Cite hq ADR 0170, not 0169: the firewall seat's record was renumbered after a collision on hq main

internal/declaration/declaration.go

@@ -941,7 +941,7 @@ type Container struct {
 	Dns []string `json:"dns,omitempty"`
 
 	// Capabilities are the Linux capabilities this container is granted beyond the runtime's
-	// default set, by name (novox/hq ADR 0169): a holder's runtime that changes the machine's packet
+	// default set, by name (novox/hq ADR 0170): a holder's runtime that changes the machine's packet
 	// filter asks for NET_ADMIN. Exactly these, named in the spec so a change recreates the
 	// container; a privileged container stays undeclarable.
 	Capabilities []string `json:"capabilities,omitempty"`

internal/declaration/declaration_test.go

@@ -505,7 +505,7 @@ func TestKeptNetworksAndLeftOutModulesAreReadStrictly(t *testing.T) {
 	}
 }
 
-// A container may ask for a capability by name, and nothing else (novox/hq ADR 0169).
+// A container may ask for a capability by name, and nothing else (novox/hq ADR 0170).
 func TestACapabilityIsNamedOrRefused(t *testing.T) {
 	image := "postgres@sha256:" + strings.Repeat("a", 64)
 	d, err := Parse([]byte(`{"declaration":1,"resources":[