1. OCX on H1 acts on R1 because the repository's server-code and default user match those specified in R1. OCX on H2 ignores R1 because its repository's default user is different from that of R1.

2. No, OCX on H3 does not act on R1 because even though it shares a server-code with H1's clone, its default user is different. Only OCX on the repository whose server-code and default user match those in R1 will act on it.

3. No, the ended message by mallory does not count. It names the wrong default user (`lab-1`) for the run.

4. OCX on H1 will not act on R2 because the run's process user is `zed`, who holds only check-in capability (`i`). A `started` message posted by `zed` for his own run (R2) would count if it matched all the criteria, but since it does not, it does not count.

5. No, a run cannot name `"process": {"user": "lab-1"}` and be run because that would imply lab-1 holds admin or setup capability, which is not allowed according to refusal 4 in the protocol.

6. The most OCX on H1 can do on the server is set by who has that repository's command line. It is chosen by the user who has the host's command line for that specific repository.

7. `$$clone$$` refers to the path where the new clone is created when a run includes a "clone" step in its workspace. It is not the repository named in the run's `repository`.

8. A new run naming the old server-code will be refused by OCX on H1 because its default user has changed, and only OCX on the repository whose server-code and default user match those in the run will act on it.

9. Runs name `default_user` to ensure that their reports are received from the correct user (the one who named them) rather than any other user with similar permissions or access.

10. Only users holding admin or setup, or the user holding `R` that sent the run, can send a `stop` for R1. A `stop` message would hold `ocx`, `kind`, and `run`, with the run being the hash of the forum post or ticket change holding the run.