ipa-ca-install detects whether a CA is configured based on the existence of "/var/lib/pki/pki-tomcat/conf/ca/CS.cfg via cainstance.is_ca_installed_locally()

ipa-csreplica-manage determines it based on the services in cn=masters.

We've seen in the past where a CA install fails and doesn't mark the CA as installed so pkidestroy doesn't get called. This may be another corner case of it but we've seen two reports of it on freeipa-users when users try to install a 4.x master with a CA against a 3.0 master. I don't know if the versions are significant.