[hivecommons-hive]

The projects carousel's Prev/Next controls live outside [data-carousel], so hovering or focusing them never paused auto-advance.
Bind the same mouseenter/mouseleave/focusin/focusout handlers to the controls as well as the root; focusout treats focus moving between root and controls as still inside.
Adds a regression test in scripts/carousels.test.mjs.

Closes #271

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Needs one more change before it can land: the CSP hash for the edited inline script was not regenerated, which is why the test check is red — and it would also disable the carousel in browsers.

What I verified at head 24dec05:

• index.html:1149-1159 edits the body of the projects-carousel inline <script>. index.html:5 pins every inline script with a script-src 'sha256-…' allow-list; the hash for this script is now stale. node scripts/update-csp-hashes.mjs --check index.html → Stale: index.html (exit 1), and scripts/page-csp.test.mjs fails with "index.html: CSP meta present, hashes match inline scripts" (CI run 40269667195, test 233).
• Consequence if merged as-is: the browser enforces the <meta http-equiv="Content-Security-Policy"> and refuses to execute an inline script whose hash isn't listed, so the projects carousel loses all its JS (dots, Prev/Next, keyboard, auto-advance) — a worse state than the bug being fixed.
• Fix: node scripts/update-csp-hashes.mjs index.html and commit the rewritten index.html:5.

The behavioural change itself looks correct to me: controls is document.querySelector('[data-carousel-controls]') (index.html:992), the if (!el) return guard keeps the no-controls boot path (covered by "projects without external controls still boots" test) intact, and the focusout predicate treats root↔controls focus moves as still-inside. scripts/carousels.test.mjs passes 42/42 locally with the new regression test. Matches the stated goal of #271.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 633d8ae

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the full projects-carousel IIFE at index.html:985-1167 on head 633d8ae, not just the diff. Looks correct to me.

What I verified:

• controls (index.html:992) is the projects IIFE's own document.querySelector('[data-carousel-controls]'), not the hero controls at :676 (separate IIFE, :670-853), so the new [root, controls].forEach binds to the right element.
• The focusout guard at index.html:1155 treats focus moving root→controls and controls→root as still inside; start() (:1144) re-checks pointerPaused/focusPaused, so a focusout while the pointer is still over the controls stays paused.
• The CSP script-src hash was regenerated for the new inline script body: node scripts/update-csp-hashes.mjs --check exits 0 at this head.
• node --test scripts/carousels.test.mjs scripts/page-csp.test.mjs: 72 pass, 0 fail; the new regression test exercises hover, focus, and both cross-element focus moves.

No findings. Diff matches the PR body and closes #271 as stated.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the carousel script and the tree at the PR head; this looks correct to me.

• controls is document.querySelector('[data-carousel-controls]') (index.html:992), which sits in the band header outside [data-carousel] (index.html:407 vs :418), so the root-only listeners on main genuinely never fired for Prev/Next — matches #271.
• Binding the same handlers to [root, controls] (index.html:1149-1160) is safe: start() is gated by canAutoAdvance() (:1137-1146), so the mouseleave→start()→mouseenter→stop() sequence when the pointer crosses from the track to the buttons just resets the interval rather than advancing. The if (!el) return covers the withControls=false harness case, and the extended focusout test covers root↔controls focus moves in both directions.
• CSP: recomputed sha256 of every inline <script> at the PR head; the new script-src hash matches the modified block. (The one unhashed block is the application/ld+json data block, which is not executed and is unchanged from main.)
• node --test scripts/ at the PR head: 751 pass, 0 fail.

No findings.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#272633d8ae` sha256:095f0cb2e7d166b11e8bb35880fd94dd77bd85e15ec719307a1bb40fbb5c5207 — download from the dashboard or `hivectl review evidence #272`.