = yield* signIn(sso, person, email, mode);
+          expect(landed.pathname, email).toBe("/login");
+          expect(landed.searchParams.get("error"), email).toBe(code);
+          expect(yield* sso.session(person), email).toBeNull();
+        });
+      // Verified, from the approved domain, never invited: SSO adds no one.
+      yield* expectRefused("stranger@sso.example.test", "valid", "sso_not_member");
+      yield* expectRefused("unverified@sso.example.test", "unverified", "sso_email_unverified");
+      yield* expectRefused("member@outside.example.test", "valid", "sso_domain_not_allowed");
+      const members = yield* sso.owner.read(
+        `/api/auth/organization/list-members?organizationId=${sso.organization.id}`,
+      );
+      expect(members).toMatchObject({ total: 1, members: [{ role: "owner" }] });
+    }),
+  ).pipe(Effect.provide([NodeServices.layer, FetchHttpClient.layer])),
+);
+
+it.live(
+  "the self-host image signs in an invited member through SSO and refuses them once removed",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const sso = yield* ssoImage;
+        yield* Console.log(`image ${sso.imageId} build ${sso.build}`);
+        const invited = yield* sso.owner
+          .json("/api/auth/organization/invite-member", {
+            organizationId: sso.organization.id,
+            email: "member@sso.example.test",
+            role: "member",
+          })
+          .pipe(
+            Effect.flatMap((response) => driver("read invitation", () => response.json())),
+            Effect.flatMap(Schema.decodeUnknownEffect(Schema.Struct({ id: Schema.String }))),
+          );
+        const member = client(sso.origin);
+        expect(
+          (yield* member.json("/api/auth/self-host/register", {
+            invitation: invited.id,
+            email: "member@sso.example.test",
+            name: "SSO Member",
+            password,
+          })).status,
+        ).toBe(200);
+        expect(yield* member.read("/api/auth/organization/list")).toMatchObject([
+          { id: sso.organization.id },
+        ]);
+        // The registered member connects SSO from Security; the link is not a sign-in.
+        const linked = yield* sso.ssoFlow(
+          member,
+          "member@sso.example.test",
+          "valid",
+          "/api/auth/link-social",
+        );
+        expect(linked.searchParams.get("error")).toBeNull();
+
+        const returning = client(sso.origin);
+        const admitted = yield* signIn(sso, returning, "member@sso.example.test", "valid");
+        expect(admitted.searchParams.get("error")).toBeNull();
+        expect(yield* sso.session(returning)).toMatchObject({
+          user: { email: "member@sso.example.test" },
+        });
+
+        expect(
+          (yield* sso.owner.json("/api/auth/organization/remove-member", {
+            organizationId: sso.organization.id,
+            memberIdOrEmail: "member@sso.example.test",
+          })).status,
+        ).toBe(200);
+        const removed = client(sso.origin);
+        const refused = yield* signIn(sso, removed, "member@sso.example.test", "valid");
+        expect(refused.pathname).toBe("/login");
+        expect(refused.searchParams.get("error")).toBe("sso_not_member");
+        expect(yield* sso.session(removed)).toBeNull();
+      }),
+    ).pipe(Effect.provide([NodeServices.layer, FetchHttpClient.layer])),
+);
diff --git a/e2e/tests/self-host-organization-creation.spec.ts b/e2e/tests/self-host-organization-creation.spec.ts
index a93da3626a..66e4847952 100644
--- a/e2e/tests/self-host-organization-creation.spec.ts
+++ b/e2e/tests/self-host-organization-creation.spec.ts
@@ -11,6 +11,10 @@ import { Api, body, type Session } from "../support/api.ts";
 import { HostedLive, withCase, withHostedCase } from "../support/case.ts";
 import { Organization, Resource } from "../support/contracts.ts";
 import { legacyStorage } from "../support/legacy-storage.ts";
+import { McpClient } from "../support/mcp-client.ts";
+import { consentTo } from "../support/mcp-connections.ts";
+import { Target } from "../support/platform.ts";
+import { targetHosts } from "../support/role-hosts.ts";
 import { serverControl } from "../support/server-control.ts";
 import { scenarios } from "../test-plan.ts";
 
@@ -22,6 +26,8 @@ const Members = Schema.Struct({
   ),
 });
 const Configuration = Schema.Struct({ setup: Schema.Boolean });
+const SessionUser = Schema.Struct({ user: Schema.Struct({ id: Schema.String }) });
+const Capabilities = Schema.Struct({ createOrganization: Schema.Boolean });
 
 const create = (session: Session, name: string, headers?: Record<string, string>) =>
   Effect.flatMap(Api, (api) =>
@@ -141,6 +147,92 @@ layer(HostedLive, { excludeTestServices: true })("Self-host organization creatio
     ),
   );
 
+  it.effect(scenarios.selfHostOrganizationCreationForgedCallers.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors,
+          target = yield* Target;
+        const root = actors.organization.id;
+        const anonymous = yield* api.session();
+        const owner = yield* body(
+          SessionUser,
+          yield* api.request(actors.owner, "GET", "/api/auth/get-session"),
+        );
+        const capabilities = (session: Session, headers?: Record<string, string>) =>
+          api.request(session, "GET", "/api/auth/self-host/capabilities", undefined, headers);
+        const answer = (session: Session) =>
+          capabilities(session).pipe(
+            Effect.flatMap((response) => body(Capabilities, response)),
+            Effect.map((value) => value.createOrganization),
+          );
+        expect(yield* answer(actors.owner)).toBe(true);
+        expect(yield* answer(actors.admin)).toBe(false);
+        expect(yield* answer(actors.member)).toBe(false);
+        expect((yield* capabilities(anonymous)).status).toBe(401);
+
+        // Better Auth takes the creator from the session; a body naming the owner changes nothing.
+        const spoof = (session: Session) =>
+          api.request(session, "POST", "/api/auth/organization/create", {
+            name: "Spoofed team",
+            slug: `spoof-${randomUUID().slice(0, 8)}`,
+            keepCurrentActiveOrganization: true,
+            userId: owner.user.id,
+          });
+        expect((yield* spoof(actors.admin)).status).toBe(403);
+        expect((yield* spoof(actors.member)).status).toBe(403);
+        expect((yield* spoof(anonymous)).status).toBe(401);
+
+        const key = yield* body(
+          Key,
+          yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
+            name: "Owner key",
+          }),
+        );
+        const consent = yield* consentTo(actors.owner, `${targetHosts(target).mcp}/mcp`, {
+          "x-executor-organization": root,
+        });
+        expect(consent.status, JSON.stringify(consent)).toBe(200);
+        const oauth = yield* consent.tokens;
+        // Each credential is the owner's and valid where it was issued: the API key at the
+        // organization API, the OAuth token, bound to the MCP resource, through an MCP client.
