Until Nix becomes more popular, I've been thinking about ways to build an audit tool that would work with CM tools to handle this case:

http://stevenjewel.com/2014/03/puppet-undo-and-puppet-audit/