Battle.net installer now working. It crashes when the login page loads, but that seems to be fixed in upcoming version and the controls did read.

bootstrapper_controls.h

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
+#pragma once
+#include <windows.h>
+#include <cstdint>
+#include <memory>
+#include <string>
+
+bool is_bootstrapper_window(HWND window);
+
+struct BootstrapperControl {
+  HWND window = nullptr;
+  DWORD process = 0, thread = 0;
+  uint64_t generation = 0, deadline = 0;
+  bool available = false;
+  std::string identity, name, role, value, states;
+};
+
+// Caller initializes COM. Queries only copied properties, never invokes or
+// focuses a control. The deadline bounds traversal, not a blocked COM call.
+BootstrapperControl read_bootstrapper_control(HWND window, uint64_t deadline);
+
+// A separate worker keeps a stalled UIA provider out of the MSAA, menu,
+// editor and controller paths. At most one request and one result are kept.
+class BootstrapperControlReader {
+public:
+  ~BootstrapperControlReader();
+  bool start();
+  void observe(HWND window);
+  bool take(BootstrapperControl &result);
+  void stop();
+private:
+  struct State;
+  std::shared_ptr<State> state_;
+  HANDLE worker_ = nullptr;
+};