You are reading a protocol definition for the first time. Read it, then answer each question at the end in one to three sentences, naming the section that decides it. Use only what the text says.

## 2. Protocol version 2

An OCX message is a JSON object in a fenced block of a forum post or a
ticket change, found as version 1 finds one ([Fossil, senders and nodes,
section 2](https://ollama.openbeagle.org/ollama/doc/tip/docs/protocol-v1-fossil.md#finding)).
Every message carries `"ocx": 2`. A reader that knows only version 2 ignores
a block with `"ocx": 1`. When this section says OCX does something, it means
OCX on the run's clone.

### 2.1 The kinds

| Kind | Sent by | Written where | Keys | Answered by |
| --- | --- | --- | --- | --- |
| `run` | a user holding admin or setup; or a user holding `R`, within what the clone's owner allows (2.9, row 1) | anywhere: a new thread, a reply, a ticket change | `ocx`, `kind`, `clone`, `objective`, then `workspace`, `sandbox`, `limits`, `process`, read in that order | `started` then `ended`, or `ended` alone |
| `stop` | a user holding admin or setup; or the user holding `R` that sent the run | where its run is | `ocx`, `kind`, `run` | its run's `ended` |
| `started` | OCX, as the clone's user; from any other user, even one holding admin or setup, it does not count | where its run is | `ocx`, `kind`, `run`, `clone`, `values`, `limits` | none |
| `ended` | OCX, as the clone's user; from any other user, even one holding admin or setup, it does not count | where its run is | `ocx`, `kind`, `run`, `clone`, `outcome`, `exit`, `note` | none |

Two clones appear in a run. The run's clone, named by the key `clone`,
already exists and acts on the run. The process's clone does not exist until
the workspace step `clone` makes it, new, from the server's repository; its
path is `$$process_clone$$`, and the process works in it.

| Key | In | Holds |
| --- | --- | --- |
| `ocx` | every kind | `2` |
| `kind` | every kind | `run`, `stop`, `started` or `ended` |
| `clone` | `run` | `{"server_code", "user"}`, both required. `server_code`: the 40 lower-case hex digits of the server-code of the repository that is to act on the run, the run's clone, as `fossil info` prints it as server-id there. `user`: the login of the Fossil user OCX acts as on that clone, the clone's user. Every other repository ignores the run |
| `clone` | `started`, `ended` | `{"server_code", "user"}`: the server-code of the repository that wrote it, and the user it wrote as |
| `objective` | `run` | text, required: what the run is for, and what counts as passing |
| `run` | `stop`, `started`, `ended` | the run's hash in full: the hash of the forum post or ticket change holding it |

Who sent a message is the user the server's repository received it from, by
its receipt, never a name written in the message. A post's edit is a new
artifact: an edit holding a run is a new run.

| A message that | Is |
| --- | --- |
| is a `run` naming this repository's server-code, from anyone section 2.1 does not name | refused: OCX writes `ended`, `refused`, as the clone's user (2.9, row 1) |
| is a `run` naming this repository's server-code with another `clone.user` | refused, not ignored (2.9, row 4) |
| is a `run` naming another repository's server-code | ignored by this repository: it writes nothing |
| is a `stop` from anyone section 2.1 does not name | ignored |
| is a `started` or `ended` not received from the run's `clone.user`, or whose `clone` is not the run's | does not count |
| is a second `started` or `ended` for one run that counts | ignored: the first, in the server's order, counts |
| has a `kind`, or an `ocx`, the reader does not know | ignored |

### 2.2 The clone's user, and the process's user

| Who | Is | Holds |
| --- | --- | --- |
| the clone's user, `clone.user` | the Fossil user OCX acts as on the run's clone; on a clone that `poll` made, the clone's default user, which its owner chose with `poll --login`; on the server's repository, the user its hook was installed with, `hook --login` | never admin or setup (`hook` and `poll` refuse one); on the server's host, no capability: OCX writes into the repository directly; elsewhere what its owner asked: by default `g`, `o`, `i`, and `y` to share unversioned files. Its capabilities on the server's repository are the most OCX on that clone can do, as for any Fossil command line |
| the process's user, `process.user` | the Fossil user the run's process acts as, in the process's clone | never admin or setup; never a clone's user (one named as the `clone.user` of a run a user holding admin or setup sent); it works for one clone's user: the `clone.user` of the first run, in the server's order, that a user holding admin or setup sent naming it |

The clone's user and the process's user are never the same user. Once an
admin's run has named `builder` as its `process.user` with `clone.user`
`lab-1`, `builder` works for `lab-1`: every clone whose user is not `lab-1`
refuses a run whose `process.user` is `builder` (2.9, row 6).

One user may be the user of several clones: each run names its clone by
server-code, so no run is taken by two. Several clones on one host each have
their own release root.


## Questions

S1 stands for the 40-digit server-code 1a2b3c4d5e6f708192a3b4c5d6e7f80910a1b2c3, and S2 for 9f8e7d6c5b4a39281706f5e4d3c2b1a098765432.

1. A run holds `"clone": {"server_code": S1, "user": "lab-1"}`. One host has two clones whose OCX both act as the user lab-1: one with server-code S1, one with S2. Which acts on the run, and what does the other do with it?
2. The server's repository received a `started` for that run from the user `stone`, who holds setup; its `clone` is `{"server_code": S1, "user": "lab-1"}`. Does it count? Why?
3. The server's repository received a `started` for that run from lab-1, its `clone` being `{"server_code": S2, "user": "lab-1"}`. Does it count? Why?
4. In a run, what is `clone.user` and what is `process.user`? Who acts as each? May they be the same user?
5. A user holding only the capability `i` (check-in) posts a run naming clone S1, user lab-1. What does OCX on S1 write, and as which user?
6. A run names `{"server_code": S1, "user": "lab-2"}`, but OCX on the clone S1 acts as lab-1. What does OCX do, and does what it writes count?
9. What keys does a `stop` hold, and who may send one that is acted on?
11. The word "clone" appears in a run as the key `clone`, as the workspace step `clone`, and inside the value name `$$process_clone$$`. Which repository does each refer to?