+        expect(
+          (yield* api.request(anonymous, "GET", `/api/organizations/${root}/access`, undefined, {
+            authorization: `Bearer ${Redacted.value(key.key)}`,
+          })).status,
+        ).toBe(200);
+        yield* (yield* McpClient).connect(oauth, "creation-refusal", { organization: root });
+        for (const [label, token] of [
+          ["API key", Redacted.value(key.key)],
+          ["OAuth access token", Redacted.value(oauth)],
+        ] as const) {
+          const bearer = { authorization: `Bearer ${token}`, "x-executor-organization": root };
+          expect((yield* create(anonymous, `${label} team`, bearer)).status, label).toBe(401);
+          expect((yield* capabilities(anonymous, bearer)).status, label).toBe(401);
+          expect(
+            (yield* api.request(
+              anonymous,
+              "POST",
+              "/api/auth/organization/create",
+              {
+                name: `${label} spoof`,
+                slug: `bearer-${randomUUID().slice(0, 8)}`,
+                keepCurrentActiveOrganization: true,
+                userId: owner.user.id,
+              },
+              bearer,
+            )).status,
+            `${label} naming the owner`,
+          ).toBe(401);
+        }
+        expect((yield* listed(actors.owner)).map((organization) => organization.id)).toEqual([
+          root,
+        ]);
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+
   it.effect(scenarios.selfHostOrganizationCreationBootstrap.title, (context) =>
     withCase(
       context,
diff --git a/e2e/tests/self-host-organization-switcher.spec.ts b/e2e/tests/self-host-organization-switcher.spec.ts
index 79d8b98456..075ce11c8b 100644
--- a/e2e/tests/self-host-organization-switcher.spec.ts
+++ b/e2e/tests/self-host-organization-switcher.spec.ts
@@ -120,4 +120,83 @@ layer(HostedLive, { excludeTestServices: true })("Self-host organization switche
       }),
     ),
   );
+  it.effect(scenarios.selfHostOrganizationSwitcherCapabilityUnavailable.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const actors = yield* Actors,
+          browser = yield* Browser;
+        const root = actors.organization;
+        const origin = targetHosts(yield* Target).browser;
+        let arrived = () => {};
+        const arrival = new Promise<void>((resolve) => {
+          arrived = resolve;
+        });
+        let release = () => {};
+        const held = new Promise<void>((resolve) => {
+          release = resolve;
+        });
+        const creation = (page: Page) =>
+          page.getByRole("menuitem", { name: "Create organization", exact: true }).count();
+        const openSwitcher = (page: Page) =>
+          switcher(page)
+            .click()
+            .then(() =>
+              page.getByRole("menuitemradio", { name: "Evidence lab", exact: true }).waitFor(),
+            );
+
+        yield* browser.login(actors.owner);
+        yield* browser.use("Hold the capability answer", (page) =>
+          page.route("**/api/auth/self-host/capabilities", (route) => {
+            arrived();
+            return held.then(() =>
+              route.fulfill({
+                status: 503,
+                contentType: "application/json",
+                body: JSON.stringify({ message: "Authentication is unavailable. Try again." }),
+              }),
+            );
+          }),
+        );
+        yield* browser.use("The owner opens the root's apps", (page) =>
+          page.goto(`${origin}/org/${root.slug}/apps`).then(() => arrival),
+        );
+        expect(
+          yield* browser.use("While the answer is pending, no create action", (page) =>
+            openSwitcher(page).then(() => creation(page)),
+          ),
+        ).toBe(0);
+        yield* browser.checkpoint("No create action while the capability is pending");
+        yield* browser.use("Close the switcher", (page) => page.keyboard.press("Escape"));
+
+        yield* browser.use("The capability answer fails", (page) =>
+          Promise.all([
+            page.waitForResponse((response) =>
+              response.url().endsWith("/api/auth/self-host/capabilities"),
+            ),
+            Promise.resolve().then(release),
+          ]),
+        );
+        expect(
+          yield* browser.use("After a failed answer, no create action", (page) =>
+            openSwitcher(page).then(() => creation(page)),
+          ),
+        ).toBe(0);
+        yield* browser.checkpoint("No create action after the capability fails");
+        yield* browser.use("Close the switcher", (page) => page.keyboard.press("Escape"));
+
+        yield* browser.use("The server answers again", (page) =>
+          page.unroute("**/api/auth/self-host/capabilities"),
+        );
+        expect(
+          yield* browser.use("Reload the root's apps", (page) => openApps(page, origin, root.slug)),
+        ).toEqual({ createOrganization: true });
+        expect(
+          yield* browser.use("Once the server answers, the owner may create", (page) =>
+            openSwitcher(page).then(() => creation(page)),
+          ),
+        ).toBe(1);
+      }),
+    ),
+  );
 });
diff --git a/e2e/tests/self-host-root-inspection.spec.ts b/e2e/tests/self-host-root-inspection.spec.ts
new file mode 100644
index 0000000000..4fa0544b70
--- /dev/null
+++ b/e2e/tests/self-host-root-inspection.spec.ts
@@ -0,0 +1,620 @@
+/**
+ * The offline root-record gate (`scripts/inspect-self-host-root.ts`) run as an operator runs it:
+ * a separate Node process over a PGlite data-directory archive and a recorded baseline. The
+ * archives are real PGlite dumps with the product's table and column names. Every case checks
+ * the exit code, the fixed report, and that neither stream carries rows, SQL errors, stack
+ * traces or the session token planted in each archive.
