1. When OCX on H1 takes the step `password` for R1, it comes from OCX setting a fresh password for the process's user 'builder' based on the server's configuration and permissions. Before being given, the run checks if the sender has the required capabilities to perform the action.

2. When zed sends a run R2 naming H1's clone, it is refused because the `process.user` (builder) is not allowed by the server’s policy set in `ROOT/settings/capability-R.json`, as OCX enforces these rules.

3. When R3 tries to use a hard-coded password ("hunter2") instead of the process's user's password, it is also refused because hardcoded passwords are generally unsafe and against Fossil's best practices, which enforce using dynamic passwords for security reasons.

4. In R1's `started`, the value `password` is written as `$$password$$`, indicating that OCX has not yet created a concrete password but will do so when needed.

5. Lab-2 signs in to the server and asks the `password` tool for R1’s password, but does not receive it because R1's `process.user` (builder) is already associated with another clone (H2), violating OCX's rule of one run per user across hosts.

6. After R1’s `started` counts, lab-1 asks the `password` tool again for R1's password, but it gets no response because the server has already set a new password for the process user upon receiving and processing R1.

7. A person does not directly press a button or edit files on H1 to give builder a password; instead, the password is dynamically generated and managed by OCX based on the `clone.user` (lab-1) and the server's security policies.

8. For run R4, sent by stone naming the server’s repository as its clone, if builder works for that repository, the password comes from the `password` step of R4 itself, which includes a dynamic password generated when OCX processes the request and ensures builder is properly authenticated to access the server's resources.