diff --git a/Cargo.lock b/Cargo.lock
index bb0260e..44851b6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2266,7 +2266,7 @@ dependencies = [
 
 [[package]]
 name = "dig-node-service"
-version = "0.68.1"
+version = "0.69.0"
 dependencies = [
  "async-trait",
  "axum",
diff --git a/Cargo.toml b/Cargo.toml
index daed0a5..931d408 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -31,7 +31,7 @@ edition = "2021"
 # the ROOT manifest (`[workspace.package].version`), so it MUST be set here for a
 # release to fire (§3.6). The library crates (dig-node-core/dig-runtime/dig-wallet)
 # keep their own independent versions — only the released binary tracks the workspace version.
-version = "0.68.1"
+version = "0.69.0"
 
 # Release hardening, matching digstore: keep integer-overflow checks ON in release.
 # The node parses untrusted serialized input and does offset/length arithmetic over
diff --git a/DEVELOPMENT_LOG.md b/DEVELOPMENT_LOG.md
index 3cb8c25..7fd6100 100644
--- a/DEVELOPMENT_LOG.md
+++ b/DEVELOPMENT_LOG.md
@@ -4,6 +4,29 @@ High-signal realizations from debugging/development: non-obvious cross-system co
 sharp edges, and gotchas. Concise durable facts with context — NOT a change diary. See
 `CLAUDE.md` §4.5 for the maintenance contract (a curator periodically re-verifies + prunes).
 
+## Root has NO systemd `--user` bus, so a user-scope service install is impossible under `sudo` (#526)
+
+`systemctl --user` (and everything `service-manager`'s systemd backend does at `ServiceLevel::User`)
+talks to a **per-login-session D-Bus user manager**. A process running as root under `sudo` inherits
+the invoking user's environment but NOT their session bus, and root's own user manager is normally not
+running, so the call fails with `Failed to connect to bus: Operation not permitted` — surfacing to a
+caller as a bare non-zero exit (the dig-installer observed `exited with 6`). There is no environment
+tweak that makes this work in general: `XDG_RUNTIME_DIR`/`DBUS_SESSION_BUS_ADDRESS` point at the
+*invoking* user's runtime dir, which root may reach but which registers the unit for THAT user's
+session — not a machine-wide service.
+
+Two consequences that generalize beyond this repo:
+
+- **An elevated installer must register SYSTEM scope, not user scope.** A user-scope unit only starts
+  when its user's session/manager starts, so on a headless host it may never come back after a reboot.
+  Only a system unit (`WantedBy=multi-user.target`) starts at boot with no login session — which is why
+  dig-node's own `.deb`/`.pkg` always registered system scope while the CLI's `install` verb did not.
+- **The privilege level, not the platform, decides the default.** A single compile-time "prefer user
+  level" constant cannot express it: the same binary on the same OS must land a user unit for a desktop
+  double-click and a system unit under `sudo`. The scope has to be a RUNTIME value (see `resolve_scope`
+  in `crates/dig-node-service/src/service.rs`) — and, because both scopes can be registered
+  independently, an install at one scope must clear the other or two units race for the node's port.
+
 ## A git-pinned peer-stack dep hides shipped fixes indefinitely — the network looked dead for 11 minors (#1771)
 
 dig-gossip is a **git dependency pinned by rev** (it cannot go to crates.io until dig-peer-protocol
diff --git a/README.md b/README.md
index 094de96..10cfb17 100644
--- a/README.md
+++ b/README.md
@@ -64,11 +64,19 @@ dig-node uninstall
   `sc config` + a `sc qc` read-back to confirm it took). Re-running `install` against an
   already-registered service cleanly stops + deregisters + recreates it instead of hitting
   `CreateService` error 1073 ("the specified service already exists").
-- **Linux / macOS:** the service installs at **user level** (systemd `--user` / a launchd GUI agent),
-  so no `sudo` is needed and it runs as you. (systemd user services start at login; enable
-  linger — `loginctl enable-linger $USER` — if you want it running without an active session.)
-  Both back ends restart the service on crash out of the box — systemd's generated unit sets
-  `Restart=on-failure`, launchd's generated plist sets `KeepAlive: true`.
+- **Linux / macOS:** both scopes exist, and `install` picks by privilege — run it plainly and you get a
+  **user-level** service (systemd `--user` / a launchd GUI agent): no `sudo`, runs as you. (systemd
+  user services start at login; enable linger — `loginctl enable-linger $USER` — if you want it
+  running without an active session.) Run it with `sudo` and you get a **system-level** service that
+  starts at boot with no login session — what you want on a headless host, and what the DIG installer
+  and the native `.deb`/`.pkg` register. Both back ends restart the service on crash out of the box —
+  systemd's generated unit sets `Restart=on-failure`, launchd's generated plist sets `KeepAlive: true`.
+- **Choosing explicitly:** `install`, `uninstall`, `start` and `stop` all accept
+  `--scope <auto|system|user>` (default `auto` = the privilege-based choice above). An explicit scope
+  is honoured as given — `--scope system` without root is refused with a clear message rather than
+  quietly becoming a user service that will not survive a reboot. `install` also removes any
+  registration at the *other* scope first, so upgrading a user-level install to a system one never
+  leaves two services fighting over the port; `uninstall` with the default `auto` clears both.
 
 ## Point the extension at it
 
diff --git a/SPEC.md b/SPEC.md
index 02e67c5..4bfe9f3 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -1493,7 +1493,8 @@ flood of never-attached `begin`s cannot grow engine state without bound.
 
 `run` (default when no subcommand; serves in the foreground and is the unix-service entrypoint) ·
 `run-service` (hidden; the Windows SCM entrypoint, §9.4; behaves as `run` off Windows) ·
-`install` · `uninstall` · `start` · `stop` · `status` · `pair` (§7.11) · `open` (§8.5) ·
+`install` · `uninstall` · `start` · `stop` (each accepting `--scope <auto|system|user>`, §9.1) ·
+`status` · `pair` (§7.11) · `open` (§8.5) ·
 the **control-parity** subcommands `info` · `config` · `cache` · `stores` · `sync` · `updater` ·
 `subscriptions` (§8.6) · `peers` (§8.7) · `logs` (§11).
 
@@ -1662,10 +1663,58 @@ Numeric values and symbolic names are a stable contract and MUST NOT be renumber
 
 ## 9. OS-service contract
 
-9.1. **Install levels.** Linux (systemd) and macOS (launchd) install at **user level** (no
-root/sudo; runs as the installing user). Windows SCM has no per-user services, so install is
-**system-level only**, and `install`/`uninstall` MUST fail fast with a clear
-`PERMISSION_DENIED` when the console is not elevated (probed up front, not deep inside `sc.exe`).
+9.1. **Service scope (`--scope`, #526).** A registration lives in exactly ONE of two scopes, and
+`install`, `uninstall`, `start` and `stop` all accept `--scope <auto|system|user>`, default `auto`.
+
+| Scope | Where the registration lands | Runs as | Survives a reboot with NO login session | Requires |
+| --- | --- | --- | --- | --- |
+| `system` | systemd system unit (`/etc/systemd/system/dignetwork-dig-node.service`, `WantedBy=multi-user.target`) · launchd daemon (`/Library/LaunchDaemons/net.dignetwork.dig-node.plist`, `system` domain) · Windows SCM service | root / LocalSystem | **YES** — starts at boot | root / Administrator |
+| `user` | systemd user unit (`~/.config/systemd/user/dignetwork-dig-node.service`) · launchd agent (`gui/<uid>` domain) | the installing user | NO — starts with that user's session | nothing |
+
+- **Resolution (normative).** Given the operator's choice, whether the OS HAS a user scope, and
+  whether the process is root, the resolved scope MUST be: `system` whenever the OS has no user
+  scope (Windows SCM) — **including for an explicit `--scope user`, which cannot be honoured
+  there**; otherwise the explicit `--scope system`/`--scope user` **verbatim** (an explicit choice is
+  authoritative and MUST NEVER be silently overridden by the privilege level); otherwise, for
+  `auto`, `system` when running as root and `user` when not.
+- **`auto` is the default**, so a caller that passes no flag — including a dig-installer release
+  predating this flag — gets the historical behaviour: user scope for an unelevated desktop install,
+  and now system scope for an ELEVATED install, which is what makes a headless install survive a
+  reboot. Root has no `systemd --user`/D-Bus session, so a user-scope registration attempted as root
+  cannot succeed at all.
+- **A system scope requested without root MUST be refused** (`PERMISSION_DENIED`) with a message
+  naming the missing privilege and the `--scope user` alternative — never silently downgraded to
+  user scope (a silent downgrade produces a registration that does not survive a reboot, which the
+  operator asked to avoid). On Windows, the equivalent up-front check is elevation itself:
+  `install`/`uninstall` MUST fail fast with a clear `PERMISSION_DENIED` when the console is not
+  elevated (probed up front, not deep inside `sc.exe`).
+- **Cross-scope migration (`install`).** Before registering at the resolved scope, `install` MUST
+  deregister this service label at the OTHER scope, so a host upgrading from a previous user-level
+  install does not end up with two registrations both starting a node bound to the same port. The
+  other scope is PROBED first (so a scope holding no registration is never written to), the removal
+  is best-effort (an unprivileged install cannot delete a system unit) and it is REPORTED, never
+  silently dropped: `result.migrated_from_scope { scope, found, removed, error }` in `--json`, plus a
+  `note`/`WARN` line in the human summary. A failed other-scope removal MUST NOT fail the install.
+- **The existence probe is ADVISORY; the OS deregistration is AUTHORITATIVE.**
+  `launchctl print gui/<uid>/<label>` cannot see a per-user agent from a session with no Aqua/GUI
+  domain (a headless CI runner, an ssh login), so it reports absence for a service that IS
+  registered. Therefore the scope the operator NAMED (or `auto` resolved to) MUST be deregistered
+  **unconditionally**, without gating on the probe — a probe false-negative MUST NEVER turn an
+  uninstall into a silent no-op. A scope merely being SWEPT (the other scope during `install`, the
+  second scope of `uninstall --scope auto`) MUST be probe-gated, so a scope nobody asked about is
+  never written to.
+- **`uninstall` scope sweep.** An explicit `--scope` removes exactly that scope. `--scope auto`
+  removes the resolved scope and then sweeps the other, so an uninstall can never leave a
+  registration behind still starting the node. Every scope is reported
+  (`result.removed_scopes: ["system", "user"]`). Anything short of a complete removal MUST be an
+  error naming the scope, never a silent success: a scope seen but not removed, or one left
+  **indeterminate** (the probe could not read it AND the removal did not succeed, so a remaining
+  registration is unproven either way). Only when nothing was removed anywhere AND nothing is
+  unresolved is the result `NOT_FOUND` ("nothing to uninstall"), carrying the underlying removal
+  error as context.
+- **Native packages register system scope**, consistently with `--scope system`: the `.deb`'s static
+  systemd unit is `WantedBy=multi-user.target` running as root, and the macOS `postinstall`
+  bootstraps into the `system` launchd domain (§9.7).
 
