diff --git a/.gitignore b/.gitignore
index c6707d4..7c807d1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,5 @@ var/
 # local preview launch config
 frontend/.claude/
 .claude/launch.json
+
+.env.*.bak
diff --git a/app/ingestion/knowledge_ingest.py b/app/ingestion/knowledge_ingest.py
index f945d35..c45d0d2 100644
--- a/app/ingestion/knowledge_ingest.py
+++ b/app/ingestion/knowledge_ingest.py
@@ -139,6 +139,13 @@ class SqlAlchemyKnowledgeIngestRepository:
                     if existing_doc.status == DocumentStatus.DISCOVERED:
                         existing_doc.status = DocumentStatus.STORED_ORIGINAL
 
+                # Flush the Document row before FK-dependent inserts: there is no
+                # ORM relationship between AssetIngestJob/DocumentArtifact and
+                # Document, so the unit of work does not order these INSERTs and
+                # PostgreSQL rejects the job row with a ForeignKeyViolation
+                # (SQLite-based tests do not enforce FKs, hence unseen there).
+                db.flush()
+
                 ensure_artifact(
                     db,
                     document_id=document_id,
diff --git a/docker-compose.shared-minio.yml b/docker-compose.shared-minio.yml
new file mode 100644
index 0000000..a3119b7
--- /dev/null
+++ b/docker-compose.shared-minio.yml
@@ -0,0 +1,28 @@
+# Shared-minio migration overlay (phase 1 of
+# TeamHUB-Platform/docs/submodules/plans/2026-07-08-shared-minio-migration-prompt.md).
+# Attaches ONLY api and worker to the shared teamhub_net so they can reach the
+# platform MinIO (alias teamhub-minio) from container start. Unlike
+# docker-compose.teamhub.yml this overlay does not strip host ports from data
+# services and does not enable AUTH_REQUIRE_IDENTITY - local debug contour.
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.shared-minio.yml up -d --no-deps api worker
+
+networks:
+  teamhub_net:
+    external: true
+    name: teamhub_net
+
+services:
+  api:
+    networks:
+      edge: {}
+      legacyhub_db: {}
+      teamhub_net:
+        aliases: [legacyhub-api]
+
+  worker:
+    networks:
+      edge: {}
+      legacyhub_db: {}
+      teamhub_net: {}
diff --git a/docker/Dockerfile b/docker/Dockerfile
index bd0883a..c7fce41 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -22,6 +22,7 @@ RUN apt-get update \
         build-essential \
         curl \
         ca-certificates \
+        git \
         ghostscript \
         qpdf \
         unpaper \
@@ -51,7 +52,14 @@ COPY pyproject.toml README.md alembic.ini /app/
 COPY app /app/app
 COPY scripts /app/scripts
 
+# Local build: install the recognition engine from a pre-built wheel (the
+# pinned git source lives in a private GitHub repo unreachable from the build
+# container without credentials), then relax the pyproject pin to a version
+# spec inside this layer only - the repo file stays untouched.
+COPY docker/wheels /tmp/wheels
 RUN pip install --upgrade pip wheel setuptools \
+ && pip install /tmp/wheels/*.whl \
+ && sed -i 's|"teamhub-document-recognition-engine @ git+[^"]*"|"teamhub-document-recognition-engine>=0.1.0"|' pyproject.toml \
  && pip install -e .
 
 RUN mkdir -p /data/input /data/work
diff --git a/docker/wheels/teamhub_document_recognition_engine-0.1.0-py3-none-any.whl b/docker/wheels/teamhub_document_recognition_engine-0.1.0-py3-none-any.whl
new file mode 100644
index 0000000..c6c2d71
Binary files /dev/null and b/docker/wheels/teamhub_document_recognition_engine-0.1.0-py3-none-any.whl differ