+ */
+import { expect, it } from "@effect/vitest";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { Effect, FileSystem, Path, Schema, Stream } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
+const root = "org-root-1";
+const owners = ["user-owner-a", "user-owner-b"];
+const canary = "CANARY-SESSION-TOKEN-7d1f";
+
+const schema = [
+  `create table "organization" ("id" text primary key, "name" text not null, "slug" text not null)`,
+  `create table "member" ("id" text primary key, "organizationId" text not null, "userId" text not null, "role" text not null)`,
+  `create table "session" ("id" text primary key, "token" text not null)`,
+  `insert into "session" values ('session-1', '${canary}')`,
+];
+const rootTable = `create table "selfHostRoot" ("id" text not null, "organizationId" text not null)`;
+const journalTable = `create table private_self_host_migrations (migration_id integer primary key, created_at timestamptz not null default now(), name text not null)`;
+const organizations = [
+  `insert into "organization" values ('${root}', 'Root', 'executor'), ('org-second', 'Second', 'second')`,
+  `insert into "member" values
+    ('m1', '${root}', 'user-owner-a', 'owner'),
+    ('m2', '${root}', 'user-owner-b', 'owner'),
+    ('m3', '${root}', 'user-admin', 'admin'),
+    ('m4', 'org-second', 'user-outsider', 'owner')`,
+];
+const recorded = [`insert into "selfHostRoot" values ('root', '${root}')`];
+const journal = [
+  `insert into private_self_host_migrations (migration_id, name) values (1, 'root_organization')`,
+];
+/** An upgraded install whose root has two legitimate owners. */
+const valid = [...schema, rootTable, journalTable, ...organizations, ...recorded, ...journal];
+
+/** Builds one archive: `node --eval builder <statements.json> <out.tar>`. */
+const builder = `
+import { readFileSync, writeFileSync } from "node:fs";
+import { PGlite } from "@electric-sql/pglite";
+const [input, output] = process.argv.slice(1);
+const db = new PGlite();
+try {
+  for (const statement of JSON.parse(readFileSync(input, "utf8"))) await db.exec(statement);
+  writeFileSync(output, new Uint8Array(await (await db.dumpDataDir("none")).arrayBuffer()));
+} finally {
+  await db.close();
+}
+`;
+
+/** The full journals 7c4922535596a6fe86938a8acbe0078107ce2bca (#81) writes on self-host. */
+const hostedTable = `create table private_hosted_migrations (migration_id integer primary key, created_at timestamptz not null default now(), name text not null)`;
+const hostedJournal = [
+  "baseline",
+  "api_key_memberships",
+  "upgrade_executor_apps",
+  "data_steps",
+  "upgrade_executor_apps",
+  "upgrade_pinned_executor_apps",
+  "require_connection_targets",
+  "oauth_client_access",
+  "app_account_links",
+].map(
+  (name, index) =>
+    `insert into private_hosted_migrations (migration_id, name) values (${index + 1}, '${name}')`,
+);
+/** An install #81 just upgraded: one organization and exactly the journals #81 writes. */
+const rolloutReady = [
+  ...schema,
+  rootTable,
+  journalTable,
+  hostedTable,
+  `insert into "organization" values ('${root}', 'Root', 'executor')`,
+  `insert into "member" values
+    ('m1', '${root}', 'user-owner-a', 'owner'),
+    ('m2', '${root}', 'user-owner-b', 'owner'),
+    ('m3', '${root}', 'user-admin', 'admin')`,
+  ...recorded,
+  ...journal,
+  ...hostedJournal,
+];
+
+const baseline = (ownerUserIds: readonly string[] = owners, organizationId = root) =>
+  JSON.stringify({ version: 1, organizationId, ownerUserIds });
+
+const Report = Schema.Struct({
+  gate: Schema.Literals(["pass", "fail", "invalid", "error"]),
+  reason: Schema.optionalKey(Schema.String),
+  missingOwners: Schema.optionalKey(Schema.Array(Schema.String)),
+  unexpectedOwners: Schema.optionalKey(Schema.Number),
+  checks: Schema.optionalKey(Schema.Record(Schema.String, Schema.Boolean)),
+  journals: Schema.optionalKey(Schema.Record(Schema.String, Schema.Json)),
+});
+
+const workspace = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem,
+    path = yield* Path.Path,
+    processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const directory = yield* fs.makeTempDirectoryScoped({ prefix: "executor-root-inspection-" });
+  let files = 0;
+  const file = (contents: string | Uint8Array) =>
+    Effect.gen(function* () {
+      const target = path.join(directory, `fixture-${files++}`);
+      yield* typeof contents === "string"
+        ? fs.writeFileString(target, contents)
+        : fs.writeFile(target, contents);
+      return target;
+    });
+  /**
+   * A PGlite data-directory dump of a database built from `statements`, as export writes it. The
+   * dump is made in its own Node process with the repository's pinned PGlite.
+   */
+  const dump = (statements: readonly string[]) =>
+    Effect.gen(function* () {
+      const input = yield* file(JSON.stringify(statements));
+      const output = `${input}.tar`;
+      yield* processes.string(
+        ChildProcess.make("node", ["--input-type=module", "--eval", builder, input, output], {
+          cwd: path.resolve("."),
+        }),
+      );
+      return yield* fs.readFile(output);
+    });
+  const archive = (statements: readonly string[]) => Effect.flatMap(dump(statements), file);
+  /** Run the gate as `node <script> ...args` from `cwd` and read both streams and the exit code. */
+  const run = (args: readonly string[], options: { script?: string; cwd?: string } = {}) =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const child = yield* processes.spawn(
+          ChildProcess.make(
+            "node",
+            [options.script ?? path.resolve("scripts/inspect-self-host-root.ts"), ...args],
+            {
+              cwd: options.cwd ?? path.resolve("."),
+              env: { PATH: process.env.PATH ?? "" },
+              extendEnv: false,
+            },
+          ),
+        );
+        const [stdout, stderr, code] = yield* Effect.all(
+          [
+            child.stdout.pipe(Stream.decodeText(), Stream.mkString),
+            child.stderr.pipe(Stream.decodeText(), Stream.mkString),
+            child.exitCode,
+          ],
+          { concurrency: "unbounded" },
+        );
+        for (const leak of [canary, "Error", "    at ", "relation", "select ", "SQLSTATE"])
+          expect(stdout + stderr, `output must not contain ${JSON.stringify(leak)}`).not.toContain(
+            leak,
+          );
+        expect(stderr, "nothing is written to stderr").toBe("");
+        const report = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Report))(stdout);
+        return { code: Number(code), report };
+      }),
+    );
+  return { directory, file, dump, archive, run };
+});
+
+it.live(
+  "the root gate passes for the recorded organization and every one of its owners",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const gate = yield* workspace;
+        const archive = yield* gate.archive(valid);
+        const passed = yield* gate.run([archive, yield* gate.file(baseline())]);
+        expect(passed.code).toBe(0);
+        expect(passed.report).toMatchObject({
+          gate: "pass",
+          missingOwners: [],
+          unexpectedOwners: 0,
+        });
+        // Owner order in the baseline does not matter.