 9.2. **Recorded environment.** `install` MUST register the absolute path of the currently-running
 executable (never a PATH lookup) and record the resolved config as service environment variables:
@@ -1727,12 +1776,15 @@ registering a system-level service, `install` MUST verify the program's director
 component privileged-owned, non-reparse) and **refuse with `PERMISSION_DENIED`** otherwise, before any
 side effect (no state-dir harden, no service create). This is the SAME spawn-free owner gate the
 self-heal spawn root (§7 #565) and the TLS material root (§4.1a #661) use — one shared check,
-fail-closed on an indeterminate owner. A **user-level** install
-(the Linux/macOS default) runs as the very user who owns the binary, crosses no privilege boundary,
-and is always allowed. The canonical install path (native OS package, §9.7) places the binary in a
-protected admin-owned location (`%ProgramFiles%\DIG Network\dig-node\`, `/usr/…`), so it satisfies
-the gate; a manual `dig-node install` from a user-writable download directory is what the gate
-refuses. A single explicit, **default-off** opt-out — the `DIG_NODE_ALLOW_INSECURE_SERVICE_TARGET`
+fail-closed on an indeterminate owner. The refusal MUST NAME the offending path
+LEVEL (the first ancestor that fails the check), not merely the program path: the check walks the
+whole chain, so a privileged-owned leaf under a user-writable parent is refused, and an operator
+cannot act on a refusal that does not say which level failed. A **user-scope** install runs as the
+very user who owns the binary, crosses no privilege boundary, and is always allowed. The canonical
+install paths (native OS package, §9.7; the dig-installer's root-owned `/opt/dig/bin`) place the
+binary in a protected admin-owned location (`%ProgramFiles%\DIG Network\dig-node\`, `/usr/…`), so
+they satisfy the gate; a manual system-scope `dig-node install` from a user-writable download
+directory is what the gate refuses — and it is refused loudly, never downgraded to user scope. A single explicit, **default-off** opt-out — the `DIG_NODE_ALLOW_INSECURE_SERVICE_TARGET`
 env var (truthy `1`/`true`/`yes`) — bypasses the gate with a loud warning, intended ONLY for a
 controlled test/dev install of an unreleased build from a build directory (e.g. the `service-smoke`
 CI); it MUST NOT be set on an end-user machine.
diff --git a/crates/dig-node-service/src/entrypoint.rs b/crates/dig-node-service/src/entrypoint.rs
index 1629ef1..ee68483 100644
--- a/crates/dig-node-service/src/entrypoint.rs
+++ b/crates/dig-node-service/src/entrypoint.rs
@@ -36,8 +36,24 @@ use crate::control_cli::{self, ControlAction};
 use crate::open;
 use crate::pair::{self, PairAction};
 use crate::peers::{self, BanState, PeersAction};
+use crate::service::ScopeChoice;
 use crate::{serve, service, VERSION};
 
+/// The shared `--scope <auto|system|user>` flag carried by every service verb (#526).
+///
+/// Flattened into each verb rather than declared four times, so the flag's spelling, default and
+/// help text can never drift between `install`, `uninstall`, `start` and `stop`. The default is
+/// `auto`, so a caller that passes no flag at all — including a dig-installer release predating
+/// this flag — behaves exactly as it did before.
+#[derive(clap::Args)]
+struct ScopeArg {
+    /// Which OS scope to act on: `system` (machine-wide, starts at boot, needs root/Administrator),
+    /// `user` (per-user, no elevation, starts with your login session), or `auto` — system when
+    /// running elevated, user otherwise. Windows has only system scope.
+    #[arg(long = "scope", value_enum, default_value_t = ScopeChoice::Auto)]
+    choice: ScopeChoice,
+}
+
 #[derive(Parser)]
 #[command(
     // A default only: [`run`] overrides both the displayed name and the usage `bin_name`
@@ -68,13 +84,25 @@ enum Command {
     #[command(hide = true)]
     RunService,
     /// Register the node as an auto-starting OS service.
-    Install,
+    Install {
+        #[command(flatten)]
+        scope: ScopeArg,
+    },
     /// Remove the OS service.
-    Uninstall,
+    Uninstall {
+        #[command(flatten)]
+        scope: ScopeArg,
+    },
     /// Start the installed service.
-    Start,
+    Start {
+        #[command(flatten)]
+        scope: ScopeArg,
+    },
     /// Stop the running service.
-    Stop,
+    Stop {
+        #[command(flatten)]
+        scope: ScopeArg,
+    },
     /// Report whether the node is serving (probes /health).
     Status,
     /// Pair a browser controller (the DIG Chrome extension) with this node (#280):
@@ -291,10 +319,10 @@ impl Command {
     fn action(&self) -> &'static str {
         match self {
             Command::Run | Command::RunService => "run",
-            Command::Install => "install",
-            Command::Uninstall => "uninstall",
-            Command::Start => "start",
-            Command::Stop => "stop",
+            Command::Install { .. } => "install",
+            Command::Uninstall { .. } => "uninstall",
+            Command::Start { .. } => "start",
+            Command::Stop { .. } => "stop",
             Command::Status => "status",
             Command::Pair { .. } => "pair",
             Command::Open { .. } => "open",
@@ -377,10 +405,10 @@ pub fn run() -> std::process::ExitCode {
     let exit = match command {
         Command::Run => render_serve(block_on_serve(config), action, json),
         Command::RunService => render_serve(run_service(config), action, json),
-        Command::Install => render(service::install(&config), action, json),
-        Command::Uninstall => render(service::uninstall(), action, json),
-        Command::Start => render(service::start(), action, json),
-        Command::Stop => render(service::stop(), action, json),
+        Command::Install { scope } => render(service::install(&config, scope.choice), action, json),
+        Command::Uninstall { scope } => render(service::uninstall(scope.choice), action, json),
+        Command::Start { scope } => render(service::start(scope.choice), action, json),
+        Command::Stop { scope } => render(service::stop(scope.choice), action, json),
         Command::Status => render_status(service::status(&config), action, json),
         Command::Pair { action: pair_cmd } => {
             let pair_action = match pair_cmd {
diff --git a/crates/dig-node-service/src/security.rs b/crates/dig-node-service/src/security.rs
index 5a2b4a1..75f8cc1 100644
--- a/crates/dig-node-service/src/security.rs
+++ b/crates/dig-node-service/src/security.rs
@@ -40,7 +40,16 @@ use std::path::Path;
 /// component is untrusted. `dir.ancestors()` always yields at least `dir`, so an empty chain can
 /// never vacuously pass.
 pub fn dir_is_privileged(dir: &Path) -> bool {
-    dir.ancestors().all(component_is_privileged)
+    first_unprivileged_ancestor(dir).is_none()
+}
+
+/// The FIRST ancestor component of `dir` (walking leaf → filesystem root) that fails the trust bar,
+/// or `None` when the whole chain is privileged. The diagnostic twin of [`dir_is_privileged`]: the
+/// boolean answers *whether* a path is trustworthy, this answers *which level* is not — so a refusal
+/// can name the offending directory instead of leaving an operator to bisect the chain by hand
+/// (#526: the system-service install gate must be actionable, never a silent downgrade).
+pub fn first_unprivileged_ancestor(dir: &Path) -> Option<&Path> {
+    dir.ancestors().find(|c| !component_is_privileged(c))
 }
 
 /// Whether a SINGLE existing path `component` clears the trust bar: privileged-owned, not
diff --git a/crates/dig-node-service/src/service.rs b/crates/dig-node-service/src/service.rs
index 2ecfc30..1a13e9e 100644
--- a/crates/dig-node-service/src/service.rs
+++ b/crates/dig-node-service/src/service.rs
@@ -40,14 +40,27 @@
 //!   backend) and could flip the installer's reported `installed` status to `false` even though
 //!   the service is up. So `reinstall` here stops at **create** — a caller starts it explicitly.
 //!
-//! Install level by platform:
-//!   * Linux (systemd) / macOS (launchd) — **user-level** by default (`--user` /
-//!     `gui` domain), so no root/sudo is needed and the service runs as the
-//!     installing user.
-//!   * Windows (SCM) — **system-level only**: the Service Control Manager has no
-//!     per-user services, so `install`/`uninstall` require an **elevated
-//!     (Administrator)** console. This is detected up front and reported with a
-//!     clear message rather than failing deep inside `sc.exe`.
+//! ## Install SCOPE (#526)
+//!
+//! Every service verb is **scope-explicit**: `--scope <auto|system|user>` (default `auto`) selects
+//! which OS scope ([`ServiceScope`]) the registration lives in, resolved by the one pure decision
+//! function [`resolve_scope`].
+//!
+//!   * Linux (systemd) / macOS (launchd) — BOTH scopes exist. `auto` picks **system** when running
+//!     as root (what an elevated `dig-installer` needs: a `multi-user.target` unit / a
+//!     `/Library/LaunchDaemons` daemon that starts at BOOT with no login session — matching what
+//!     dig-node's own native packages already register) and **user** otherwise (the historical
+//!     no-elevation desktop install: a `systemd --user` unit / a `gui/<uid>` agent).
+//!     Root has NO systemd `--user` D-Bus session, which is precisely why the previous
+//!     unconditional user-level preference made an elevated headless install impossible.
+//!   * Windows (SCM) — **system scope only**: the Service Control Manager has no per-user services,
+//!     so every choice resolves to system and `install`/`uninstall` require an **elevated
+//!     (Administrator)** console. This is detected up front and reported with a clear message
+//!     rather than failing deep inside `sc.exe`.
+//!
+//! `install` clears any registration at the OTHER scope first ([`install_at_scope`]) so a host
+//! upgrading from a user-level install never runs two units racing for the same port, and
+//! `uninstall --scope auto` sweeps BOTH scopes so nothing is left starting the node.
 //!
 //! The OS calls are behind the [`ServiceBackend`] trait so the clean-reinstall ORDER is
 //! unit-tested against a recording mock — CI never shells out to `sc`/`launchctl`/`systemctl`
@@ -93,12 +106,178 @@ const REMOVAL_POLL_ATTEMPTS: u32 = 40;
 /// The interval between removal polls (see [`REMOVAL_POLL_ATTEMPTS`]).
 const REMOVAL_POLL_INTERVAL: Duration = Duration::from_millis(500);
 
