A package may be declared absent, and an uninstalled front end is retired for good (hq ADR 0175)

absent: true on a package has the host remove it through the machine's own
package manager when it is installed and leave alone a machine that never had
it; read back either way. Undeclaring a package still removes nothing. A
found firewall whose command is gone is recorded as removed, said once, and
asked nothing of.

internal/firewall/filters.go

@@ -319,8 +319,17 @@ func Active(ctx context.Context, run Runner) bool {
 	return err == nil && statusActive(out)
 }
 
+// Installed says whether ufw is on this machine at all: a command that is not there is a front end
+// that was uninstalled (novox/hq ADR 0175), not one that is silent.
+func Installed(ctx context.Context, run Runner) bool {
+	_, err := run(ctx, "ufw", "status")
+	return !missing(err)
+}
+
 // Retirements of a found firewall, as the host records them.
 const (
 	RetiredByMesh  = "mesh"
 	RetiredFoundSo = "found-inactive"
+	// RetiredRemoved is a front end uninstalled by the module that replaced it (ADR 0175).
+	RetiredRemoved = "removed"
 )