1. OCX on H1 acts on R1 as stone's user (lab-1). OCX on H2 does nothing with R1 because its clone's server-code is not "aaaa…a" nor does the run's `clone.user` match its repository.

2. OCX on H3 does not act on R1 because it has a different server-code than the one in R1. If H3's clone's user were lab-1, it still wouldn't act because the run's `clone.user` doesn’t match H3's repository.

3. No, mallory’s `ended` does not count because OCX on H1 checks the sender of R1 and finds that only stone or a user holding admin/setup can send an `ended`.

4. Yes, stone’s `started` counts because it holds setup, matches R1’s `clone`, and is sent by someone who can write to the server.

5. OCX on H1 does not act on R3, but mallory's `started` does count as she holds check-in and the server allows runs with only check-in capability.

6. OCX on H1 acts on R4 because it matches the run’s server-code and user. What it writes counts because of this match and sender verification.

7. No, a run sent by stone cannot name `"process": {"user": "lab-1"}` and be run because that would violate rule 4 in OCX's behavior regarding `clone.user` being the process’s user.

8. OCX on H2 does nothing with R5 because its clone's server-code is not "bbbb…b". If it were, it wouldn’t act as the run’s `clone.user` doesn’t match H2’s repository.

9. OCX on H1 can do setup because that’s the highest capability stone holds on the server.

10. `$process_clone$$` is a new directory created by the clone step, and it is not the same repository R1's key `clone` names; instead, it references the newly made process clone.

11. OCX on H1 acts on the new run as lab-1 because it matches R1’s server-code. The sender must name the new server-code in their run to have OCX act.

12. A user with `R` may send a `stop`, and it holds only `ocx` and `kind`.