-/// Whether user-level (no-elevation) install is supported on this OS. Windows SCM
-/// is system-only; systemd/launchd support a user domain.
-#[cfg(windows)]
-const PREFERS_USER_LEVEL: bool = false;
-#[cfg(not(windows))]
-const PREFERS_USER_LEVEL: bool = true;
+// ---------------------------------------------------------------------------------------------
+// Service SCOPE (#526): which OS scope a registration lives in, and how one is chosen.
+// ---------------------------------------------------------------------------------------------
+
+/// The OS scope a service registration lives in.
+///
+/// The two scopes are genuinely different registrations in different places, with different
+/// survival properties:
+///
+/// * [`ServiceScope::System`] — a machine-wide registration owned by the privileged principal:
+///   a systemd **system** unit (`/etc/systemd/system/…`, `WantedBy=multi-user.target`), a launchd
+///   **daemon** (`/Library/LaunchDaemons/…`, `system` domain), or a Windows SCM service. It starts
+///   at BOOT, with **no logged-in user session** — the only scope that survives a reboot on a
+///   headless host. Registering one requires root/Administrator.
+/// * [`ServiceScope::User`] — a per-user registration: a systemd **user** unit
+///   (`~/.config/systemd/user/…`) or a launchd **agent** (`gui/<uid>` domain). It needs no
+///   elevation, runs as the installing user, and starts when that user's session/manager starts —
+///   so on a headless host it may not come back after a reboot at all. Windows SCM has no
+///   equivalent, so this scope simply does not exist there.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ServiceScope {
+    /// Machine-wide, privileged, boot-started (see the type doc).
+    System,
+    /// Per-user, no elevation required, session-started (see the type doc).
+    User,
+}
+
+impl ServiceScope {
+    /// Whether this is the per-user (no-elevation) scope.
+    pub fn is_user(self) -> bool {
+        self == ServiceScope::User
+    }
+
+    /// The lowercase wire/CLI spelling (`"system"` / `"user"`), used in `--json` output and prose.
+    pub fn as_str(self) -> &'static str {
+        match self {
+            ServiceScope::System => "system",
+            ServiceScope::User => "user",
+        }
+    }
+
+    /// The OTHER scope — the one a stale registration from a previous install could be hiding in
+    /// (see [`install_at_scope`]).
+    pub fn other(self) -> Self {
+        match self {
+            ServiceScope::System => ServiceScope::User,
+            ServiceScope::User => ServiceScope::System,
+        }
+    }
+}
+
+/// What the operator ASKED for on the command line (`--scope <auto|system|user>`).
+///
+/// Distinct from [`ServiceScope`] — the resolved answer — because `auto` is not a scope: it is a
+/// request to let the host decide ([`resolve_scope`]). Kept as the default so a caller that passes
+/// no flag (including a dig-installer release predating #526) behaves exactly as before.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, clap::ValueEnum)]
+pub enum ScopeChoice {
+    /// Let the host decide: system scope when running as root/elevated, user scope otherwise.
+    #[default]
+    Auto,
+    /// Force a machine-wide, boot-started registration (requires root/Administrator).
+    System,
+    /// Force a per-user registration (ignored on Windows, which has no user scope).
+    User,
+}
+
+/// Resolve the scope to act on. **The one scope decision in the codebase**, and deliberately PURE:
+/// every input is a parameter — no `cfg!`, no `geteuid`, no filesystem — so the complete decision
+/// table is unit-tested on any host at any privilege level (a `#[cfg(unix)]`-only scope test would
+/// be unfalsifiable on a Windows dev box).
+///
+/// * `os_supports_user == false` (Windows SCM) ⇒ always [`ServiceScope::System`]: there is exactly
+///   one scope, so even an explicit `--scope user` cannot be honoured.
+/// * An explicit [`ScopeChoice::System`]/[`ScopeChoice::User`] is **authoritative** — never silently
+///   overridden by the privilege level. (Whether the caller may actually register there is a
+///   separate, loudly-reported question: [`ensure_privilege_for_scope`].)
+/// * [`ScopeChoice::Auto`] follows privilege: root gets the reboot-surviving system registration an
+///   elevated installer needs; an ordinary desktop user keeps the historical no-elevation user
+///   registration.
+pub fn resolve_scope(choice: ScopeChoice, os_supports_user: bool, is_root: bool) -> ServiceScope {
+    if !os_supports_user {
+        return ServiceScope::System;
+    }
+    match choice {
+        ScopeChoice::System => ServiceScope::System,
+        ScopeChoice::User => ServiceScope::User,
+        ScopeChoice::Auto if is_root => ServiceScope::System,
+        ScopeChoice::Auto => ServiceScope::User,
+    }
+}
+
+/// The scopes `uninstall` must sweep, in the order to sweep them.
+///
+/// An explicit choice removes exactly what was named. **`auto` sweeps BOTH scopes** (requested one
+/// first) on a user-capable OS: an uninstall that silently leaves the other scope's registration
+/// behind is the defect class where a "removed" node keeps starting at boot. Sweeping is safe
+/// because each scope is PROBED before anything is deleted ([`remove_registration`]), so a scope
+/// holding nothing is never written to.
+pub fn uninstall_scopes(
+    choice: ScopeChoice,
+    os_supports_user: bool,
+    is_root: bool,
+) -> Vec<ServiceScope> {
+    let requested = resolve_scope(choice, os_supports_user, is_root);
+    if !os_supports_user || choice != ScopeChoice::Auto {
+        return vec![requested];
+    }
+    vec![requested, requested.other()]
+}
+
+/// Whether this OS has a per-user service scope at all. Windows SCM has no per-user services;
+/// systemd and launchd both do. The one `cfg!`-reading adapter that feeds the pure
+/// [`resolve_scope`] decision.
+fn host_supports_user_scope() -> bool {
+    !cfg!(windows)
+}
+
+/// Whether this process is root (uid 0). Read via `id -u` rather than adding a `libc` dependency
+/// for one call — the same approach [`launchd_domain_target`] already uses for the uid. Always
+/// `false` off unix, where the answer never reaches a decision: Windows has no user scope, so
+/// [`resolve_scope`] short-circuits to system and elevation is checked by the SCM gate
+/// ([`is_elevated`]).
+#[cfg(unix)]
+fn host_is_root() -> bool {
+    unix_uid() == Some(0)
+}
+#[cfg(not(unix))]
+fn host_is_root() -> bool {
+    false
+}
+
+/// The effective uid via `id -u`, or `None` when it cannot be determined.
+#[cfg(unix)]
+fn unix_uid() -> Option<u32> {
+    std::process::Command::new("id")
+        .arg("-u")
+        .output()
+        .ok()
+        .and_then(|o| String::from_utf8(o.stdout).ok())
+        .and_then(|s| s.trim().parse::<u32>().ok())
+}
+
+/// Resolve `choice` against THIS host — the single place the pure [`resolve_scope`] decision meets
+/// the real OS and privilege level.
+fn host_scope(choice: ScopeChoice) -> ServiceScope {
+    resolve_scope(choice, host_supports_user_scope(), host_is_root())
+}
+
+/// Refuse a system-scope registration that the caller cannot actually make, with a message that
+/// says what to do — rather than failing cryptically deep inside `systemctl`/`launchctl`, and
+/// rather than silently downgrading to user scope (which on a headless host would not survive a
+/// reboot: exactly the defect #526 fixes). PURE, so the policy is table-tested.
+///
+/// Windows is exempt: it has no user scope, and its elevation requirement is reported by its own
+/// SCM gate ([`is_elevated`]) with Windows-specific advice.
+fn ensure_privilege_for_scope(
+    scope: ServiceScope,
+    os_supports_user: bool,
+    is_root: bool,
+) -> io::Result<()> {
+    if !os_supports_user || scope.is_user() || is_root {
+        return Ok(());
+    }
+    Err(io::Error::new(
+        io::ErrorKind::PermissionDenied,
+        "dig-node: registering a system-level (machine-wide, boot-started) service requires \
+         root. Re-run with `sudo dig-node install --scope system`, or install at user scope \
+         (`--scope user`) — noting that a user-scope service only starts with your login \
+         session and so may not come back after a reboot on a headless host.",
+    ))
+}
 
 // These recovery-action items back the Windows-only crash-restart path
 // ([`configure_windows_recovery`] + the note in [`install`]), but are deliberately kept
@@ -249,6 +428,206 @@ pub fn reinstall<B: ServiceBackend>(
     Ok(report)
 }
 