+        const reordered = yield* gate.run([
+          archive,
+          yield* gate.file(baseline(owners.toReversed())),
+        ]);
+        expect(reordered.code).toBe(0);
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  120_000,
+);
+
+it.live(
+  "the root gate fails when the owners, the root record or the journal differ from the recording",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const gate = yield* workspace;
+        const archive = yield* gate.archive(valid);
+        const fails = (
+          label: string,
+          statements: readonly string[] | string,
+          known: string,
+          failed: readonly string[],
+        ) =>
+          Effect.gen(function* () {
+            const target =
+              typeof statements === "string" ? statements : yield* gate.archive(statements);
+            const result = yield* gate.run([target, yield* gate.file(known)]);
+            expect(result.code, label).toBe(1);
+            expect(result.report.gate, label).toBe("fail");
+            const checks = result.report.checks ?? {};
+            expect(
+              Object.keys(checks)
+                .filter((name) => checks[name] === false)
+                .toSorted(),
+              label,
+            ).toEqual([...failed].toSorted());
+            return result.report;
+          });
+        const omitted = yield* fails(
+          "a recorded owner omitted",
+          archive,
+          baseline(["user-owner-a"]),
+          ["ownersMatchRecordedSet"],
+        );
+        expect(omitted).toMatchObject({ missingOwners: [], unexpectedOwners: 1 });
+        const added = yield* fails(
+          "an owner added to the recording",
+          archive,
+          baseline([...owners, "user-ghost"]),
+          ["ownersMatchRecordedSet"],
+        );
+        expect(added).toMatchObject({ missingOwners: ["user-ghost"], unexpectedOwners: 0 });
+        yield* fails(
+          "an admin recorded as an owner",
+          archive,
+          baseline([...owners, "user-admin"]),
+          ["ownersMatchRecordedSet"],
+        );
+        yield* fails(
+          "an unrecorded member holding owner among several roles",
+          [...valid, `update "member" set "role" = 'admin,owner' where "id" = 'm3'`],
+          baseline(),
+          ["ownersMatchRecordedSet"],
+        );
+        yield* fails(
+          "one owner listed twice",
+          [...valid, `insert into "member" values ('m5', '${root}', 'user-owner-a', 'owner')`],
+          baseline(),
+          ["ownerMembershipsUnique"],
+        );
+        yield* fails(
+          "no root record",
+          [...schema, rootTable, journalTable, ...organizations, ...journal],
+          baseline(),
+          ["exactlyOneRootRow", "rootIdIsRoot", "rootIsRecordedOrganization"],
+        );
+        yield* fails(
+          "no root table",
+          [...schema, journalTable, ...organizations, ...journal],
+          baseline(),
+          ["rootTableExists", "exactlyOneRootRow", "rootIdIsRoot", "rootIsRecordedOrganization"],
+        );
+        yield* fails(
+          "two root records",
+          [...valid, `insert into "selfHostRoot" values ('root', '${root}')`],
+          baseline(),
+          ["exactlyOneRootRow", "rootIdIsRoot", "rootIsRecordedOrganization"],
+        );
+        yield* fails(
+          "a root record under another ID",
+          [
+            ...schema,
+            rootTable,
+            journalTable,
+            ...organizations,
+            ...journal,
+            `insert into "selfHostRoot" values ('primary', '${root}')`,
+          ],
+          baseline(),
+          ["rootIdIsRoot"],
+        );
+        // A structurally valid record naming another organization, whose owners would gain
+        // creation, against the recorded identity.
+        yield* fails(
+          "a root record naming another organization",
+          [
+            ...schema,
+            rootTable,
+            journalTable,
+            ...organizations,
+            ...journal,
+            `insert into "selfHostRoot" values ('root', 'org-second')`,
+          ],
+          baseline(),
+          ["rootIsRecordedOrganization"],
+        );
+        yield* fails(
+          "a recording of an organization the archive does not have",
+          archive,
+          baseline(owners, "org-elsewhere"),
+          ["rootIsRecordedOrganization", "recordedOrganizationExists", "ownersMatchRecordedSet"],
+        );
+        yield* fails(
+          "no journal",
+          [...schema, rootTable, ...organizations, ...recorded],
+          baseline(),
+          ["journalRecordsRootOrganization"],
+        );
+        yield* fails(
+          "a journal without the root step",
+          [...schema, rootTable, journalTable, ...organizations, ...recorded],
+          baseline(),
+          ["journalRecordsRootOrganization"],
+        );
+        yield* fails(
+          "a journal naming another first step",
+          [
+            ...schema,
+            rootTable,
+            journalTable,
+            ...organizations,
+            ...recorded,
+            `insert into private_self_host_migrations (migration_id, name) values (1, 'other')`,
+          ],
+          baseline(),
+          ["journalRecordsRootOrganization"],
+        );
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  180_000,
+);
+
+it.live("the root gate refuses an invalid invocation or baseline before reading the archive", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const gate = yield* workspace;
+      const archive = yield* gate.archive(valid);
+      const refused = (label: string, args: readonly string[], reason: string) =>
+        Effect.gen(function* () {
+          const result = yield* gate.run(args);
+          expect(result.code, label).toBe(2);
+          expect(result.report, label).toEqual({ gate: "invalid", reason });
+        });
+      const known = (text: string) => gate.file(text);
+      yield* refused(
+        "no arguments",
+        [],
+        "usage: node scripts/inspect-self-host-root.ts [--rollout pr81] <export.tar> <baseline.json>",
+      );
+      yield* refused(
+        "three arguments",
+        [archive, archive, archive],
+        "usage: node scripts/inspect-self-host-root.ts [--rollout pr81] <export.tar> <baseline.json>",
+      );
+      yield* refused(
+        "a missing baseline",
+        [archive, `${gate.directory}/absent.json`],
+        "baseline file cannot be read",
+      );
+      yield* refused("not JSON", [archive, yield* known("{owners")], "baseline is not JSON");
+      yield* refused("an array", [archive, yield* known("[]")], "baseline must be an object");
+      yield* refused(
+        "an extra field",
+        [
+          archive,
+          yield* known(
+            JSON.stringify({
+              version: 1,
+              organizationId: root,
+              ownerUserIds: owners,
+              trusted: true,
+            }),
+          ),
+        ],
+        "baseline must have exactly version, organizationId and ownerUserIds",
+      );
+      yield* refused(
+        "no owners field",
+        [archive, yield* known(JSON.stringify({ version: 1, organizationId: root }))],
+        "baseline must have exactly version, organizationId and ownerUserIds",
+      );
+      yield* refused(
+        "another version",
+        [
+          archive,
+          yield* known(JSON.stringify({ version: 2, organizationId: root, ownerUserIds: owners })),
+        ],
+        "baseline version must be 1",
+      );
+      yield* refused(
+        "an empty owner set",
+        [archive, yield* known(baseline([]))],
+        "baseline ownerUserIds must be a non-empty array",
+      );
+      yield* refused(
+        "a repeated owner",
+        [archive, yield* known(baseline(["user-owner-a", "user-owner-a"]))],
+        "baseline ownerUserIds must not repeat",
+      );
+      yield* refused(
+        "an owner that is not an ID",
+        [archive, yield* known(baseline(["user-owner-a", "x' or '1'='1"]))],
+        "baseline ownerUserIds must be IDs",
+      );
+      yield* refused(
+        "a numeric owner",
+        [
+          archive,
+          yield* known(JSON.stringify({ version: 1, organizationId: root, ownerUserIds: [7] })),
+        ],
+        "baseline ownerUserIds must be IDs",
+      );
+      yield* refused(
+        "an empty organization",
+        [archive, yield* known(baseline(owners, ""))],
+        "baseline organizationId must be an ID",
+      );
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live(
+  "the root gate reports an unreadable archive, another Postgres or another PGlite as an error",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem,
+          path = yield* Path.Path;
+        const gate = yield* workspace;
+        const known = yield* gate.file(baseline());
+        const unusable = (
+          label: string,
+          args: readonly string[],
+          reason: string,
+          options?: { script?: string; cwd?: string },
+        ) =>
+          Effect.gen(function* () {
+            const result = yield* gate.run(args, options);
+            expect(result.code, label).toBe(3);
+            expect(result.report, label).toEqual({ gate: "error", reason });
+          });
+        yield* unusable(
+          "a missing archive",
+          [`${gate.directory}/absent.tar`, known],
+          "archive file cannot be read",
+        );
+        yield* unusable(
+          "bytes that are not an archive",
+          [yield* gate.file(`not a tar ${canary}`), known],
+          "archive cannot be loaded as a PGlite data directory",
+        );
+        // Each PG_VERSION file in the dump says which Postgres wrote that directory; Postgres
+        // refuses another. Tar headers are 512-byte aligned and a file's bytes follow its header.
