Role definitions install at the handshake

Claude Code reads ~/.claude/agents/ once, at session start. Definitions written during a tool call therefore did nothing that session, and the agent offered to simulate the two roles with general-purpose subagents — which drops the tools: allowlist, the only thing making the split enforceable rather than advisory.

They now install on the initialize handshake, during the session start the user was already performing. The hook is oninitialized, not a step after connect(): connect resolves before the client has sent initialize, so the client identity is still unknown there.