+/// What a per-scope removal attempt did — the reporting unit for the cross-scope migration
+/// ([`install_at_scope`]) and for `uninstall` ([`remove_registrations`]).
+///
+/// `found` (what the PROBE saw) and `removed` (what the OS deregistration actually did) are
+/// deliberately separate, because **the probe is advisory and the deregistration is authoritative**:
+/// `launchctl print gui/<uid>/<label>` cannot see a per-user agent from a session with no Aqua/GUI
+/// domain (a headless CI runner, an ssh login), so it false-negatives on a service that IS
+/// registered. Only `removed` proves anything; `found` explains, and `indeterminate` admits when
+/// absence was never established.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ScopeRemoval {
+    /// The scope this attempt addressed.
+    pub scope: ServiceScope,
+    /// The probe SAW a registration at this scope. Advisory only — a `false` here does NOT prove
+    /// absence (see the type doc).
+    pub found: bool,
+    /// The OS deregistration succeeded. The authoritative signal.
+    pub removed: bool,
+    /// Absence was never established: the probe failed (or said nothing was there) AND the removal
+    /// did not succeed either — so whether a registration remains is UNKNOWN, and must not be
+    /// reported as a clean uninstall.
+    pub indeterminate: bool,
+    /// Why the probe or the removal failed, when one did. `None` on success and on a clean
+    /// "nothing registered here".
+    pub error: Option<String>,
+}
+
+/// How hard to try at a scope — the distinction that keeps a probe false-negative from turning into
+/// a silent no-op.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RemovalMode {
+    /// The scope the operator NAMED (or `auto` resolved to). Deregistered UNCONDITIONALLY: the OS
+    /// removal call is the authority, so a probe that wrongly reports absence can never turn the
+    /// uninstall into a no-op. (This is also the pre-#526 behaviour of `uninstall`, which always
+    /// called delete outright.)
+    Requested,
+    /// A scope being swept for a stale registration nobody asked about (the other scope during
+    /// `install`, the second scope under `uninstall --scope auto`). PROBE-GATED: nothing is written
+    /// unless a registration is actually seen, so a sweep can never disturb an unrelated scope.
+    Swept,
+}
+
+/// Deregister the service at ONE scope, best-effort, reporting exactly what happened.
+///
+/// Never returns `Err`: the caller decides which combination of per-scope outcomes is fatal (a stale
+/// swept registration is not; a named scope left behind is). See [`RemovalMode`] for why a
+/// [`RemovalMode::Requested`] scope is removed without trusting the probe.
+pub fn remove_registration<B: ServiceBackend + ?Sized>(
+    backend: &B,
+    scope: ServiceScope,
+    mode: RemovalMode,
+) -> ScopeRemoval {
+    let mut removal = ScopeRemoval {
+        scope,
+        found: false,
+        removed: false,
+        indeterminate: false,
+        error: None,
+    };
+    let probe = backend.is_installed();
+    match &probe {
+        Ok(found) => removal.found = *found,
+        Err(e) => {
+            removal.error = Some(format!("could not determine whether it is registered: {e}"))
+        }
+    }
+    // A sweep touches nothing it did not positively see — an unrelated scope must never be written
+    // to on the strength of a guess. A probe FAILURE leaves the swept scope indeterminate: absence
+    // was not established, and the caller reports that rather than assuming it is clean.
+    if mode == RemovalMode::Swept && !removal.found {
+        removal.indeterminate = probe.is_err();
+        return removal;
+    }
+    // Best-effort stop first so nothing keeps holding the node's port past the deregistration.
+    let _ = backend.stop();
+    match backend.delete() {
+        Ok(()) => removal.removed = true,
+        Err(e) => {
+            // A failed delete at a scope the probe never saw a registration at is the ordinary
+            // "there was nothing here" case (the OS says so twice) — keep the reason for context,
+            // but only a scope we DID see, or could not read at all, is unresolved.
+            removal.indeterminate = probe.is_err();
+            removal.error = Some(e.to_string());
+        }
+    }
+    removal
+}
+
+/// Register at the requested scope, first clearing any registration at the OTHER scope.
+///
+/// **The other-scope sweep is a placement requirement, not a nicety.** A host upgrading from a
+/// prior user-level install to a system-level one would otherwise end up with TWO registrations,
+/// both starting a node bound to the same port; which one wins is a race, and the stale one can.
+/// So the other scope is deregistered BEFORE the requested one is created — never after, which
+/// would delete a registration the new one may share state with, and never left to the caller.
+///
+/// The sweep is best-effort: an unprivileged install cannot delete a system unit, and that must be
+/// REPORTED (in the returned [`ScopeRemoval`]) rather than fail an otherwise-good install. `other`
+/// is `None` where the platform has only one scope (Windows).
+pub fn install_at_scope<T: ServiceBackend, O: ServiceBackend>(
+    target: &T,
+    other: Option<(&O, ServiceScope)>,
+    plan: &InstallPlan,
+) -> io::Result<(ReinstallReport, Option<ScopeRemoval>)> {
+    let migration =
+        other.map(|(backend, scope)| remove_registration(backend, scope, RemovalMode::Swept));
+    let report = reinstall(target, plan)?;
+    Ok((report, migration))
+}
+
+/// Remove at several scopes, in order, reporting each ([`remove_registration`]).
+pub fn remove_registrations(
+    targets: &[(&dyn ServiceBackend, ServiceScope, RemovalMode)],
+) -> Vec<ScopeRemoval> {
+    targets
+        .iter()
+        .map(|(backend, scope, mode)| remove_registration(*backend, *scope, *mode))
+        .collect()
+}
+
+/// Turn per-scope removal results into the `uninstall` [`Outcome`], failing LOUDLY on anything
+/// less than a complete removal.
+///
+/// * Any scope found-but-not-removed, or left indeterminate ⇒ `Err`: an uninstall that leaves a
+///   registration behind — or cannot tell whether it did — must never report success, which is how
+///   a "removed" node keeps starting at boot.
+/// * Nothing removed anywhere, and nothing unresolved ⇒ `Err(NotFound)`: there was nothing to
+///   uninstall. Any removal error collected along the way is carried as context, since the reason a
+///   delete failed is the best evidence available for "there was nothing here".
+/// * Otherwise ⇒ success, naming every scope removed.
+fn uninstall_outcome(removals: Vec<ScopeRemoval>) -> io::Result<Outcome> {
+    let removed: Vec<&'static str> = removals
+        .iter()
+        .filter(|r| r.removed)
+        .map(|r| r.scope.as_str())
+        .collect();
+    let problems: Vec<String> = removals
+        .iter()
+        .filter(|r| r.indeterminate || (r.found && !r.removed))
+        .map(|r| {
+            let why = r.error.as_deref().unwrap_or("removal did not take effect");
+            format!("{} scope: {why}", r.scope.as_str())
+        })
+        .collect();
+
+    if !problems.is_empty() {
+        let removed_note = if removed.is_empty() {
+            "nothing was removed".to_string()
+        } else {
+            format!("removed at: {}", removed.join(", "))
+        };
+        return Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!(
+                "dig-node: could not fully uninstall service \"{SERVICE_LABEL}\" ({removed_note}). \
+                 Unresolved: {}. Re-run elevated (e.g. `sudo dig-node uninstall --scope system`) — \
+                 a registration left behind will keep starting the node.",
+                problems.join("; ")
+            ),
+        ));
+    }
+    if removed.is_empty() {
+        return Err(io::Error::new(io::ErrorKind::NotFound, {
+            let scopes = removals
+                .iter()
+                .map(|r| r.scope.as_str())
+                .collect::<Vec<_>>()
+                .join(" or ");
+            let reasons = removals
+                .iter()
+                .filter_map(|r| {
+                    r.error
+                        .as_deref()
+                        .map(|e| format!("{} scope: {e}", r.scope.as_str()))
+                })
+                .collect::<Vec<_>>();
+            let mut msg = format!(
+                "dig-node: no service registration for \"{SERVICE_LABEL}\" was found at \
+                     {scopes} scope — nothing to uninstall."
+            );
+            if !reasons.is_empty() {
+                msg.push_str(&format!(" ({})", reasons.join("; ")));
+            }
+            msg
+        }));
+    }
+    Ok(Outcome::new(
+        format!(
+            "dig-node: uninstalled service \"{SERVICE_LABEL}\" at {} scope",
+            removed.join(" + ")
+        ),
+        json!({
+            "installed": false,
+            "registered": false,
+            "label": SERVICE_LABEL,
+            "removed_scopes": removed,
+        }),
+    ))
+}
+
 /// Poll [`ServiceBackend::is_installed`] until the service is gone, bounded by
 /// [`REMOVAL_POLL_ATTEMPTS`]. Checks BEFORE sleeping, so a backend that removes synchronously
 /// (the test mock, and systemd/launchd) returns immediately with no delay; only a lingering
@@ -410,22 +789,27 @@ fn insecure_service_target_allowed() -> bool {
 /// user who owns the binary — there is no privilege boundary to cross — so it is always allowed.
 /// `allow_insecure_override` is the explicit test/dev opt-out
 /// ([`ALLOW_INSECURE_SERVICE_TARGET_ENV`]); it is default-`false` in production.
+///
+/// Since #526 this genuinely fires on unix too (a root systemd unit / launchd daemon is as
+/// privileged as a Windows SYSTEM service), so its refusal NAMES the offending directory level: the
+/// gate walks every ancestor, and an operator cannot act on "somewhere in this path is
+/// user-writable". The canonical installer target (`/opt/dig/bin`, root-owned) clears it.
 fn ensure_service_target_is_safe(
     program: &std::path::Path,
-    user_level: bool,
+    scope: ServiceScope,
     allow_insecure_override: bool,
 ) -> io::Result<()> {
     // A user-level service runs as the installing user: swapping a binary that user already owns
     // grants that user nothing it lacked. No privilege boundary, no LPE — always allowed.
-    if user_level {
+    if scope.is_user() {
         return Ok(());
     }
     // The program's directory is the surface an attacker would need write access to; a
     // privileged-owned directory keeps a non-privileged user from replacing the binary in it.
     let root = program.parent().unwrap_or(program);
-    if crate::security::dir_is_privileged(root) {
+    let Some(offending) = crate::security::first_unprivileged_ancestor(root) else {
         return Ok(());
-    }
+    };
     // Explicit, default-off test/dev opt-out — a controlled install of an unreleased build from a
     // build directory (see the env-var doc). Never set on an end-user machine.
     if allow_insecure_override {
@@ -442,12 +826,13 @@ fn ensure_service_target_is_safe(
         io::ErrorKind::PermissionDenied,
         format!(
             "dig-node: refusing to register a system-level (privileged) service pointing at \
-             \"{}\", whose directory is writable by a non-privileged user. Registering it would \
-             let any local user replace that binary and gain persistent SYSTEM/root code \
+             \"{}\": the path level \"{}\" is writable by a non-privileged user. Registering it \
+             would let any local user replace that binary and gain persistent SYSTEM/root code \
              execution (a privilege-escalation vector, #565). Install dig-node into a protected, \
              admin-owned location — via the DIG installer or a native OS package — and re-run \
              `dig-node install` from there.",
-            program.display()
+            program.display(),
+            offending.display(),
         ),
     ))
 }
@@ -473,38 +858,53 @@ fn is_elevated() -> bool {
     true
 }
 