+        const versioned = Buffer.from(yield* gate.dump(valid));
+        let patched = 0;
+        for (
+          let at = versioned.indexOf("PG_VERSION\u0000");
+          at >= 0;
+          at = versioned.indexOf("PG_VERSION\u0000", at + 1)
+        ) {
+          const contents = Math.floor(at / 512) * 512 + 512;
+          if (versioned.subarray(contents, contents + 3).toString() !== "18\n") continue;
+          versioned.write("17\n", contents);
+          patched++;
+        }
+        expect(patched, "the dump's PG_VERSION files").toBeGreaterThan(0);
+        yield* unusable(
+          "a data directory from Postgres 17",
+          [yield* gate.file(versioned), known],
+          "archive cannot be loaded as a PGlite data directory",
+        );
+
+        // The script copied out of the repository cannot resolve PGlite at all.
+        const outside = yield* fs.makeTempDirectoryScoped({ prefix: "executor-root-gate-copy-" });
+        const copy = path.join(outside, "inspect-self-host-root.ts");
+        yield* fs.copyFile(path.resolve("scripts/inspect-self-host-root.ts"), copy);
+        const archive = yield* gate.archive(valid);
+        yield* unusable("PGlite missing", [archive, known], "PGlite cannot be loaded", {
+          script: copy,
+          cwd: outside,
+        });
+        // A PGlite other than the product's pinned one is refused before it opens the archive.
+        const stub = path.join(outside, "node_modules/@electric-sql/pglite");
+        yield* fs.makeDirectory(stub, { recursive: true });
+        yield* fs.writeFileString(
+          path.join(stub, "package.json"),
+          JSON.stringify({
+            name: "@electric-sql/pglite",
+            version: "0.4.0",
+            type: "module",
+            main: "index.js",
+          }),
+        );
+        yield* fs.writeFileString(
+          path.join(stub, "index.js"),
+          "export class PGlite { constructor() { throw new Error('the stub must not open the archive'); } }\n",
+        );
+        yield* unusable("PGlite 0.4.0", [archive, known], "PGlite 0.4.0 is not 0.5.8", {
+          script: copy,
+          cwd: outside,
+        });
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  120_000,
+);
+
+it.live(
+  "the #81 rollout gate requires exactly one organization and exactly the journals #81 writes",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const gate = yield* workspace;
+        const known = yield* gate.file(baseline());
+        const ready = yield* gate.archive(rolloutReady);
+        const passed = yield* gate.run(["--rollout", "pr81", ready, known]);
+        expect(passed.code).toBe(0);
+        expect(passed.report).toMatchObject({ gate: "pass" });
+        // The general gate accepts an install that already holds several organizations; the
+        // rollout gate does not.
+        const general = yield* gate.run([
+          yield* gate.archive([...valid, hostedTable, ...hostedJournal]),
+          known,
+        ]);
+        expect(general.code, "general gate with two organizations").toBe(0);
+        const fails = (label: string, statements: readonly string[], failed: readonly string[]) =>
+          Effect.gen(function* () {
+            const result = yield* gate.run([
+              "--rollout",
+              "pr81",
+              yield* gate.archive(statements),
+              known,
+            ]);
+            expect(result.code, label).toBe(1);
+            const checks = result.report.checks ?? {};
+            expect(
+              Object.keys(checks)
+                .filter((name) => checks[name] === false)
+                .toSorted(),
+              label,
+            ).toEqual([...failed].toSorted());
+          });
+        yield* fails(
+          "two organizations",
+          [...rolloutReady, `insert into "organization" values ('org-second', 'Second', 'second')`],
+          ["rolloutExactlyOneOrganization"],
+        );
+        yield* fails(
+          "a hosted journal entry missing",
+          [...rolloutReady, "delete from private_hosted_migrations where migration_id = 9"],
+          ["rolloutJournal_private_hosted_migrations"],
+        );
+        yield* fails(
+          "an extra hosted journal entry",
+          [
+            ...rolloutReady,
+            "insert into private_hosted_migrations (migration_id, name) values (10, 'later_step')",
+          ],
+          ["rolloutJournal_private_hosted_migrations"],
+        );
+        yield* fails(
+          "a hosted journal entry under another name",
+          [
+            ...rolloutReady,
+            "update private_hosted_migrations set name = 'other' where migration_id = 5",
+          ],
+          ["rolloutJournal_private_hosted_migrations"],
+        );
+        yield* fails(
+          "no hosted journal",
+          [...rolloutReady, "drop table private_hosted_migrations"],
+          ["rolloutJournal_private_hosted_migrations"],
+        );
+        yield* fails(
+          "an extra self-host journal entry",
+          [
+            ...rolloutReady,
+            "insert into private_self_host_migrations (migration_id, name) values (2, 'later_step')",
+          ],
+          ["rolloutJournal_private_self_host_migrations"],
+        );
+        yield* fails(
+          "the self-host journal entry missing",
+          [...rolloutReady, "delete from private_self_host_migrations"],
+          ["journalRecordsRootOrganization", "rolloutJournal_private_self_host_migrations"],
+        );
+        const report = yield* gate.run([
+          "--rollout",
+          "pr81",
+          yield* gate.archive([
+            ...rolloutReady,
+            "delete from private_hosted_migrations where migration_id = 9",
+            "insert into private_hosted_migrations (migration_id, name) values (11, 'later_step')",
+          ]),
+          known,
+        ]);
+        expect(report.code).toBe(1);
+        expect(report.report).toMatchObject({
+          journals: {
+            private_hosted_migrations: {
+              pinned: 9,
+              found: 9,
+              missing: ["9_app_account_links"],
+              unexpected: 1,
+            },
+          },
+        });
+        for (const [label, args] of [
+          ["an unknown rollout", ["--rollout", "pr82", ready, known]],
+          ["a rollout without a name", ["--rollout"]],
+        ] as const) {
+          const refused = yield* gate.run(args);
+          expect(refused.code, label).toBe(2);
+          expect(refused.report, label).toEqual({
+            gate: "invalid",
+            reason: "unknown rollout; expected one of: pr81",
+          });
