Refuse token issue --adopted for a converged node and point to adopt, rather than flip it quietly (hq ADR 0100)

cmd/mesh-controller/nodes.go

@@ -279,13 +279,20 @@ func issueFor(ctx context.Context, inv *inventory.Inventory, existing, fresh str
 		}
 		name = node.Name
 	}
-	// Saying adopted makes the node adopted. Not saying it leaves the node as it is: re-issuing a
-	// token for an adopted node does not converge it — converging is its own act, previewed
-	// (novox/hq ADR 0100).
-	if adopted {
-		if err := inv.SetAdopted(ctx, name, true); err != nil {
+	// Not saying adopted leaves the node as it is: re-issuing a token for an adopted node does not
+	// converge it — converging is its own act, previewed (novox/hq ADR 0100). And saying it for a
+	// node already converged is refused rather than done quietly: returning a node to adopted is
+	// its own act too, which unloads the mesh's filter and enables the found firewall again.
+	if adopted && fresh == "" {
+		node, err := inv.NodeByName(ctx, name)
+		if err != nil {
 			return inventory.Issued{}, err
 		}
+		if !node.Adopted {
+			return inventory.Issued{}, fmt.Errorf("%s is converged, and a token does not change "+
+				"that: run `adopt %s` to return it to adopted, then issue the token without "+
+				"--adopted", name, name)
+		}
 	}
 
 	return inv.IssueToken(ctx, name, validFor)