-/// The real [`ServiceBackend`]: the native OS service manager (user-level on Linux/macOS,
-/// system-level on Windows) plus the OS existence probe and the Windows display-name override
-/// + read-back verify.
+/// The real [`ServiceBackend`]: the native OS service manager pinned to ONE
+/// [`ServiceScope`], plus the scope-aware OS existence probe and the Windows display-name
+/// override + read-back verify.
 pub struct SystemServiceBackend {
     label: ServiceLabel,
     manager: Box<dyn ServiceManager>,
-    /// Whether the manager is operating at user level (Linux/macOS) — surfaced for messaging.
-    user_level: bool,
+    /// The scope this backend acts on — every probe/create/delete addresses THAT scope only.
+    scope: ServiceScope,
     /// Windows-only: whether the post-create `sc qc` read-back confirmed the display name was
     /// actually applied. `None` off Windows (nothing to verify) or before a `create` has run.
     display_name_verified: Cell<Option<bool>>,
 }
 
 impl SystemServiceBackend {
-    /// Acquire the native service manager, set to user-level where the platform supports it.
-    pub fn new() -> io::Result<Self> {
+    /// Acquire the native service manager pinned to `scope`.
+    ///
+    /// A scope the platform's manager cannot address is an ERROR naming the scope — never a silent
+    /// downgrade to the other one, which is how a requested boot-surviving registration would
+    /// quietly become a session-only one (#526).
+    pub fn new(scope: ServiceScope) -> io::Result<Self> {
         let mut manager = <dyn ServiceManager>::native()?;
-        let mut user_level = false;
-        if PREFERS_USER_LEVEL && manager.set_level(ServiceLevel::User).is_ok() {
-            user_level = true;
-        }
+        let level = if scope.is_user() {
+            ServiceLevel::User
+        } else {
+            ServiceLevel::System
+        };
+        manager.set_level(level).map_err(|e| {
+            io::Error::new(
+                io::ErrorKind::Unsupported,
+                format!(
+                    "dig-node: this platform's service manager cannot register a {}-level \
+                     service ({e})",
+                    scope.as_str()
+                ),
+            )
+        })?;
         Ok(Self {
             label: label()?,
             manager,
-            user_level,
+            scope,
             display_name_verified: Cell::new(None),
         })
     }
 
-    /// Whether this backend installs at user level (no elevation) vs system level.
-    pub fn user_level(&self) -> bool {
-        self.user_level
+    /// The scope this backend acts on.
+    pub fn scope(&self) -> ServiceScope {
+        self.scope
     }
 
     /// Windows: whether the `sc qc` read-back confirmed the display-name override took effect.
@@ -523,7 +923,10 @@ impl SystemServiceBackend {
 
 impl ServiceBackend for SystemServiceBackend {
     fn is_installed(&self) -> io::Result<bool> {
-        Ok(query_installed(&os_native_service_name(&self.label)))
+        Ok(query_installed(
+            &os_native_service_name(&self.label),
+            self.scope,
+        ))
     }
 
     fn stop(&self) -> io::Result<()> {
@@ -586,10 +989,11 @@ fn os_native_service_name(label: &ServiceLabel) -> String {
     }
 }
 
-/// Probe whether a service named `service_name` is registered, per OS. Best-effort: a probe
-/// that cannot run (tool missing) reports `false` so the clean-reinstall proceeds to create.
+/// Probe whether a service named `service_name` is registered AT `scope`, per OS. Best-effort: a
+/// probe that cannot run (tool missing) reports `false` so the clean-reinstall proceeds to create.
+/// Windows SCM has exactly one scope, so `scope` carries no information there.
 #[cfg(windows)]
-fn query_installed(service_name: &str) -> bool {
+fn query_installed(service_name: &str, _scope: ServiceScope) -> bool {
     // `sc query <name>` exits 0 when the service exists, 1060 (does-not-exist) otherwise.
     std::process::Command::new("sc.exe")
         .args(["query", service_name])
@@ -601,10 +1005,10 @@ fn query_installed(service_name: &str) -> bool {
 }
 
 /// macOS launchd existence probe: `launchctl print <domain>/<label>` exits 0 when the service
-/// is bootstrapped.
+/// is bootstrapped in that scope's domain.
 #[cfg(target_os = "macos")]
-fn query_installed(service_name: &str) -> bool {
-    let domain = launchd_domain_target(service_name);
+fn query_installed(service_name: &str, scope: ServiceScope) -> bool {
+    let domain = launchd_domain_target(service_name, scope);
     std::process::Command::new("launchctl")
         .args(["print", &domain])
         .stdout(std::process::Stdio::null())
@@ -615,12 +1019,14 @@ fn query_installed(service_name: &str) -> bool {
 }
 
 /// Linux systemd existence probe: `systemctl [--user] cat <label>.service` exits 0 when the
-/// unit file exists (non-zero "No files found" otherwise).
+/// unit file exists in that scope (non-zero "No files found" otherwise). `--user` addresses the
+/// per-user manager, its absence the system manager — the two hold DIFFERENT unit files, so the
+/// flag must track the scope being probed or the probe reports on the wrong registration.
 #[cfg(all(unix, not(target_os = "macos")))]
-fn query_installed(service_name: &str) -> bool {
+fn query_installed(service_name: &str, scope: ServiceScope) -> bool {
     let unit = format!("{service_name}.service");
     let mut cmd = std::process::Command::new("systemctl");
-    if PREFERS_USER_LEVEL {
+    if scope.is_user() {
         cmd.arg("--user");
     }
     cmd.args(["cat", &unit])
@@ -631,29 +1037,18 @@ fn query_installed(service_name: &str) -> bool {
         .unwrap_or(false)
 }
 
-/// The launchd domain target (`gui/<uid>/<label>` for a user agent, `system/<label>` for a
-/// daemon) `launchctl print` addresses. PURE given the uid, so the format is testable.
+/// The launchd domain target `launchctl print` addresses for `scope`: `gui/<uid>/<label>` for a
+/// per-user AGENT, `system/<label>` for a machine-wide DAEMON — the same `system` domain
+/// `packaging/macos/scripts/postinstall` bootstraps into.
 #[cfg(target_os = "macos")]
-fn launchd_domain_target(service_name: &str) -> String {
-    if PREFERS_USER_LEVEL {
-        format!("gui/{}/{}", unsafe { libc_getuid() }, service_name)
+fn launchd_domain_target(service_name: &str, scope: ServiceScope) -> String {
+    if scope.is_user() {
+        format!("gui/{}/{}", unix_uid().unwrap_or(0), service_name)
     } else {
         format!("system/{service_name}")
     }
 }
 
-#[cfg(target_os = "macos")]
-fn libc_getuid() -> u32 {
-    // Avoid a `libc` dependency for one call: read the effective uid via `id -u`.
-    std::process::Command::new("id")
-        .arg("-u")
-        .output()
-        .ok()
-        .and_then(|o| String::from_utf8(o.stdout).ok())
-        .and_then(|s| s.trim().parse::<u32>().ok())
-        .unwrap_or(0)
-}
-
 /// Override the Windows service display name (`sc config <name> displayname= "<display>"`).
 /// Best-effort; a failure is swallowed (the service is already usable under its id) — the
 /// caller reads back the result via [`query_windows_display_name`].
@@ -703,11 +1098,19 @@ fn ensure_install_host_allowed(config: &Config) -> io::Result<()> {
 /// [`configure_windows_recovery`] — so a crashed service comes back up the same way systemd
 /// (`Restart=on-failure`) and launchd (`KeepAlive`) already do for Linux/macOS via
 /// `service-manager`'s own defaults.
-pub fn install(config: &Config) -> io::Result<Outcome> {
+///
+/// `scope` selects WHERE the registration lands (#526): [`ScopeChoice::Auto`] — the default, and
+/// what a caller passing no flag gets — keeps the historical no-elevation user registration for a
+/// desktop user while giving an ELEVATED installer the machine-wide, boot-started one it needs on a
+/// headless host. Any registration at the other scope is cleared first ([`install_at_scope`]).
+pub fn install(config: &Config, scope: ScopeChoice) -> io::Result<Outcome> {
     // #1667: fail fast on a remote bind that lacks the escape hatch, BEFORE any side effect
     // (service registration, state-dir harden), so the refusal leaves nothing behind.
     ensure_install_host_allowed(config)?;
 
+    let scope = host_scope(scope);
+    ensure_privilege_for_scope(scope, host_supports_user_scope(), host_is_root())?;
+
     if cfg!(windows) && !is_elevated() {
         return Err(io::Error::new(
             io::ErrorKind::PermissionDenied,
@@ -717,17 +1120,13 @@ pub fn install(config: &Config) -> io::Result<Outcome> {
         ));
     }
 
-    let backend = SystemServiceBackend::new()?;
+    let backend = SystemServiceBackend::new(scope)?;
     let program = current_exe()?;
     // §565 LPE gate: before touching anything, refuse a privileged (system-level) registration
     // whose program binary sits in a user-writable directory — a swapped binary would run as
     // SYSTEM/root on the next start. Checked FIRST so a refusal has no side effects (no state-dir
     // harden, no service create). A user-level install runs as the invoking user and is allowed.
-    ensure_service_target_is_safe(
-        &program,
-        backend.user_level(),
-        insecure_service_target_allowed(),
-    )?;
+    ensure_service_target_is_safe(&program, scope, insecure_service_target_allowed())?;
     let plan = build_plan(config, program.clone());
 
     // HARDEN the machine-wide state dir NOW, as the INSTALLING (interactive) user, per the
@@ -751,7 +1150,18 @@ pub fn install(config: &Config) -> io::Result<Outcome> {
         }
     }
 
-    let report = reinstall(&backend, &plan)?;
+    // Clear a registration at the OTHER scope before creating this one, so a host upgrading from a
+    // previous user-level install never ends up with two units racing for the node's port. Skipped
+    // where the platform has only one scope (Windows SCM).
+    let other_scope = scope.other();
+    let other_backend = host_supports_user_scope()
+        .then(|| SystemServiceBackend::new(other_scope).ok())
+        .flatten();
+    let (report, migration) = install_at_scope(
+        &backend,
+        other_backend.as_ref().map(|b| (b, other_scope)),
+        &plan,
+    )?;
 
     // Windows: best-effort SCM recovery-action config. A failure here (e.g.
     // `sc.exe` missing/blocked) must not fail the whole install — the service is
@@ -774,11 +1184,6 @@ pub fn install(config: &Config) -> io::Result<Outcome> {
     #[cfg(not(windows))]
     let (recovery_configured, recovery_note): (bool, Option<String>) = (true, None);
 