+        }
+        const misplaced = yield* gate.run([ready, known, "--rollout", "pr81"]);
+        expect(misplaced.code, "the option after the paths").toBe(2);
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  180_000,
+);
diff --git a/e2e/tests/self-host-setup-integrity.spec.ts b/e2e/tests/self-host-setup-integrity.spec.ts
new file mode 100644
index 0000000000..db400970e8
--- /dev/null
+++ b/e2e/tests/self-host-setup-integrity.spec.ts
@@ -0,0 +1,138 @@
+/**
+ * First setup creates the instance's only owner, organization and root record together. Callers
+ * racing to set up a fresh instance leave exactly one of each, and a setup that fails partway
+ * leaves nothing behind, so a retry starts from an empty instance.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { password } from "../support/actors.ts";
+import { Api, body, type Session } from "../support/api.ts";
+import { HostedLive, withCase } from "../support/case.ts";
+import { Organization } from "../support/contracts.ts";
+import { legacyStorage } from "../support/legacy-storage.ts";
+import { serverControl } from "../support/server-control.ts";
+import { scenarios } from "../test-plan.ts";
+
+const Configuration = Schema.Struct({ setup: Schema.Boolean });
+
+const countQueries = [
+  {
+    sql: `select
+      (select count(*)::int from "user") as users,
+      (select count(*)::int from "account") as accounts,
+      (select count(*)::int from "organization") as organizations,
+      (select count(*)::int from "member") as members,
+      (select count(*)::int from "session") as sessions`,
+  },
+  { sql: `select "id", "organizationId" from "selfHostRoot"` },
+] as const;
+
+const setup = (session: Session, index: number) =>
+  Effect.flatMap(Api, (api) =>
+    api.request(session, "POST", "/api/auth/self-host/setup", {
+      name: `Racer ${index}`,
+      email: `racer-${index}@example.test`,
+      password,
+      organizationName: `Race team ${index}`,
+    }),
+  );
+
+const configuration = (session: Session) =>
+  Effect.flatMap(Api, (api) =>
+    api
+      .request(session, "GET", "/api/auth/self-host/config")
+      .pipe(Effect.flatMap((response) => body(Configuration, response))),
+  );
+
+layer(HostedLive, { excludeTestServices: true })("Self-host setup integrity", (it) => {
+  it.effect(scenarios.selfHostSetupRace.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api;
+        const sessions = yield* Effect.forEach([0, 1, 2, 3, 4], () => api.session());
+        expect((yield* configuration(sessions[0]!)).setup).toBe(true);
+        const statuses = yield* Effect.forEach(
+          sessions,
+          (session, index) => setup(session, index).pipe(Effect.map((response) => response.status)),
+          { concurrency: "unbounded" },
+        );
+        expect(statuses.toSorted()).toEqual([200, 403, 403, 403, 403]);
+        const winner = statuses.indexOf(200);
+        const organizations = yield* body(
+          Schema.Array(Organization),
+          yield* api.request(sessions[winner]!, "GET", "/api/auth/organization/list"),
+        );
+        expect(organizations).toHaveLength(1);
+        expect((yield* configuration(sessions[0]!)).setup).toBe(false);
+
+        const [[counts] = [], root = []] = yield* legacyStorage(countQueries);
+        expect(counts).toEqual({
+          users: 1,
+          accounts: 1,
+          organizations: 1,
+          members: 1,
+          sessions: 1,
+        });
+        expect(root).toEqual([{ id: "root", organizationId: organizations[0]!.id }]);
+      }),
+    ),
+  );
+
+  it.effect(scenarios.selfHostSetupRollback.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api;
+        // The membership is the last row setup writes, after the user, account, organization
+        // and root record.
+        yield* legacyStorage([
+          {
+            sql: `create function e2e_refuse_member() returns trigger language plpgsql as $$
+              begin raise exception 'synthetic setup failure'; end $$`,
+          },
+          {
+            sql: `create trigger e2e_refuse_member before insert on "member"
+              for each row execute function e2e_refuse_member()`,
+          },
+        ]);
+        yield* serverControl("start");
+        const failed = yield* api.session();
+        const first = yield* setup(failed, 1);
+        expect(first.status).toBeGreaterThanOrEqual(500);
+        expect((yield* configuration(failed)).setup).toBe(true);
+        const [[afterFailure] = [], rootAfterFailure = []] = yield* legacyStorage(countQueries);
+        expect(afterFailure).toEqual({
+          users: 0,
+          accounts: 0,
+          organizations: 0,
+          members: 0,
+          sessions: 0,
+        });
+        expect(rootAfterFailure).toEqual([]);
+
+        yield* legacyStorage([
+          { sql: `drop trigger e2e_refuse_member on "member"` },
+          { sql: "drop function e2e_refuse_member()" },
+        ]);
+        yield* serverControl("start");
+        const retried = yield* api.session();
+        expect((yield* setup(retried, 2)).status).toBe(200);
+        const organizations = yield* body(
+          Schema.Array(Organization),
+          yield* api.request(retried, "GET", "/api/auth/organization/list"),
+        );
+        expect(organizations).toHaveLength(1);
+        const [[afterRetry] = [], rootAfterRetry = []] = yield* legacyStorage(countQueries);
+        expect(afterRetry).toEqual({
+          users: 1,
+          accounts: 1,
+          organizations: 1,
+          members: 1,
+          sessions: 1,
+        });
+        expect(rootAfterRetry).toEqual([{ id: "root", organizationId: organizations[0]!.id }]);
+      }),
+    ),
+  );
+});
diff --git a/package.json b/package.json
index dea351cbf0..06ce7bbb27 100644
--- a/package.json
+++ b/package.json
@@ -99,6 +99,7 @@
     "e2e:billing": "vitest run --config e2e/billing.config.ts",
     "auth:security": "bun apps/hosted/server/scripts/check-better-auth-security.mjs",
     "e2e:pglite": "vitest run --config e2e/pglite.config.ts",
+    "e2e:root-inspection": "vitest run --config e2e/self-host-root-inspection.config.ts",
     "e2e:dashboard-file-names": "vitest run --config e2e/dashboard-file-names.config.ts",
     "e2e:apps-published": "vitest run --config e2e/apps-published.config.ts",
     "e2e:ci-selection": "vitest run --config e2e/ci-selection.config.ts",
diff --git a/scripts/inspect-self-host-root.ts b/scripts/inspect-self-host-root.ts
new file mode 100644
index 0000000000..cfa6421a31
--- /dev/null
+++ b/scripts/inspect-self-host-root.ts
@@ -0,0 +1,292 @@
+/**
+ * Offline gate for the self-host root organization record.
