Record accepted Phase 3 handoff and subclass caveat

Wine preferences tab landed as 75f34ea with maintainer flesh-test results; the pre-attached edit-subclass dynamic-addition caveat is recorded and localized for Phase 4.

docs/testing/wine-proton-phases.md

@@ -130,7 +130,7 @@ At the start of every phase session:
 | 0 | Native exclusion foundation | none | `wine/native-hook-exclusions` | Fast-forward merged into wine-access `hunter`; not pushed |
 | 1 | Ready record, spawn evidence, mixed-prefix spawn semantics | `wine/ready-and-spawn-evidence` | `wine/ready-and-spawn-evidence` | Accepted and merged into `hunter` in both repositories; not pushed |
 | 2 | Live Wine settings | `wine/live-settings` | none | Accepted and merged into `hunter`; not pushed |
-| 3 | Wine preferences tab | `wine/preferences-tab` | none | Not started |
+| 3 | Wine preferences tab | `wine/preferences-tab` | none | Accepted and merged into `hunter`; not pushed |
 | 4 | Live verification and final results | `wine/verification` | Defect branch only for a proven helper cause | Not started |
 
 ## Phase 0: native hook-exclusions foundation
@@ -362,6 +362,72 @@ the result with no reader restart.
 Stop boundary: report the diff and evidence. Do not begin the live
 regression in the same session.
 
+### Accepted handoff (2026-11-01)
+
+- Session: `wine-3-growler` (`vivid-antlia`,
+  01a19aed-ae17-7ea0-8e69-0a430cf8c4ab); coordinated from the master
+  session (`still-enceladus`).
+- Starting commit: Cthulhu `dc6a961` on `wine/preferences-tab`.
+  Wine-access untouched (Cthulhu-only phase).
+- Committed after maintainer acceptance: Cthulhu `75f34ea`
+  ("Add global Wine preferences tab"), 15 files, +543/-5, then
+  merged into `hunter` at the maintainer's direction. This ledger
+  update rides a separate docs commit on the phase branch. Not
+  pushed.
+- Automated evidence (phase session; preferences/config/wine
+  suites, the focused global-apply app test, `go vet`, gofmt, and
+  the harness compile independently re-run green by the master
+  session at landing): Values round-trip and ownership, duplicate
+  collapse, invalid entries rejected by name with prior settings
+  intact, global Apply governing the same manager and persisting
+  through TOML, app-scoped Apply unable to change governing/global/
+  app-profile Wine, build. Full `internal/app` shows only the
+  pre-existing sandbox socket failure recorded in Phases 1-2 (not
+  re-verified on a clean tree this session).
+- Not exercised by the phase session: the native preferences
+  harness could not run in its environment (Xvfb/session failures
+  reproduced identically with the pre-Phase-3 binary, so no Phase 3
+  signal); the added `CTHULHU_PREFS_WINE_ONLY` mode is unverified.
+  Keyboard-only round trip remains Phase 4.
+- Live evidence, by kind: installed-binary — maintainer-rebuilt
+  Cthulhu from the phase tree. Audible speech / physical input —
+  maintainer flesh test, 2026-11-01, Diablo IV kept alive in the
+  same prefix throughout: baseline Notepad reading; adding
+  `notepad.exe` in the Wine tab and Applying (no reader restart)
+  took effect — save/close dialog no longer spoke, a freshly
+  launched Notepad did not read, and Diablo IV survived the
+  addition-triggered helper restart. Removing the entry did not
+  restore reading while Diablo kept the prefix/helper alive,
+  which is the decision 4/17 no-downgrade rule, not a failure.
+  Braille-display evidence: none this phase.
+- Recorded caveat, carried to Phase 4 (not a Phase 3 defect): in
+  the same live test, the already-running Notepad instance's edit
+  text remained readable long after Apply, including after focus
+  excursions into Diablo's menus. Master-session code inspection
+  confirmed the mechanism: the helper's edit subclass is installed
+  in the target process on first focus `SetWindowSubclass` in
+  wine-access `edit_hook.c`, module pinned until the control is
+  destroyed, so it survives the helper restart; it finds the new
+  helper's bridge dynamically by window class, and the new
+  helper's text-event presentation in `main.cpp` does not check
+  the exclusion list, while dialog WinEvents and new foreground
+  hooks are correctly gated. Fresh instances are fully gated.
+  Classified as a Phase 0/1 dynamic-addition gap: exclusion is
+  enforced at foreground-hook install and dialog presentation, but
+  not against a pre-attached edit subclass. Note also that the
+  subclass DLL remains mapped in the already-running process until
+  it exits, so event gating alone cannot make an already-running
+  anti-tamper program retroactively clean; listing before launch
+  remains fully protected. Phase 4 must decide the remedy (at
+  minimum, presentation-side gating of stale-subclass text events
+  in the replacement helper, with a regression: editor focused,
+  then listed, helper restarted, focus away and back) and record
+  the outcome; Wine review remaining available for listed
+  programs is accepted behavior and is not this caveat.
+- Ready for maintainer review: yes. Accepted by the maintainer on
+  2026-11-01 with the caveats above recorded ("record these and
+  move on").
+
 ## Phase 4: live verification and final results
 
 Status: not started. Contract decisions: 7, 8, 10, 11, 12, 14, 15,
@@ -372,6 +438,14 @@ after Phase 3 has landed there. Open a narrow wine-access defect
 branch only if the regression proves a root cause there; do not
 create one speculatively.
 
+Known starting item (recorded at Phase 3 acceptance): the
+pre-attached edit-subclass caveat in the Phase 3 accepted handoff
+above. Its root cause is already localized to wine-access
+(`edit_hook.c` subclass persistence plus ungated text-event
+presentation in `main.cpp`), so if the maintainer elects to fix it
+in this phase, that localization is the proof required for a
+narrow wine-access defect branch.
+
 Fixed live corpus:
 
 - Diablo IV: excluded, anti-tamper path; controller speech by ear