!macro NSIS_HOOK_PREUNINSTALL
  ${If} $UpdateMode = 1
    DetailPrint "ProxyWarden: verifying managed component state before update"
    ClearErrors
    ExecWait '"$INSTDIR\${MAINBINARYNAME}.exe" --nsis-verify-upgrade' $0
  ${Else}
    ; The generated Tauri guard normally runs after PREUNINSTALL.  Repeat it
    ; here so no service/filesystem mutation starts while the app is alive.
    !insertmacro CheckIfAppIsRunning "${MAINBINARYNAME}.exe" "${PRODUCTNAME}"
    DetailPrint "ProxyWarden: uninstalling verified managed components"
    ClearErrors
    ExecWait '"$INSTDIR\${MAINBINARYNAME}.exe" --nsis-uninstall-managed' $0
  ${EndIf}

  IfErrors 0 +3
    DetailPrint "ProxyWarden native lifecycle helper could not be launched"
    Abort "ProxyWarden could not start the native lifecycle verifier."

  ${If} $0 = 3010
    SetRebootFlag true
    ; The helper keeps its exact durable reboot fact until this parent has
    ; observed 3010. Delete only that fixed published marker, then fail closed
    ; if acknowledgement cannot be persisted before uninstall continues.
    ClearErrors
    Delete "$INSTDIR\.proxywarden-nsis-reboot-required.json"
    IfErrors 0 +3
      DetailPrint "ProxyWarden reboot acknowledgement could not be persisted"
      Abort "ProxyWarden could not safely acknowledge the required reboot."
    StrCpy $0 0
  ${EndIf}
  ${If} $0 != 0
    DetailPrint "ProxyWarden native lifecycle check failed with exit code $0"
    Abort "ProxyWarden could not safely verify or remove managed components."
  ${EndIf}
!macroend