1. OCX on H1 acts on R1 because its server-code (aaaa…a) and clone's user (lab-1) match the run's `clone` key. OCX on H2 does nothing because the run's `clone.server_code` (aaaa…a) does not match H2's server-code (bbbb…b).

2. OCX on H3 does not act on R1 because the run's `clone.user` (lab-1) does not match H3's clone's user (lab-9). If H3's clone's user were lab-1, it would act because both the server-code and user would match.

3. It does not count because reports only count if they are sent by the run's `clone.user` (lab-1), and this report was sent by mallory.

4. It does not count because reports only count if they are sent by the run's `clone.user` (lab-1), and this report was sent by stone.

5. OCX on H1 does not act on R3 because the run's `clone.user` (mallory) does not match H1's clone's user (lab-1). Mallory's `started` does not count because rule 3 requires the run to be sent by a user holding admin, setup, or `R` who is not the `clone.user`, but mallory holds none of those capabilities.

6. OCX on H1 acts on R4 because the server-code and user match. However, it writes a refusal (outcome `refused`) because mallory's sender capabilities do not include admin, setup, or `R` (refusal 1); this refusal counts because it is written as the clone's user.

7. No, it cannot be run. It would be refused under rule 4 because the `process.user` cannot be any clone's user, and lab-1 is a clone's user.

8. OCX on H2 refuses the run (refusal 5). This happens because the `process.user` (builder) already works for another clone (H1's aaaa…a), and a process's user can only work for one clone.

9. The capabilities of the clone's user (lab-1) on the server set the limit. The clone's owner chose this user via `poll --login`.

10. `$$process_clone$$` is a new repository created by `fossil clone` of the server's repository using the process's user's credentials. It is not the repository named in the run's `clone` key; the protocol states the process's clone is never the run's clone.

11. OCX on H1 will not act on the run because a repository made again by `fossil clone` gets a new server-code, and the run's server-code (aaaa…a) will no longer match. The sender must send the run again naming the new server-code.

12. A user holding admin or setup (such as stone) may send a `stop` for R1. It holds the keys `ocx`, `kind`, and `run`.