The proxy-hops test still read the value from Config

09b5f87 moved trusted_proxy_hops out of the environment and into the
settings registry, but tests/test_proxy.py kept asserting against
Config.trusted_proxy_hops() — which no longer exists. The unit lane has
been red since that commit.

Assert through live() instead. That is what proxy.py actually calls, and
it is seeded from the defaults at import time, so the test covers the
case that matters: a boot that has not reached the database yet still
counts one hop rather than zero.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_proxy.py

@@ -4,8 +4,8 @@ The whole security property is "a caller cannot forge their own address", and it
 on counting in from the RIGHT of the header rather than the left. These are the cases
 that tell the two apart — pure functions, no request context, no database.
 """
-from thoughtsync.config import Config
 from thoughtsync.proxy import forwarded_for, trusted_entry
+from thoughtsync.settings import live
 
 PEER = "10.0.0.1"  # the socket address: our own proxy, or the caller when unproxied
 
@@ -13,7 +13,12 @@ PEER = "10.0.0.1"  # the socket address: our own proxy, or the caller when unpro
 def test_default_is_one_hop():
     # One reverse proxy terminating TLS — this deployment, and the only shape that is
     # safe to assume. A wrong default here is a silent security bug, not a preference.
-    assert Config.trusted_proxy_hops() == 1
+    #
+    # Read through live() rather than the registry: live() is what proxy.py actually
+    # calls, and it is seeded from the defaults at import time so the value is right
+    # before the first database read. A boot that never reached the DB must still
+    # count one hop, not zero.
+    assert live("trusted_proxy_hops") == 1
 
 
 def test_no_proxy_ignores_the_header_entirely():