-    let scope = if backend.user_level() {
-        "user"
-    } else {
-        "system"
-    };
     let action = if report.existed {
         "reinstalled (stopped + deleted the existing service, then recreated it)"
     } else {
@@ -786,13 +1191,33 @@ pub fn install(config: &Config) -> io::Result<Outcome> {
     };
     let addr = config.bind_addr();
     let mut summary = format!(
-        "dig-node: {action} as a {scope}-level service\n  \
+        "dig-node: {action} as a {}-level service\n  \
          id:      {SERVICE_LABEL}\n  \
          display: {SERVICE_DISPLAY_NAME}\n  \
          program: {}\n  serves:  http://{addr}\n  Set the DIG Chrome extension's \"server host\" to {addr}.\n  \
          Start it now with: dig-node start",
+        scope.as_str(),
         program.display(),
     );
+    // Report the cross-scope migration: a cleared stale registration is news, and so is one that
+    // could NOT be cleared (it would keep starting a second node bound to the same port).
+    if let Some(m) = &migration {
+        if m.removed {
+            summary.push_str(&format!(
+                "\n  note: removed a previous {}-scope registration of this service.",
+                m.scope.as_str()
+            ));
+        } else if m.found || m.indeterminate {
+            let err = m.error.as_deref().unwrap_or("removal did not take effect");
+            summary.push_str(&format!(
+                "\n  WARN a {}-scope registration of this service is still present and could \
+                 not be removed ({err}); both may try to serve the same port. Remove it with: \
+                 dig-node uninstall --scope {}",
+                m.scope.as_str(),
+                m.scope.as_str()
+            ));
+        }
+    }
     if let Some(note) = &recovery_note {
         summary.push_str("\n  ");
         summary.push_str(note);
@@ -812,7 +1237,7 @@ pub fn install(config: &Config) -> io::Result<Outcome> {
         "started": false,
         "label": SERVICE_LABEL,
         "display_name": SERVICE_DISPLAY_NAME,
-        "scope": scope,
+        "scope": scope.as_str(),
         "program": program.display().to_string(),
         "addr": addr,
         "upstream": config.upstream,
@@ -821,12 +1246,26 @@ pub fn install(config: &Config) -> io::Result<Outcome> {
     if let Some(verified) = display_name_verified {
         result["display_name_verified"] = json!(verified);
     }
+    if let Some(m) = &migration {
+        result["migrated_from_scope"] = json!({
+            "scope": m.scope.as_str(),
+            "found": m.found,
+            "removed": m.removed,
+            "indeterminate": m.indeterminate,
+            "error": m.error,
+        });
+    }
     Ok(Outcome::new(summary, result))
 }
 
-/// Uninstall the dig-node service. Stops it first (best-effort) so the uninstall
-/// is clean.
-pub fn uninstall() -> io::Result<Outcome> {
+/// Uninstall the dig-node service, stopping it first (best-effort) so the removal is clean.
+///
+/// `scope` selects WHAT to remove (#526): an explicit scope removes exactly that one, while
+/// [`ScopeChoice::Auto`] — the default — sweeps BOTH scopes, so an uninstall can never silently
+/// leave the other scope's registration behind still starting the node
+/// ([`uninstall_scopes`]/[`uninstall_outcome`]). Every scope is reported, and anything short of a
+/// complete removal is an error, never a silent success.
+pub fn uninstall(scope: ScopeChoice) -> io::Result<Outcome> {
     if cfg!(windows) && !is_elevated() {
         return Err(io::Error::new(
             io::ErrorKind::PermissionDenied,
@@ -834,14 +1273,38 @@ pub fn uninstall() -> io::Result<Outcome> {
              (Administrator) console.",
         ));
     }
-    let backend = SystemServiceBackend::new()?;
-    // Best-effort stop before removal (ignore "not running" errors).
-    let _ = backend.stop();
-    backend.delete()?;
-    Ok(Outcome::new(
-        format!("dig-node: uninstalled service \"{SERVICE_LABEL}\""),
-        json!({ "installed": false, "registered": false, "label": SERVICE_LABEL }),
-    ))
+    let scopes = uninstall_scopes(scope, host_supports_user_scope(), host_is_root());
+    // Build a backend per scope first: a scope whose manager cannot be acquired is reported as an
+    // unresolved scope rather than aborting the sweep of the others.
+    let backends: Vec<(ServiceScope, io::Result<SystemServiceBackend>)> = scopes
+        .into_iter()
+        .map(|s| (s, SystemServiceBackend::new(s)))
+        .collect();
+    // The FIRST scope is the one the operator named (or `auto` resolved to) and is removed
+    // unconditionally; any further scope is only being swept for a stale registration.
+    let removals = backends
+        .iter()
+        .enumerate()
+        .map(|(i, (scope, backend))| {
+            let mode = if i == 0 {
+                RemovalMode::Requested
+            } else {
+                RemovalMode::Swept
+            };
+            match backend {
+                Ok(b) => remove_registration(b, *scope, mode),
+                Err(e) => ScopeRemoval {
+                    scope: *scope,
+                    found: false,
+                    removed: false,
+                    // A scope whose manager cannot even be acquired is UNKNOWN, not clean.
+                    indeterminate: true,
+                    error: Some(e.to_string()),
+                },
+            }
+        })
+        .collect();
+    uninstall_outcome(removals)
 }
 
 /// Whether an OS service-start error actually means "the service is ALREADY running".
@@ -887,16 +1350,17 @@ fn start_outcome(result: io::Result<()>) -> io::Result<Outcome> {
     }
 }
 
-/// Start the installed service. Idempotent: an already-running service is reported as success
-/// (#772), never a hard error.
-pub fn start() -> io::Result<Outcome> {
-    let backend = SystemServiceBackend::new()?;
+/// Start the installed service at `scope` (#526 — the same resolution `install` used, so the
+/// default `auto` starts what a default `install` registered). Idempotent: an already-running
+/// service is reported as success (#772), never a hard error.
+pub fn start(scope: ScopeChoice) -> io::Result<Outcome> {
+    let backend = SystemServiceBackend::new(host_scope(scope))?;
     start_outcome(backend.start())
 }
 
-/// Stop the running service.
-pub fn stop() -> io::Result<Outcome> {
-    let backend = SystemServiceBackend::new()?;
+/// Stop the running service at `scope` (#526).
+pub fn stop(scope: ScopeChoice) -> io::Result<Outcome> {
+    let backend = SystemServiceBackend::new(host_scope(scope))?;
     backend.stop()?;
     Ok(Outcome::new(
         format!("dig-node: stop requested for \"{SERVICE_LABEL}\""),
@@ -985,6 +1449,7 @@ fn is_2xx_status_line(response_head: &str) -> bool {
 mod tests {
     use super::*;
     use std::cell::RefCell;
+    use std::rc::Rc;
 
     // -- identity + pure builders -----------------------------------------------------------
 
@@ -1216,7 +1681,7 @@ SERVICE_NAME: net.dignetwork.dig-node
         let dir = tempfile::tempdir().unwrap();
         let program = dir.path().join("dig-node");
         assert!(
-            ensure_service_target_is_safe(&program, /* user_level */ true, false).is_ok(),
+            ensure_service_target_is_safe(&program, ServiceScope::User, false).is_ok(),
             "a user-level install from a user-owned dir must be allowed"
         );
     }
@@ -1229,7 +1694,7 @@ SERVICE_NAME: net.dignetwork.dig-node
         // condition — so registration MUST fail closed with PERMISSION_DENIED.
         let dir = tempfile::tempdir().unwrap();
         let program = dir.path().join("dig-node");
-        let err = ensure_service_target_is_safe(&program, /* user_level */ false, false)
+        let err = ensure_service_target_is_safe(&program, ServiceScope::System, false)
             .expect_err("a system-level install from a user-writable dir must be refused");
         assert_eq!(err.kind(), io::ErrorKind::PermissionDenied);
         // The message must name the LPE class + the offending path so an operator can act.
@@ -1249,7 +1714,7 @@ SERVICE_NAME: net.dignetwork.dig-node
         let dir = tempfile::tempdir().unwrap();
         let program = dir.path().join("dig-node");
         assert!(
-            ensure_service_target_is_safe(&program, /* user_level */ false, true).is_ok(),
+            ensure_service_target_is_safe(&program, ServiceScope::System, true).is_ok(),
             "the explicit insecure override must permit the otherwise-refused system-level install"
         );
     }
@@ -1306,9 +1771,13 @@ SERVICE_NAME: net.dignetwork.dig-node
     fn system_backend_builds_and_probes_an_unregistered_service_cleanly() {
         // Building the native backend + probing for a service that is not registered must never
         // panic and must report a boolean (false in a clean env). No service is created.
-        if let Ok(backend) = SystemServiceBackend::new() {
+        if let Ok(backend) = SystemServiceBackend::new(ServiceScope::System) {
             let _installed = backend.is_installed().expect("probe never hard-errors");
-            let _user_level = backend.user_level();
+            assert_eq!(
+                backend.scope(),
+                ServiceScope::System,
+                "the backend keeps its scope"
+            );
             assert_eq!(backend.display_name_verified(), None, "no create() ran yet");
         }
     }
@@ -1320,20 +1789,32 @@ SERVICE_NAME: net.dignetwork.dig-node
     /// the Windows `CreateService 1073` bug: it FAILS if the service still appears installed —
     /// so a test that recreates onto a live service fails exactly as Windows would, and the
     /// clean-reinstall (which deletes first) is proven to defeat it.
+    ///
+    /// Every call is appended to a log that may be SHARED with a second mock (see
+    /// [`MockBackend::tagged`]), each mock tagging its own entries — that shared, tagged log is what
+    /// makes the RELATIVE order of two different-scope backends assertable (the #526 cross-scope
+    /// migration must deregister the other scope BEFORE creating at the requested one).
     struct MockBackend {
         installed: RefCell<bool>,
-        calls: RefCell<Vec<String>>,
+        /// Prefix stamped onto this mock's log entries (`""` when it owns the log alone).
+        tag: &'static str,
+        log: Rc<RefCell<Vec<String>>>,
         created_plan: RefCell<Option<InstallPlan>>,
         fail_stop: bool,
+        fail_delete: bool,
+        fail_probe: bool,
     }
 
     impl MockBackend {
         fn new(installed: bool) -> Self {
             Self {
                 installed: RefCell::new(installed),
-                calls: RefCell::new(Vec::new()),
+                tag: "",
+                log: Rc::new(RefCell::new(Vec::new())),
                 created_plan: RefCell::new(None),
                 fail_stop: false,
+                fail_delete: false,
+                fail_probe: false,
             }
         }
         fn with_failing_stop(installed: bool) -> Self {
@@ -1342,18 +1823,45 @@ SERVICE_NAME: net.dignetwork.dig-node
                 ..Self::new(installed)
             }
         }
+        /// A mock that writes into a SHARED log under `tag`, so two mocks' calls interleave in one
+        /// ordered transcript.
+        fn tagged(tag: &'static str, log: &Rc<RefCell<Vec<String>>>, installed: bool) -> Self {
+            Self {
+                tag,
+                log: Rc::clone(log),
+                ..Self::new(installed)
+            }
+        }
+        /// A mock whose `delete` fails — a registration that is FOUND but cannot be removed (the
+        /// case that must never be reported as a silent success).
+        fn failing_delete(mut self) -> Self {
+            self.fail_delete = true;
+            self
+        }
+        /// A mock whose existence probe errors — an indeterminate scope, which must be REPORTED,
+        /// never silently treated as "nothing there".
+        fn failing_probe(mut self) -> Self {
+            self.fail_probe = true;
+            self
+        }
+        fn record(&self, what: &str) {
+            self.log.borrow_mut().push(format!("{}{what}", self.tag));
+        }
         fn calls(&self) -> Vec<String> {
-            self.calls.borrow().clone()
+            self.log.borrow().clone()
         }
     }
 
