## 2026-09-01 — /goal rebuild session
- **new-bw-app.sh re-run requires --name despite authoritative bw-app.toml**
  (--dir alone dies "need --name"). Cost: ~2 min + a wrong first invocation in
  an autonomous session. Fix: derive NAME from the toml when --dir is passed.
- **`srv-gw logs --project` output isn't clean JSON on stdout** when piped
  (a leading non-JSON line broke `python -m json.tool` parsing). Cost: one
  broken pipeline. Fix: emit pure JSON to stdout, human text to stderr.
- **No sanctioned in-container command path for developers.** Seeding league
  needed `docker exec easel-app python -m app.seed_league` — owner-only.
  When Adi (a developer) needs to run an app-owned management command
  (re-seed, data fix, alembic stamp), he can't. Filed as a substrate ask in
  /srv/.logs/ideas.md (`srv-gw exec`).

## 2026-09-01 — Adi's first session
- **A repo created by one developer is unusable by the next without a manual
  opt-in.** `git init` ran as rian; every git command from a second project
  member dies `detected dubious ownership in repository at /srv/apps/<project>`
  and does nothing until that member runs
  `git config --global --add safe.directory <path>` by hand. Cost: every git
  command in the session failed until diagnosed. This matters now because
  whether git becomes a convention for new-standard apps is an open question —
  if it does, EVERY multi-developer project inherits this on day one. Fix
  belongs in whatever creates the repo (`new-workspace.sh`, or `srv-gw
  create-project`): set `safe.directory` for the project group, or set
  `core.sharedRepository=group` and document the one-liner in the standards.
- **An owner-written credential handoff file blocks the developer it was
  written for.** `.qa-invite.txt` (0600, rian) holds the set-password link for a
  QA account created specifically to unblock a developer session — which cannot
  read it. Compounding: the app's invite endpoint emails the link rather than
  returning it, so there is no self-serve path. The general shape worth fixing:
  when the owner provisions a credential *for* a named project member, it wants
  a mode the group can read (or a gateway command that hands it over), not 0600.