diff --git a/Cargo.toml b/Cargo.toml
index 2cd68d6..6a2a012 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ members = ["apps/chuzz", "crates/chuzz-control"]
 resolver = "3"
 
 [workspace.package]
-version = "0.1.37"
+version = "0.1.38"
 edition = "2024"
 rust-version = "1.91"
 license = "MIT OR Apache-2.0"
@@ -32,21 +32,21 @@ homepage = "https://github.com/pathscale/chuzz"
 # the same range gets the same crate rather than a second copy. To build against
 # a working checkout, see `scripts/local-engine.sh`; it is opt-in so the default
 # exercises what a release actually resolves.
-blitz-dom = { package = "ps-blitz-dom", version = "^0.4" }
-blitz-html = { package = "ps-blitz-html", version = "^0.4" }
-blitz-net = { package = "ps-blitz-net", version = "^0.4" }
-blitz-script = { package = "ps-blitz-script", version = "^0.4" }
-blitz-traits = { package = "ps-blitz-traits", version = "^0.4" }
+blitz-dom = { package = "ps-blitz-dom", version = "^0.4.9" }
+blitz-html = { package = "ps-blitz-html", version = "^0.4.9" }
+blitz-net = { package = "ps-blitz-net", version = "^0.4.9" }
+blitz-script = { package = "ps-blitz-script", version = "^0.4.9" }
+blitz-traits = { package = "ps-blitz-traits", version = "^0.4.9" }
 # The wasmi host binding over blitz-dom-api, so a WebAssembly guest can build a
 # document with no JavaScript and no URL in the path.
-blitz-wasm = { package = "ps-blitz-wasm", version = "^0.4" }
+blitz-wasm = { package = "ps-blitz-wasm", version = "^0.4.9" }
 dioxus-native = { package = "ps-dioxus-native", version = "^0.7.3", default-features = false }
 # The MCP framing the control server speaks, same source and feature as
 # tauri-runtime-blitz uses for its agent-control surface.
 # The one control surface: wire vocabulary, the document core, and both
 # transports. It used to be reached through `tauri-runtime-blitz`, which meant a
 # headless browser compiled a Tauri runtime with the runtime switched off.
-blitz-control-protocol = { version = "^0.5", default-features = false }
+blitz-control-protocol = { version = "^0.5.1", default-features = false }
 endpoint-libs = { version = "^3", default-features = false, features = ["agent-control"] }
 brotli = { version = "8", default-features = false, features = ["std"] }
 image = { version = "^0.25.6", default-features = false }
@@ -80,7 +80,7 @@ anyrender = { package = "ps-anyrender", version = "^0.13.0" }
 # revision below closes the stack, snapshots, and reopens it, so glass renders
 # in the CPU paths as well as on the GPU.
 anyrender_vello_cpu = { package = "ps-anyrender-vello-cpu", version = "^0.17.0", features = ["filters"] }
-blitz-paint = { package = "ps-blitz-paint", version = "^0.4" }
+blitz-paint = { package = "ps-blitz-paint", version = "^0.4.9" }
 png = "=0.18.1"
 # Naming `wasmi::Linker` is unavoidable: `blitz_wasm::add_to_linker` takes one,
 # and blitz-wasm does not re-export the runtime. This must stay on the same
diff --git a/apps/chuzz/tests/serves_inspection.rs b/apps/chuzz/tests/serves_inspection.rs
index 6e4d8bc..fd6a824 100644
--- a/apps/chuzz/tests/serves_inspection.rs
+++ b/apps/chuzz/tests/serves_inspection.rs
@@ -414,6 +414,35 @@ fn serves_a_page_over_the_inspection_socket() {
             DebugResponse::Ack
         ));
 
+        // Click and DoubleClick both move the synthetic pointer onto their
+        // target, just as a physical click does. Move it away before testing
+        // entry, or hovering the same button again is correctly a no-op and
+        // there is no repaint to observe.
+        assert!(matches!(
+            request(
+                &mut stream,
+                &mut next_id,
+                &AgentControlRequest::Act(AgentAction::Input(InputCommand::Pointer {
+                    phase: PointerPhase::Move,
+                    x: 1.0,
+                    y: 1.0,
+                    button: 0,
+                    modifiers: Modifiers::default(),
+                })),
+            )
+            .await,
+            DebugResponse::Ack
+        ));
+        let event = tokio::time::timeout(Duration::from_millis(50), stream.recv())
+            .await
+            .expect("leaving a hovered control should repaint")
+            .expect("the host keeps serving")
+            .expect("read paint event");
+        assert!(matches!(
+            decode_diagnostics_event(event),
+            Ok(DebugEvent::PaintCommitted { .. })
+        ));
+
         assert!(matches!(
             request(
                 &mut stream,
@@ -435,26 +464,20 @@ fn serves_a_page_over_the_inspection_socket() {
 
         // These inputs now use the shared document-control implementation.
         // A page without a scroll range still accepts a wheel as a no-op.
-        for supported in [
-            AgentControlRequest::Act(AgentAction::Input(InputCommand::Pointer {
-                phase: PointerPhase::Move,
-                x: 1.0,
-                y: 1.0,
-                button: 0,
-                modifiers: Modifiers::default(),
-            })),
-            AgentControlRequest::Act(AgentAction::Input(InputCommand::Wheel {
-                delta_x: 0.0,
-                delta_y: 1.0,
-                phase: WheelPhase::Moved,
-                modifiers: Modifiers::default(),
-            })),
-        ] {
-            assert!(matches!(
-                request(&mut stream, &mut next_id, &supported).await,
-                DebugResponse::Ack
-            ));
-        }
+        assert!(matches!(
+            request(
+                &mut stream,
+                &mut next_id,
+                &AgentControlRequest::Act(AgentAction::Input(InputCommand::Wheel {
+                    delta_x: 0.0,
+                    delta_y: 1.0,
+                    phase: WheelPhase::Moved,
+                    modifiers: Modifiers::default(),
+                })),
+            )
+            .await,
+            DebugResponse::Ack
+        ));
         for unsupported in [AgentControlRequest::Relaunch, AgentControlRequest::Quit] {
             assert!(matches!(
                 request(&mut stream, &mut next_id, &unsupported).await,