     impl ServiceBackend for MockBackend {
         fn is_installed(&self) -> io::Result<bool> {
-            self.calls.borrow_mut().push("is_installed".into());
+            self.record("is_installed");
+            if self.fail_probe {
+                return Err(io::Error::other("probe failed"));
+            }
             Ok(*self.installed.borrow())
         }
         fn stop(&self) -> io::Result<()> {
-            self.calls.borrow_mut().push("stop".into());
+            self.record("stop");
             if self.fail_stop {
                 Err(io::Error::other("not running"))
             } else {
@@ -1361,12 +1869,18 @@ SERVICE_NAME: net.dignetwork.dig-node
             }
         }
         fn delete(&self) -> io::Result<()> {
-            self.calls.borrow_mut().push("delete".into());
+            self.record("delete");
+            if self.fail_delete {
+                return Err(io::Error::new(
+                    io::ErrorKind::PermissionDenied,
+                    "Failed to connect to bus: Operation not permitted",
+                ));
+            }
             *self.installed.borrow_mut() = false; // synchronous removal
             Ok(())
         }
         fn create(&self, plan: &InstallPlan) -> io::Result<()> {
-            self.calls.borrow_mut().push("create".into());
+            self.record("create");
             if *self.installed.borrow() {
                 // Reproduce Windows error 1073: cannot create an already-existing service.
                 return Err(io::Error::new(
@@ -1515,4 +2029,345 @@ An instance of the service is already running.",
         assert_eq!(err.kind(), io::ErrorKind::AlreadyExists);
         assert!(err.to_string().contains("1073"));
     }
+
+    // -- #526 scope resolution: the decision, host-independently ------------------------------
+
+    /// The PRIMARY evidence for #526. Every input of [`resolve_scope`] is a parameter, so the
+    /// COMPLETE decision table — all 3 choices × 2 OS capabilities × 2 privilege levels — is
+    /// asserted on any host, unprivileged. Deliberately NOT `#[cfg(unix)]`-gated: a cfg-gated
+    /// scope test is unfalsifiable on a Windows dev box, where an inverted decision would stay
+    /// green.
+    #[test]
+    fn resolve_scope_decision_table_is_exhaustive_across_choice_os_and_privilege() {
+        use ScopeChoice::{Auto, System as ChooseSystem, User as ChooseUser};
+        use ServiceScope::{System, User};
+
+        // (choice, os_supports_user, is_root) => expected scope
+        let table = [
+            // Auto: the privilege level decides — root gets a reboot-surviving system unit, a
+            // desktop user keeps today's no-elevation user unit.
+            (Auto, true, true, System),
+            (Auto, true, false, User),
+            // An explicit choice is AUTHORITATIVE: never silently overridden by privilege.
+            (ChooseSystem, true, true, System),
+            (ChooseSystem, true, false, System),
+            (ChooseUser, true, true, User),
+            (ChooseUser, true, false, User),
+            // An OS with no user domain (Windows SCM) has exactly ONE scope, so every input
+            // collapses to System — including an explicit `--scope user`, which cannot be honoured.
+            (Auto, false, true, System),
+            (Auto, false, false, System),
+            (ChooseSystem, false, true, System),
+            (ChooseSystem, false, false, System),
+            (ChooseUser, false, true, System),
+            (ChooseUser, false, false, System),
+        ];
+        assert_eq!(table.len(), 12, "the table must cover 3 × 2 × 2 inputs");
+
+        for (choice, os_supports_user, is_root, expected) in table {
+            assert_eq!(
+                resolve_scope(choice, os_supports_user, is_root),
+                expected,
+                "resolve_scope({choice:?}, os_supports_user={os_supports_user}, \
+                 is_root={is_root}) must be {expected:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn scope_choice_default_is_auto_so_an_older_installer_passing_no_flag_is_unchanged() {
+        // BC: dig-installer releases predating `--scope` pass no flag at all. The default MUST be
+        // `auto`, and `auto` unprivileged on a user-capable OS MUST stay the pre-#526 user scope.
+        assert_eq!(ScopeChoice::default(), ScopeChoice::Auto);
+        assert_eq!(
+            resolve_scope(ScopeChoice::default(), true, false),
+            ServiceScope::User
+        );
+    }
+
+    #[test]
+    fn service_scope_renders_and_inverts() {
+        assert_eq!(ServiceScope::User.as_str(), "user");
+        assert_eq!(ServiceScope::System.as_str(), "system");
+        assert!(ServiceScope::User.is_user());
+        assert!(!ServiceScope::System.is_user());
+        assert_eq!(ServiceScope::User.other(), ServiceScope::System);
+        assert_eq!(ServiceScope::System.other(), ServiceScope::User);
+    }
+
+    #[test]
+    fn a_system_scope_registration_requires_root_on_a_user_capable_os() {
+        // systemd/launchd system units live in root-owned dirs; asking for one unprivileged must
+        // fail with an ACTIONABLE message up front, never a cryptic failure deep inside
+        // systemctl — and never a silent downgrade to user scope (which would not survive a
+        // reboot without a login session, the whole #526 defect).
+        let err = ensure_privilege_for_scope(ServiceScope::System, true, false)
+            .expect_err("system scope unprivileged must be refused");
+        assert_eq!(err.kind(), io::ErrorKind::PermissionDenied);
+        let msg = err.to_string();
+        assert!(msg.contains("system"), "names the scope: {msg}");
+        assert!(msg.contains("root"), "names the missing privilege: {msg}");
+
+        // The cases that must NOT be refused: root asking for system, anyone asking for user,
+        // and Windows (no user domain — elevation is checked by its own SCM gate).
+        assert!(ensure_privilege_for_scope(ServiceScope::System, true, true).is_ok());
+        assert!(ensure_privilege_for_scope(ServiceScope::User, true, false).is_ok());
+        assert!(ensure_privilege_for_scope(ServiceScope::System, false, false).is_ok());
+    }
+
+    // -- #526 cross-scope migration: a PLACEMENT fix, proven by ORDER ------------------------
+
+    /// The positional-shadowing defect: a host upgrading from a prior USER-level install to a
+    /// system-level one would end up with TWO registrations, both binding the node port, and the
+    /// stale one can win. Asserting only "the install succeeded" would pass with the deregistration
+    /// at any layer — or missing. So both scopes are recorded into ONE shared transcript and the
+    /// assertion is that the other-scope DELETE precedes the target-scope CREATE.
+    #[test]
+    fn install_deregisters_the_other_scope_before_creating_at_the_requested_one() {
+        let log = Rc::new(RefCell::new(Vec::new()));
+        let target = MockBackend::tagged("system:", &log, false);
+        let stale_user = MockBackend::tagged("user:", &log, true);
+
+        let (report, migration) =
+            install_at_scope(&target, Some((&stale_user, ServiceScope::User)), &plan())
+                .expect("install proceeds after migrating the other scope");
+
+        assert!(report.created, "the requested scope is registered");
+        let migration = migration.expect("a migration was attempted");
+        assert_eq!(migration.scope, ServiceScope::User);
+        assert!(migration.found && migration.removed, "{migration:?}");
+        assert!(migration.error.is_none());
+
+        let calls = target.calls();
+        let user_delete = calls
+            .iter()
+            .position(|c| c == "user:delete")
+            .expect("the stale user-scope registration is deleted");
+        let system_create = calls
+            .iter()
+            .position(|c| c == "system:create")
+            .expect("the requested system-scope registration is created");
+        assert!(
+            user_delete < system_create,
+            "the other scope must be deregistered BEFORE creating at the requested scope, \
+             or both registrations coexist and the stale one can win: {calls:?}"
+        );
+        // The stale unit is stopped before it is deleted, so nothing keeps holding the port.
+        let user_stop = calls.iter().position(|c| c == "user:stop").unwrap();
+        assert!(user_stop < user_delete, "{calls:?}");
+    }
+
+    #[test]
+    fn install_touches_nothing_at_the_other_scope_when_it_holds_no_registration() {
+        // The common fresh install: probing the other scope is READ-ONLY, so an absent
+        // registration must not produce a stop/delete (which would surface spurious errors on
+        // every desktop install).
+        let log = Rc::new(RefCell::new(Vec::new()));
+        let target = MockBackend::tagged("system:", &log, false);
+        let other = MockBackend::tagged("user:", &log, false);
+
+        let (report, migration) =
+            install_at_scope(&target, Some((&other, ServiceScope::User)), &plan()).unwrap();
+
+        assert!(report.created);
+        let migration = migration.expect("a migration was attempted");
+        assert!(!migration.found && !migration.removed);
+        let calls = target.calls();
+        assert!(
+            !calls.iter().any(|c| c == "user:delete" || c == "user:stop"),
+            "no write at an unregistered scope: {calls:?}"
+        );
+    }
+
+    #[test]
+    fn install_still_succeeds_when_the_other_scope_cannot_be_deregistered() {
+        // Best-effort: an unprivileged user cannot delete a system unit. That must be REPORTED,
+        // not fatal — the requested (user-scope) registration still goes in.
+        let log = Rc::new(RefCell::new(Vec::new()));
+        let target = MockBackend::tagged("user:", &log, false);
+        let other = MockBackend::tagged("system:", &log, true).failing_delete();
+
+        let (report, migration) =
+            install_at_scope(&target, Some((&other, ServiceScope::System)), &plan())
+                .expect("a failed other-scope removal must not fail the install");
+
+        assert!(report.created);
+        let migration = migration.expect("a migration was attempted");
+        assert!(migration.found && !migration.removed);
+        assert!(
+            migration.error.is_some(),
+            "an un-removable stale registration is reported, never silently dropped"
+        );
+    }
+
+    #[test]
+    fn install_with_no_other_scope_reports_no_migration() {
+        // Windows: SCM has exactly one scope, so there is no other scope to migrate FROM.
+        let target = MockBackend::new(false);
+        let (report, migration) =
+            install_at_scope(&target, None::<(&MockBackend, ServiceScope)>, &plan()).unwrap();
+        assert!(report.created);