+ *
+ *   node scripts/inspect-self-host-root.ts [--rollout pr81] <export.tar> <baseline.json>
+ *
+ * `export.tar` is an `executor-host export` archive of a stopped volume copy: a PGlite
+ * data-directory dump, loaded here into an in-memory database, never the live volume.
+ * `baseline.json` is the identity the operator recorded before the upgrade:
+ *
+ *   { "version": 1, "organizationId": "<id>", "ownerUserIds": ["<user id>", ...] }
+ *
+ * The gate passes only when the archive holds exactly one root record, `id = 'root'`, naming that
+ * organization; the organization's owners are exactly the recorded set; and the self-host journal
+ * records `1 root_organization`. Nothing is taken from the archive as the expected value.
+ *
+ * `--rollout pr81` adds the gate for rolling out #81 onto an install: the archive must hold exactly
+ * one organization, and both journals #81 writes must be exactly the pinned ones, nothing missing
+ * and nothing extra.
+ *
+ * Exit codes: 0 pass, 1 gate failed, 2 invalid invocation or baseline, 3 the archive or PGlite
+ * could not be used. Output is a fixed report: no rows, SQL errors or stack traces are printed.
+ */
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+
+/** The PGlite the self-host product bundles, and the Postgres major it runs. */
+const pgliteVersion = "0.5.8";
+const postgresMajor = 18;
+
+/**
+ * The journals 7c4922535596a6fe86938a8acbe0078107ce2bca (#81) writes on self-host, in full:
+ * `hostedProductMigrations` in apps/hosted/server/src/implementation/migrations.ts and
+ * `migrateSelfHostSteps` in apps/hosted/self-host/src/implementation/root-organization.ts. Effect's
+ * migrator stores each `<id>_<name>` key as that id and name.
+ */
+const rollouts = {
+  pr81: {
+    organizations: 1,
+    journals: {
+      private_hosted_migrations: [
+        [1, "baseline"],
+        [2, "api_key_memberships"],
+        [3, "upgrade_executor_apps"],
+        [4, "data_steps"],
+        [5, "upgrade_executor_apps"],
+        [6, "upgrade_pinned_executor_apps"],
+        [7, "require_connection_targets"],
+        [8, "oauth_client_access"],
+        [9, "app_account_links"],
+      ],
+      private_self_host_migrations: [[1, "root_organization"]],
+    },
+  },
+} as const satisfies Record<
+  string,
+  {
+    readonly organizations: number;
+    readonly journals: Record<string, ReadonlyArray<readonly [number, string]>>;
+  }
+>;
+type Rollout = (typeof rollouts)[keyof typeof rollouts];
+
+type Baseline = { readonly organizationId: string; readonly ownerUserIds: readonly string[] };
+type Exit = { readonly code: 0 | 1 | 2 | 3; readonly report: Record<string, unknown> };
+
+const identifier = /^[A-Za-z0-9_-]{1,128}$/u;
+
+const invalid = (reason: string): Exit => ({ code: 2, report: { gate: "invalid", reason } });
+const unusable = (reason: string): Exit => ({ code: 3, report: { gate: "error", reason } });
+
+const parseBaseline = (text: string): Baseline | string => {
+  let value: unknown;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return "baseline is not JSON";
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return "baseline must be an object";
+  const keys = Object.keys(value).toSorted();
+  if (keys.join(",") !== "organizationId,ownerUserIds,version")
+    return "baseline must have exactly version, organizationId and ownerUserIds";
+  const { version, organizationId, ownerUserIds } = value as Record<string, unknown>;
+  if (version !== 1) return "baseline version must be 1";
+  if (typeof organizationId !== "string" || !identifier.test(organizationId))
+    return "baseline organizationId must be an ID";
+  if (!Array.isArray(ownerUserIds) || ownerUserIds.length === 0)
+    return "baseline ownerUserIds must be a non-empty array";
+  if (!ownerUserIds.every((id) => typeof id === "string" && identifier.test(id)))
+    return "baseline ownerUserIds must be IDs";
+  if (new Set(ownerUserIds).size !== ownerUserIds.length)
+    return "baseline ownerUserIds must not repeat";
+  return { organizationId, ownerUserIds: ownerUserIds as string[] };
+};
+
+/** The installed PGlite's version, read from its own package, or undefined when it is not one. */
+const installedPgliteVersion = async (entry: string) => {
+  for (let directory = dirname(entry); directory !== dirname(directory);) {
+    try {
+      const manifest = JSON.parse(await readFile(join(directory, "package.json"), "utf8")) as {
+        readonly name?: unknown;
+        readonly version?: unknown;
+      };
+      if (manifest.name === "@electric-sql/pglite")
+        return typeof manifest.version === "string" ? manifest.version : undefined;
+    } catch {
+      // No manifest at this level; keep walking up.
+    }
+    directory = dirname(directory);
+  }
+  return undefined;
+};
+
+const inspect = async (
+  archivePath: string,
+  baselinePath: string,
+  rollout: Rollout | undefined,
+): Promise<Exit> => {
+  let baselineText: string;
+  try {
+    baselineText = await readFile(baselinePath, "utf8");
+  } catch {
+    return invalid("baseline file cannot be read");
+  }
+  const baseline = parseBaseline(baselineText);
+  if (typeof baseline === "string") return invalid(baseline);
+
+  let archive: Buffer;
+  try {
+    archive = await readFile(archivePath);
+  } catch {
+    return unusable("archive file cannot be read");
+  }
+
+  // The version is checked before PGlite's code runs, so another PGlite never opens the archive.
