1. OCX on H1 acts on R1 because the run's `clone.server_code` and `clone.user` match H1's identity. OCX on H2 does nothing because the run's `clone.server_code` does not match its own server-code.

2. OCX on H3 does not act on R1 because the run's `clone.user` (lab-1) does not match H3's clone's user (lab-9). If H3's clone's user were lab-1, OCX on H3 would act on R1 because both the server-code and user would match.

3. No, it does not count. A report only counts if the sender is exactly the run's `clone.user`, and mallory is not `lab-1`.

4. No, it does not count. A report sent by any user other than the run's `clone.user` (lab-1) does not count, even if that user holds admin or setup capabilities.

5. OCX on H1 does not act on R3 because the run's `clone.user` (mallory) does not match H1's clone's user (lab-1). Mallory's `started` report does not count because no OCX instance acted on the run.

6. OCX on H1 refuses the run because the sender (mallory) does not hold admin, setup, or `R` capabilities on the server. This refusal counts because OCX writes it as the clone's user (`lab-1`).

7. No, it would be refused. Under refusal 4, a run is refused if the `process.user` is any clone's user, and `lab-1` is the user for clones H1 and H2.

8. OCX on H2 refuses the run. Under refusal 5, a run is refused if the `process.user` (builder) already works for another clone, which it does for H1 (server-code `aaaa...a`) due to run R1.

9. The capabilities of the clone's user on the server set the limit. This user was chosen by the clone's owner using `poll --login`.

10. `$$process_clone$$` is a new repository created by `fossil clone` from the server's repository during the workspace step. It is not the repository named in R1's `clone` key, as the process's clone is never the run's clone.

11. OCX on H1 will not act on the run because a repository made again by `fossil clone` gets a new server-code that no longer matches `aaaa...a`. The sender must send the run again naming the new server-code.

12. A user holding admin or setup, or the user holding `R` who sent the run, may send a `stop`. It holds the keys `ocx`, `kind`, and `run`.