+        assert!(migration.is_none());
+    }
+
+    // -- #526 uninstall: remove at the requested scope, both under `auto` as root -------------
+
+    #[test]
+    fn uninstall_scopes_cover_both_scopes_under_auto_and_only_the_named_one_otherwise() {
+        use ScopeChoice::{Auto, System as ChooseSystem, User as ChooseUser};
+        use ServiceScope::{System, User};
+
+        // `auto` sweeps BOTH scopes so an uninstall can never leave a registration behind
+        // (the #1863 defect class), requested scope first.
+        assert_eq!(uninstall_scopes(Auto, true, true), vec![System, User]);
+        assert_eq!(uninstall_scopes(Auto, true, false), vec![User, System]);
+        // An explicit choice removes exactly what was named.
+        assert_eq!(uninstall_scopes(ChooseSystem, true, false), vec![System]);
+        assert_eq!(uninstall_scopes(ChooseUser, true, true), vec![User]);
+        // An OS with one scope has one thing to remove, whatever was asked for.
+        assert_eq!(uninstall_scopes(Auto, false, false), vec![System]);
+        assert_eq!(uninstall_scopes(ChooseUser, false, false), vec![System]);
+    }
+
+    #[test]
+    fn uninstall_removes_every_scope_that_holds_a_registration() {
+        let log = Rc::new(RefCell::new(Vec::new()));
+        let system = MockBackend::tagged("system:", &log, true);
+        let user = MockBackend::tagged("user:", &log, true);
+        let removals = remove_registrations(&[
+            (&system, ServiceScope::System, RemovalMode::Requested),
+            (&user, ServiceScope::User, RemovalMode::Swept),
+        ]);
+
+        assert_eq!(removals.len(), 2);
+        assert!(
+            removals.iter().all(|r| r.found && r.removed),
+            "{removals:?}"
+        );
+        let outcome = uninstall_outcome(removals).expect("removing both scopes is a success");
+        assert_eq!(outcome.result["registered"], json!(false));
+        assert_eq!(outcome.result["removed_scopes"], json!(["system", "user"]));
+    }
+
+    #[test]
+    fn uninstall_fails_loudly_when_a_found_registration_could_not_be_removed() {
+        // The #1863 defect class: a leftover registration reported as success. One scope removes
+        // cleanly and the OTHER fails — an outcome-only assertion ("it errored") would pass even
+        // if the successful scope had never been attempted, so both halves are asserted.
+        let log = Rc::new(RefCell::new(Vec::new()));
+        let user = MockBackend::tagged("user:", &log, true);
+        let system = MockBackend::tagged("system:", &log, true).failing_delete();
+        let removals = remove_registrations(&[
+            (&user, ServiceScope::User, RemovalMode::Requested),
+            (&system, ServiceScope::System, RemovalMode::Swept),
+        ]);
+
+        assert!(removals[0].removed, "the removable scope IS removed");
+        assert!(removals[1].found && !removals[1].removed);
+        let err = uninstall_outcome(removals)
+            .expect_err("a registration left behind must not be reported as success");
+        let msg = err.to_string();
+        assert!(msg.contains("system"), "names the scope left behind: {msg}");
+        assert!(msg.contains("user"), "reports what WAS removed too: {msg}");
+    }
+
+    #[test]
+    fn uninstall_reports_an_indeterminate_scope_rather_than_assuming_it_is_clean() {
+        // A probe that errors is NOT evidence of absence — fail closed and say so.
+        let backend = MockBackend::new(true).failing_probe().failing_delete();
+        let removals =
+            remove_registrations(&[(&backend, ServiceScope::System, RemovalMode::Requested)]);
+        assert!(!removals[0].found, "the probe reported nothing");
+        assert!(!removals[0].removed, "the removal did not succeed either");
+        assert!(
+            removals[0].indeterminate,
+            "absence was never established, so the scope is UNKNOWN: {removals:?}"
+        );
+        let err = uninstall_outcome(removals)
+            .expect_err("an unresolved scope must not be reported as a clean uninstall");
+        assert_eq!(err.kind(), io::ErrorKind::PermissionDenied);
+    }
+
+    #[test]
+    fn uninstall_errors_when_no_scope_holds_a_registration() {
+        let backend = MockBackend::new(false).failing_delete();
+        let removals =
+            remove_registrations(&[(&backend, ServiceScope::User, RemovalMode::Requested)]);
+        let err = uninstall_outcome(removals).expect_err("nothing to uninstall is an error");
+        assert_eq!(err.kind(), io::ErrorKind::NotFound);
+    }
+
+    /// Regression test for the real macOS `service-smoke` failure this change first caused: the
+    /// runner had a user-scope agent registered, but `launchctl print gui/<uid>/<label>` cannot see
+    /// it from a session with no GUI domain, so a probe-GATED uninstall reported
+    /// `no service registration … was found` and exited 6 on a service that WAS registered.
+    ///
+    /// The scope the operator NAMED must therefore be deregistered without trusting the probe — the
+    /// OS removal call is the authority. The mock is built with the lying combination (`installed:
+    /// false` for the probe, but a `delete` that succeeds), which is exactly what a false-negative
+    /// launchd probe looks like from here.
+    #[test]
+    fn a_requested_scope_is_removed_even_when_the_probe_cannot_see_it() {
+        let backend = MockBackend::new(false); // probe says "nothing here" — and is wrong
+        let removal = remove_registration(&backend, ServiceScope::User, RemovalMode::Requested);
+
+        assert!(
+            !removal.found,
+            "the probe false-negatived, as launchd's does"
+        );
+        assert!(
+            removal.removed,
+            "the deregistration must be attempted anyway, and it succeeded: {removal:?}"
+        );
+        assert!(!removal.indeterminate);
+        assert!(
+            backend.calls().contains(&"delete".to_string()),
+            "delete must be called despite the probe: {:?}",
+            backend.calls()
+        );
+        let outcome = uninstall_outcome(vec![removal]).expect("a proven removal is a success");
+        assert_eq!(outcome.result["removed_scopes"], json!(["user"]));
+    }
+
+    #[test]
+    fn a_swept_scope_is_never_written_to_on_a_probe_that_sees_nothing() {
+        // The counterpart: the requested/swept distinction is what keeps the unconditional removal
+        // above from also disturbing a scope nobody asked about. Same mock, opposite mode.
+        let backend = MockBackend::new(false);
+        let removal = remove_registration(&backend, ServiceScope::System, RemovalMode::Swept);
+
+        assert!(!removal.removed && !removal.indeterminate);
+        assert_eq!(
+            backend.calls(),
+            vec!["is_installed"],
+            "a swept scope is probed and then left alone"
+        );
+    }
+
+    // -- #526: the §565 gate now fires on unix system scope, so its refusal must be actionable
+
+    #[test]
+    fn a_refused_system_target_names_the_offending_directory_level() {
+        // The gate walks EVERY ancestor, so the leaf is often fine while a parent is not. An
+        // operator cannot act on "somewhere in this path is user-writable" — the refusal must name
+        // the level that failed. A nested tempdir gives a leaf whose PARENT chain is user-owned.
+        let dir = tempfile::tempdir().unwrap();
+        let nested = dir.path().join("bin");
+        std::fs::create_dir(&nested).unwrap();
+        let program = nested.join("dig-node");
+
+        let err = ensure_service_target_is_safe(&program, ServiceScope::System, false)
+            .expect_err("a system-level install from a user-writable chain must be refused");
+        let msg = err.to_string();
+        let offending = crate::security::first_unprivileged_ancestor(&nested)
+            .expect("the temp chain has an unprivileged level");
+        // A bare `contains(offending)` would be VACUOUS: every ancestor is a string PREFIX of the
+        // program path the message already prints, so the assertion would hold even if the level
+        // were never named. Assert the exact naming PHRASE instead.
+        let named = format!("the path level \"{}\"", offending.display());
+        assert!(
+            msg.contains(&named),
+            "the refusal must name the offending level as `{named}`: {msg}"
+        );
+    }
 }
diff --git a/crates/dig-node-service/tests/cli.rs b/crates/dig-node-service/tests/cli.rs
index 9ffa438..93a9f73 100644
--- a/crates/dig-node-service/tests/cli.rs
+++ b/crates/dig-node-service/tests/cli.rs
@@ -91,3 +91,53 @@ fn version_flag_prints_version() {
     let stdout = String::from_utf8_lossy(&out.stdout);
     assert!(stdout.contains(env!("CARGO_PKG_VERSION")), "got: {stdout}");
 }
+
+/// #526: `--scope <auto|system|user>` must be present on EVERY service verb, with `auto` as the
+/// documented default. Asserted against the BUILT binary's own help — the only place that proves
+/// the flag is actually wired into the CLI (a lib-level scope test cannot see a verb that forgot to
+/// accept it). Reads help rather than running the verbs, so nothing is registered on the host.
+#[test]
+fn every_service_verb_accepts_the_scope_flag_defaulting_to_auto() {
+    for verb in ["install", "uninstall", "start", "stop"] {
+        let out = bin()
+            .args([verb, "--help"])
+            .output()
+            .unwrap_or_else(|e| panic!("run dig-node {verb} --help: {e}"));
+        assert!(out.status.success(), "`{verb} --help` must succeed");
+        let help = String::from_utf8_lossy(&out.stdout);
+        assert!(
+            help.contains("--scope"),
+            "`{verb}` must accept --scope: {help}"
+        );
+        assert!(
+            help.contains("[default: auto]"),
+            "`{verb} --scope` must default to auto so a caller passing no flag is unchanged: {help}"
+        );
+        for value in ["auto", "system", "user"] {
+            assert!(
+                help.contains(value),
+                "`{verb} --scope` must offer `{value}`: {help}"
+            );
+        }
+    }
+}
+
+/// A scope the CLI does not define must be a USAGE error (exit 2), never silently coerced to a
+/// default — a typo'd `--scope sytem` must not quietly install at user scope.
+#[test]
+fn an_unknown_scope_value_is_a_usage_error() {
+    let out = bin()
+        .args(["install", "--scope", "sytem"])
+        .output()
+        .expect("run dig-node install --scope sytem");
+    assert_eq!(
+        out.status.code(),
+        Some(2),
+        "an invalid --scope value must be a clap usage error, not an install"
+    );
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(
+        stderr.contains("sytem"),
+        "the error names the bad value: {stderr}"
+    );
+}