tests/test_proxy.py

@@ -4,8 +4,8 @@ The whole security property is "a caller cannot forge their own address", and it
 on counting in from the RIGHT of the header rather than the left. These are the cases
 that tell the two apart — pure functions, no request context, no database.
 """
-from thoughtsync.config import Config
 from thoughtsync.proxy import forwarded_for, trusted_entry
+from thoughtsync.settings import live
 
 PEER = "10.0.0.1"  # the socket address: our own proxy, or the caller when unproxied
 
@@ -13,7 +13,12 @@ PEER = "10.0.0.1"  # the socket address: our own proxy, or the caller when unpro
 def test_default_is_one_hop():
     # One reverse proxy terminating TLS — this deployment, and the only shape that is
     # safe to assume. A wrong default here is a silent security bug, not a preference.
-    assert Config.trusted_proxy_hops() == 1
+    #
+    # Read through live() rather than the registry: live() is what proxy.py actually
+    # calls, and it is seeded from the defaults at import time so the value is right
+    # before the first database read. A boot that never reached the DB must still
+    # count one hop, not zero.
+    assert live("trusted_proxy_hops") == 1
 
 
 def test_no_proxy_ignores_the_header_entirely():