feat(client): add safe polling session UI

client/tests/test_app.py

@@ -22,3 +22,36 @@ class ApplicationArgumentsTests(unittest.TestCase):
     def test_none_uses_process_arguments(self) -> None:
         with mock.patch("cmbuyer_client.app.sys.argv", ["process-name", "--process-option"]):
             self.assertEqual(["process-name", "--process-option"], select_application_argv(None))
+
+    def test_standalone_entry_does_not_construct_http_or_device_capabilities(self) -> None:
+        source = (CLIENT_ROOT / "src" / "cmbuyer_client" / "app.py").read_text(encoding="utf-8")
+        for forbidden in (
+            "HttpTaskSource",
+            "HttpTransport",
+            "DurableClientGateway",
+            "import uiautomator2",
+            ".device",
+            ".pdd",
+        ):
+            with self.subTest(forbidden=forbidden):
+                self.assertNotIn(forbidden, source)
+        self.assertIn("gateway_factory=None", source)
+        self.assertIn("consumer=None", source)
+
+    def test_t304_ui_has_no_hidden_connection_probe_or_irreversible_capability_import(self) -> None:
+        paths = [
+            *(CLIENT_ROOT / "src" / "cmbuyer_client" / "ui").glob("*.py"),
+            *(CLIENT_ROOT / "src" / "cmbuyer_client" / "polling").glob("*.py"),
+        ]
+        source = "\n".join(path.read_text(encoding="utf-8") for path in paths)
+        for forbidden in (
+            "uiautomator2",
+            "cmbuyer_client.pdd",
+            "cmbuyer_client.device",
+            "submit_order",
+            "payment",
+            "http.client",
+            "subprocess",
+        ):
+            with self.subTest(forbidden=forbidden):
+                self.assertNotIn(forbidden, source)