1. When OCX on H1 takes the step `password` for R1, builder's password comes from the process's user set by the sender of R1 (stone). Before being given, OCX checks if R1's `clone.user` sent it or if a user holding `R` sent it and if that user is allowed to do so.

2. When zed sends run R2 naming H1's clone with the same steps as R1, refusal 4 holds because `process.user` (builder) works for another clone (H1), causing the step to fail.

3. For run R3 where the password is explicitly set to "hunter2", OCX checks if this value was set by any object before it and since no previous setting exists for `password`, refusal 3 occurs, and nothing is made.

4. In R1's `started`, the value for the password is written as `$$password$$` because the step sets a fresh password on the process's user during the run.

5. When lab-2 signs in to the server and asks the `password` tool for R1's password, it does not get it. This happens because refusal 4 holds: `process.user` (builder) works for another clone (H1), causing the step to fail.

6. After R1's `started` counts, lab-1 asks the `password` tool for R1's password again and it fails due to refusal 4. `process.user` (builder) still works for another clone (H1).

7. No person on H1 presses a button, approves a login, or edits a file to give builder a password for R1. The password is set during the run based on the user's credentials and not by manual intervention.

8. For run R4 where the server's repository is named as its clone, builder's password comes from the process's user (stone) because in this case, builder works for that repository.