Battle.net installer now working. It crashes when the login page loads, but that seems to be fixed in upcoming version and the controls did read.

README.md

@@ -256,6 +256,34 @@ The standard-control reader is deliberately limited to native Wine controls.
 Custom-drawn, DirectX, and game-specific accessibility APIs remain the
 responsibility of the application or its accessibility middleware.
 
+Battle.net's `Blizzard Bootstrapper` wizard has a separate, guarded UI Automation
+reader. Its language page exposes no MSAA child controls. The helper reads the
+focused language selector and its current language, and the Continue button,
+without activating controls or changing focus. The provider marks the selected
+language as focused even while Continue owns Tab focus, so language choices
+are presented as the selector's value rather than independent focus events.
+Arrow changes are polled and unchanged results are suppressed. This support
+also reads the second page's startup checkbox through its native Toggle
+provider. Wine rejects the client toggle-state property query, so the native
+input hook borrows the focused provider on the application's UI thread and
+copies its checked/unchecked/mixed state. Only the foreground bootstrapper's
+direct `UiaReturnRawElementProvider` import is observed; the original call and
+result are preserved, no control is toggled, and provider references are not
+retained. State changes use the existing reader's `state` event.
+
+After installing updated hooks, close and reopen the wizard as well as
+restarting the reader. The hook stays mapped for the application's lifetime.
+Later installer pages beyond these exposed controls and the Battle.net
+launcher remain unverified.
+
+The UIA queries use a separate COM worker, limited to the foreground bootstrapper
+class, 64 sibling controls and a 500 ms result deadline. Wine's implemented
+extended property queries and an explicitly constructed tree walker avoid
+unimplemented convenience APIs. Protected field values and values whose
+protection is unknown are never queried. A blocked provider can stop this
+wizard's feedback until it returns, but does not block native menus, editing,
+MSAA events or helper shutdown. This is control feedback, not UIA flat review.
+
 Native menu reading uses accompanying 64-bit and 32-bit Windows hook DLLs. They
 observe
 `WM_MENUSELECT` inside Wine applications and sends menu labels, displayed