+  let entry: string;
+  try {
+    entry = createRequire(import.meta.url).resolve("@electric-sql/pglite");
+  } catch {
+    return unusable("PGlite cannot be loaded");
+  }
+  const installed = await installedPgliteVersion(entry);
+  if (installed !== pgliteVersion)
+    return unusable(`PGlite ${installed ?? "of unknown version"} is not ${pgliteVersion}`);
+  let PGlite: typeof import("@electric-sql/pglite").PGlite;
+  try {
+    ({ PGlite } = await import("@electric-sql/pglite"));
+  } catch {
+    return unusable("PGlite cannot be loaded");
+  }
+
+  let db: InstanceType<typeof PGlite>;
+  try {
+    db = new PGlite({ loadDataDir: new Blob([archive]) });
+    await db.waitReady;
+  } catch {
+    return unusable("archive cannot be loaded as a PGlite data directory");
+  }
+  try {
+    const rows = async (sql: string, params: unknown[] = []) =>
+      (await db.query<Record<string, unknown>>(sql, params)).rows;
+    const [server] = await rows("select current_setting('server_version_num')::int as number");
+    if (Math.floor(Number(server?.number) / 10000) !== postgresMajor)
+      return unusable(`archive does not run Postgres ${postgresMajor}`);
+    const tables = new Set(
+      (
+        await rows(
+          `select table_name as name from information_schema.tables
+           where table_schema = 'public'
+             and table_name in ('selfHostRoot', 'private_self_host_migrations', 'private_hosted_migrations', 'organization', 'member')`,
+        )
+      ).map((row) => row.name),
+    );
+    const [organizationRows] = tables.has("organization")
+      ? await rows(`select count(*)::int as count from "organization"`)
+      : [];
+    const organizationCount = Number(organizationRows?.count ?? 0);
+    const root = tables.has("selfHostRoot")
+      ? await rows(`select "id", "organizationId" from "selfHostRoot"`)
+      : [];
+    const organizationExists =
+      tables.has("organization") &&
+      (await rows(`select 1 from "organization" where "id" = $1`, [baseline.organizationId]))
+        .length === 1;
+    const owners = tables.has("member")
+      ? (
+          await rows(`select "userId", "role" from "member" where "organizationId" = $1`, [
+            baseline.organizationId,
+          ])
+        )
+          .filter((row) =>
+            String(row.role)
+              .split(",")
+              .map((role) => role.trim())
+              .includes("owner"),
+          )
+          .map((row) => String(row.userId))
+      : [];
+    const journal = tables.has("private_self_host_migrations")
+      ? await rows(
+          "select migration_id::int as id, name from private_self_host_migrations where migration_id = 1",
+        )
+      : [];
+    const recorded = new Set(baseline.ownerUserIds);
+    const found = new Set(owners);
+    const missingOwners = baseline.ownerUserIds.filter((id) => !found.has(id));
+    const unexpectedOwners = owners.filter((id) => !recorded.has(id)).length;
+    const checks = {
+      rootTableExists: tables.has("selfHostRoot"),
+      exactlyOneRootRow: root.length === 1,
+      rootIdIsRoot: root.length === 1 && root[0]?.id === "root",
+      rootIsRecordedOrganization:
+        root.length === 1 && root[0]?.organizationId === baseline.organizationId,
+      recordedOrganizationExists: organizationExists,
+      ownerMembershipsUnique: found.size === owners.length,
+      ownersMatchRecordedSet: missingOwners.length === 0 && unexpectedOwners === 0,
+      journalRecordsRootOrganization:
+        journal.length === 1 && journal[0]?.name === "root_organization",
+    };
+    const rolloutReport: Record<string, unknown> = {};
+    if (rollout !== undefined) {
+      Object.assign(checks, {
+        rolloutExactlyOneOrganization: organizationCount === rollout.organizations,
+      });
+      for (const [table, expected] of Object.entries(rollout.journals)) {
+        const found = tables.has(table)
+          ? (
+              await rows(`select migration_id::int as id, name from ${table} order by migration_id`)
+            ).map((row) => `${Number(row.id)}_${String(row.name)}`)
+          : [];
+        const pinned = expected.map(([id, name]) => `${id}_${name}`);
+        const missing = pinned.filter((entry) => !found.includes(entry));
+        const unexpected = found.filter((entry) => !pinned.includes(entry)).length;
+        Object.assign(checks, {
+          [`rolloutJournal_${table}`]:
+            tables.has(table) &&
+            missing.length === 0 &&
+            unexpected === 0 &&
+            found.length === pinned.length,
+        });
+        rolloutReport[table] = { pinned: pinned.length, found: found.length, missing, unexpected };
+      }
+    }
+    const pass = Object.values(checks).every(Boolean);
+    return {
+      code: pass ? 0 : 1,
+      report: {
+        gate: pass ? "pass" : "fail",
+        ...(rollout === undefined ? {} : { rollout: "pr81", journals: rolloutReport }),
+        pglite: installed,
+        organizationCount,
+        rootRows: root.length,
+        recordedOwners: baseline.ownerUserIds.length,
+        ownersFound: owners.length,
+        missingOwners,
+        unexpectedOwners,
+        checks,
+      },
+    };
+  } catch {
+    return unusable("archive could not be queried");
+  } finally {
+    await db.close().catch(() => undefined);
+  }
+};
+
+const usage =
+  "usage: node scripts/inspect-self-host-root.ts [--rollout pr81] <export.tar> <baseline.json>";
+
+const main = async (): Promise<Exit> => {
+  let args = process.argv.slice(2);
+  let rollout: Rollout | undefined;
+  if (args[0] === "--rollout") {
+    const name = args[1];
+    if (name === undefined || !Object.hasOwn(rollouts, name))
+      return invalid(`unknown rollout; expected one of: ${Object.keys(rollouts).join(", ")}`);
+    rollout = rollouts[name as keyof typeof rollouts];
+    args = args.slice(2);
+  }
+  if (args.length !== 2 || args.some((arg) => arg === "" || arg.startsWith("--")))
+    return invalid(usage);
+  try {
+    return await inspect(args[0]!, args[1]!, rollout);
+  } catch {
+    return unusable("inspection failed unexpectedly");
+  }
+};
+
+const result = await main().catch((): Exit => unusable("inspection failed unexpectedly"));
+process.stdout.write(`${JSON.stringify(result.report, null, 2)}\n`);
+process.exitCode = result.code;