I think the client should, ideally do:- Use the network for all connections (why ask permission when forgiveness is cheap).Not gonna happen. Mobile clients do a ton of work to enable "make before break". There is no such thing as forgiveness from users who can't get Facebook updates, Twitter notifications, nor email while their device is held hostage because it switched to Wi-Fi and tore down mobile before checking for a captive portal.
This may also address your question elsewhere about browsers and "sandboxing". I suspect the sandboxing to which you're referring is about cookie isolation (primarily), but there's a kind of "network sanboxing" that is applied as well to ensure the browser uses a self-consistent networking configuration.