From 24dec055270bb35d0464c3a0090f57b9aab11d0d Mon Sep 17 00:00:00 2001
From: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 00:32:57 -0400
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=90=9B=20fix(carousel):=20pause=20aut?=
 =?UTF-8?q?o-advance=20while=20Prev/Next=20controls=20are=20hovered=20or?=
 =?UTF-8?q?=20focused?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
---
 index.html                 | 19 +++++++++++--------
 scripts/carousels.test.mjs | 16 ++++++++++++++++
 2 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/index.html b/index.html
index 8b347e5..c5364b8 100644
--- a/index.html
+++ b/index.html
@@ -1146,14 +1146,17 @@ <h2 id="infra-thanks-title">Thanks to the organizations that power Hive Commons<
   }
   function stop() { clearInterval(timer); timer = null; }
   function restart() { stop(); start(); }
-  root.addEventListener('mouseenter', function () { pointerPaused = true; stop(); });
-  root.addEventListener('mouseleave', function () { pointerPaused = false; start(); });
-  root.addEventListener('focusin', function () { focusPaused = true; stop(); });
-  root.addEventListener('focusout', function (e) {
-    if (!root.contains(e.relatedTarget)) {
-      focusPaused = false;
-      start();
-    }
+  [root, controls].forEach(function (el) {
+    if (!el) return;
+    el.addEventListener('mouseenter', function () { pointerPaused = true; stop(); });
+    el.addEventListener('mouseleave', function () { pointerPaused = false; start(); });
+    el.addEventListener('focusin', function () { focusPaused = true; stop(); });
+    el.addEventListener('focusout', function (e) {
+      if (!root.contains(e.relatedTarget) && !(controls && controls.contains(e.relatedTarget))) {
+        focusPaused = false;
+        start();
+      }
+    });
   });
   document.addEventListener('visibilitychange', function () { document.hidden ? stop() : start(); });
   if (reduceMotion.addEventListener) {
diff --git a/scripts/carousels.test.mjs b/scripts/carousels.test.mjs
index 1e9f678..f33f909 100644
--- a/scripts/carousels.test.mjs
+++ b/scripts/carousels.test.mjs
@@ -789,6 +789,22 @@ test("projects pause: pointer hovering then external focusout stays paused until
   assert.deepEqual(t.timers.intervals(), [PROJECT_ADVANCE_MS], "resumes once neither is inside");
 });
 
+test("projects pause: hovering or focusing the external Prev/Next controls pauses auto-advance", () => {
+  const t = bootProjects();
+  t.controls.dispatch("mouseenter");
+  assert.deepEqual(t.timers.intervals(), [], "hover on controls pauses");
+  t.controls.dispatch("mouseleave");
+  assert.deepEqual(t.timers.intervals(), [PROJECT_ADVANCE_MS], "leaving controls resumes");
+  t.controls.dispatch("focusin");
+  assert.deepEqual(t.timers.intervals(), [], "focus on controls pauses");
+  t.controls.dispatch("focusout", { relatedTarget: t.root });
+  assert.deepEqual(t.timers.intervals(), [], "focus moving into the carousel stays paused");
+  t.root.dispatch("focusout", { relatedTarget: t.next });
+  assert.deepEqual(t.timers.intervals(), [], "focus moving back to the controls stays paused");
+  t.controls.dispatch("focusout", { relatedTarget: null });
+  assert.deepEqual(t.timers.intervals(), [PROJECT_ADVANCE_MS], "resumes once focus leaves both");
+});
+
 test("projects reduced-motion toggle: stops and resumes auto-advance", () => {
   const t = bootProjects();
   t.mq.set(true);

From 633d8aedbdf9b458e797d42ff5568a602fa42fc7 Mon Sep 17 00:00:00 2001
From: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 00:40:39 -0400
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=90=9B=20fix(carousel):=20regenerate?=
 =?UTF-8?q?=20CSP=20script-src=20hash=20for=20the=20updated=20inline=20scr?=
 =?UTF-8?q?ipt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The inline carousel script in index.html changed, so its sha256 in the CSP
meta policy must be regenerated (node scripts/update-csp-hashes.mjs).

Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
---
 index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/index.html b/index.html
index c5364b8..5ee3749 100644
--- a/index.html
+++ b/index.html
@@ -2,7 +2,7 @@
 <html lang="en" class="no-js">
 <head>
 <meta charset="utf-8">
-<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'sha256-e2g5HkZP+fghbsY1m7moq4GopOo7zRRaAHNyQ2Q7oSI=' 'sha256-NgUcRWqgRxmvoXsdf9DJT4dQ5AOna/qzI6dDicudC9k=' 'sha256-QSGzxNSepdjMBRwnovEOJlbbTDp+rqYlcPfhcB+fgnQ=' 'sha256-yDk9g0p1zFFAzRAKzvh9BO3odtKg96amzKsWG0jpax4='; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; base-uri 'none'; form-action 'none'">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'sha256-e2g5HkZP+fghbsY1m7moq4GopOo7zRRaAHNyQ2Q7oSI=' 'sha256-NgUcRWqgRxmvoXsdf9DJT4dQ5AOna/qzI6dDicudC9k=' 'sha256-QSGzxNSepdjMBRwnovEOJlbbTDp+rqYlcPfhcB+fgnQ=' 'sha256-rrFBsqTHVoUIsbIMbJ9438/R1TuU4x9Aw7xFQONRI9U='; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; base-uri 'none'; form-action 'none'">
 <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
 <title>Hive Commons</title>
 <meta name="description" content="Hive Commons supports Hive: governed AI-agent fleets with Jira Data Center work sources, The Commons, swarms, Claude Code, GitHub Copilot, vLLM, llm-d and more.">