1. H1's OCX acts on R1 because the run's server-code and default user match H1's own. H2's OCX does nothing because the run's server-code does not match its own.

2. No, OCX on H3 does not act on R1 because the run's default user (`lab-1`) does not match H3's default user (`lab-9`).

3. No, it does not count because a report only counts if the server received it from the user named in the run's `default_user` (`lab-1`), and this was received from `mallory`.

4. OCX on H1 does not act on R2 because the run's default user (`zed`) does not match H1's default user (`lab-1`). Zed's `started` report does not count because a report cannot be sent by the user who sent the run.

5. No, it would be refused under Refusal 4 because the `process.user` cannot be the run's default user, nor any default user named in a run sent by a user holding admin or setup.

6. The capabilities of the default user (`lab-1`) on the server set the limit of what OCX on H1 can do. This was chosen by whoever has H1's repository's command line.

7. `$$clone$$` is the path to a new clone of the server's repository created during the `clone` step. It is explicitly not the repository named in the run's `repository`.

8. The run is answered by no one because a repository made again by `fossil clone` gets a new server-code, and runs naming the old one are ignored.

9. The run names the `default_user` because the server only records the user an artifact came from and the server-code alone cannot vouch for anything; thus, a user must be fixed to sign the repository's reports.

10. A `stop` may be sent by any user holding admin or setup, or by the user holding `R` who sent R1. It holds the keys `ocx`, `kind`, and `run`.