1. **Host H1's OCX acts on R1** because R1 names H1's clone with the correct server-code (`aaaa…a`) and default user (`lab-1`). **Host H2's OCX ignores R1**, as R1 is intended for a different repository.

2. **OCX on H3 does not act on R1** because the run is named for a repository with server-code `aaaa…a` but default user `lab-9`, which differs from H3's clone.

3. **mallory's ended message counts** because it comes from the repository's default user (`lab-1`) and names the correct repository and default user for R1.

4. **OCX on H1 does not act on R2** because R2 names a different repository (default user `zed`), even though R2 itself was sent by a user holding `R`. **zed's started message does not count** as it comes from the sender rather than the run's default user.

5. **A run cannot name `"process": {"user": "lab-1"}` and be run** because OCX would then ignore such a run, as `lab-1` is the default user for the repository R1 targets, not `builder`.

6. **The most that OCX on H1 can do on the server** is determined by the capabilities of the user chosen to act with the repository (default user `lab-1`). This choice is made by whoever has that repository's command line.

7. The step `{"step": "clone", "into": "$$workspace$$/clone"}` sets up a new workspace directory named `clone` inside the current workspace (`$$workspace$$`), and it is not directly tied to the repository named in R1's `repository`.

8. **When H1's clone is deleted and made again**, any new run naming the old server-code (`aaaa…a`) will be answered by no one because a new clone gets a new server-code, making it incompatible with the old run.

9. **A run names `default_user` instead of OCX finding the user from the server-code** to ensure that only users explicitly allowed to send runs can do so, preventing unauthorized access.

10. **A stop for R1 may be sent by any user holding admin or setup**, or by a user who holds `R` if permitted by `ROOT/settings/capability-R.json`. The stop must include the run's hash (`run`) and optionally the repository details (`repository`).