Should I write the project for the agency into a 'specification document', or is it enough to just say it via email?

You're right, I've been down that road too. Access credentials should be opened in the company's name, not personal accounts.

If you post the result here, it will help others too.

How did you solve this? Just because everyone does it doesn't mean it's right.

People defend habits, not processes. Resistance comes from there. Just leaving this note, it might be useful.

I went through the same thing two years ago. Access credentials should be opened in the company's name, not personal accounts.

Every "we'll look at it later" in a meeting means unbilled work. That's all, sorry if I went on too long.

There are three things to check when doing this. Ask who prepared the quote and who will actually do the work.

This is my opinion I'm not claiming it's absolute truth.

Let me share what happened to me; it might be useful. Code without setup documentation isn't yours, even if you have it.

That's all, sorry if I went on too long.

the discussion got scattered, let me summarize. code without setup documentation isnt yours, even if you have it.

correct me if Im wrong.

I feel the same way. Trying to do this alone is the most expensive way.

Looking at it as a process the picture changes. Everyone rushing into how to write a specification document gets stuck at the same point.

In legacy systems the most expensive thing is unknown dependencies.

Following. Access credentials should be opened in the company's name not personal accounts.

If scope grows, either time or budget must grow. There is no third option. If I were you, I'd go this route.

I agree, and I'd like to emphasize that. The cheapest quote is usually the least thought-out one.

Proven by experience.

You're right. If you don't write this down from the start, it leads to arguments later.

I'm also curious if anyone does it differently.

there's a common mistake people make when doing this. anyway don't hesitate to ask; those who don't ask always pay more.

access credentials should be opened in the company's name, not personal accounts.

Saved.

You're right. In legacy systems, the most expensive thing is unknown dependencies.

Good luck with that.

We got stuck at the same point for a while. If you don't write this down from the start, it leads to arguments later.

Good luck with that.

Following.

I'm curious too. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Exactly, and not many people know this. If code ownership isn't in the contract you have no bargaining power when leaving.

If you post the result here it will help others too.