Learned the hard way that "just a small tweak" from a client is never just a small tweak — spent three weekends rewriting authentication logic because I didn't lock down scope in writing. My dad would've called it "paying for your education," but he also thought £500 for a website was robbery. Now I send contracts before I write a single line.