[FEATURE] Supported per-generation admission: max-turns=1 still permits output-limit recovery requests

## Request

Please provide a supported single-generation mode or synchronous **before every model request** admission callback in the CLI/Agent SDK, covering native output-limit recovery. We need the embedding host (Hermes) to own generation budgets and continuation decisions. This is not a request to extract OAuth tokens, patch binaries, rewrite requests via a proxy or substitute API billing.

## Reproduced behavior

Unmodified native 2.1.258 and 2.1.263, macOS arm64, driven by the unchanged [DirectSDK client at eafb4186](https://github.com/NousResearch/hermes-agent/blob/eafb4186a4e8be7ac0ca94d69b10c57e0154aee8/plugins/model-providers/claude-oauth-directsdk/directsdk.py). The maintained localhost recording peer returns synthetic SSE; only stop_reason changes.

| Native | end_turn | one max_tokens then end_turn | max_tokens throughout |
|---|---:|---:|---:|
|2.1.258|1 request|2 requests|4 requests then output-limit error|
|2.1.263|1 request|2 requests|4 requests then output-limit error|

These are directly observed localhost Messages requests, **not inferred num_turns**. Fourteen localhost requests total and zero real provider calls. Native max-turns=1, CLAUDE_CODE_MAX_RETRIES=0, native tools disabled, no session persistence, DISABLE_AUTO_COMPACT=1 and DISABLE_COMPACT=1. The output-limit path apparently differs from HTTP retry/tool-turn counting; we do not assert those flags promise otherwise.

[Portable reproduction and command](https://github.com/100yenadmin/hermes-claude-agent-sdk/blob/f2986cb2df26b3dd6181b39b08f5df971a76cd68/docs/ownership-recovery/README.md), [script](https://github.com/100yenadmin/hermes-claude-agent-sdk/blob/f2986cb2df26b3dd6181b39b08f5df971a76cd68/docs/ownership-recovery/native_recovery_probe.py), [original sanitized receipt](https://github.com/100yenadmin/hermes-claude-agent-sdk/blob/f2986cb2df26b3dd6181b39b08f5df971a76cd68/docs/ownership-recovery/native-recovery-receipt.json). Receipt SHA-256: 05fd629f64c4ed3980c5516d541cf69fe683aed38703e28866e86ab2f0ba305d. The portable wrapper changes path arguments/output packaging; it is not represented as the original measured script. No model prompts, real credentials, raw sessions or live configs are needed. Native processes use a sterile temporary home, fake fixture credential, dead proxies and an OS localhost-only outbound policy. Do not remove the sandbox.

Native SHA-256:
- 2.1.258: b63136194160791c27cfa7b0403060d85eb0752991625fde8c09f9acacb17c78
- 2.1.263: ef5d2909c8af49f31ab6d5487e90316777bc2fac170adfe8160716caa8aaf4f9

## Desired supported contract / acceptance

1. Deny before the first generation: zero transmitted requests.
2. Admit one, return max_tokens, deny the next: no second request is transmitted.
3. Preserve the first partial response, usage and finish reason rather than losing them to recovery/error handling.
4. A later explicitly authorized host step can continue from canonical history.
5. No alternate recovery, structured-output, auxiliary or fallback path bypasses admission. Callback failure/cancellation must fail closed before sending.

A documented control satisfying that contract is welcome; we will test a specific supported candidate with the same peer. No supported before-request control was identified in the inspected public interface; this is not a universal-impossibility claim. A post-response hook or request counter cannot provide before-send admission.

## Related work / deduplication

Related #84756 asks for a message-transform hook (closed duplicate #84751). #58219 asks for trace propagation. This request is specifically **synchronous generation admission and forced output-limit recovery**, not message rewriting or trace-only observation. Searches for max-turns/max_tokens/output recovery did not find this exact reproduction/contract.

Our own released integration also fails strict ownership; we corrected its claim and track recovery at https://github.com/100yenadmin/hermes-claude-agent-sdk/issues/21 . The upstream DirectSDK author separately reports the native-recovery boundary. We are not presenting either integration as fully qualified.

Start by reading the linked DirectSDK client at plugins/model-providers/claude-oauth-directsdk/directsdk.py and the reproduction instructions in docs/ownership-recovery/README.md. Run native_recovery_probe.py against the localhost recording peer, then verify that any supported admission control meets the five listed acceptance conditions, including preserving partial output and failing closed before transmission.

索引モデルが issue の本文から書いたものです。