[verified] add vintage collector and point-in-time API

docs/engineering-log.md

@@ -6,6 +6,7 @@
 |---|---|---|---|
 | M0 repo foundation | complete | Flask API, Vue/Vite shell | keep research/paper guardrails |
 | M1 BOT Tourism adapter | complete | 18 tests, live BOT fetch, raw/snapshot persistence | validate multiple vintages |
+| M2 vintage collector | complete | 25 tests, manifest idempotency, live collector and point-in-time API | collect independent releases |
 | Tourism deterministic signal | complete | live foreign-arrivals YoY surprise | add occupancy/airport metric |
 | Internal paper ledger | complete | POST/readback through live API | persist in PostgreSQL later |
 | Dashboard | complete | Vite build + served source check with live-sign copy | visual browser capture after permission is available |
@@ -23,7 +24,7 @@
 
 ## Verification
 
-- Backend: 18 unittest tests pass.
+- Backend: 25 unittest tests pass.
 - Independent M1 review: **PASSED**; no concrete security or logic blockers.
 - Reviewer suggestions: set `PAPER_COOKIE_SECURE=1` outside local HTTP; replace in-memory sessions before multi-worker deployment.
 - M1 reviewer backlog: add schema-drift, duplicate/reordered-row, and malformed-vintage regression fixtures.
@@ -34,4 +35,6 @@
 - BOT source live fetch parsed 138 monthly periods and persisted raw HTML plus normalized snapshot.
 - Data-health reports `source_mode=bot`, `status=provisional`, and `replayable=true`.
 - Live vintage replay returned the same theme surprise as the current dashboard summary.
+- Vintage collector preserved one live `vintage_id` with `seen_count=4` and point-in-time API excluded it before `published_at`.
+- Independent M2 review: **PASSED**; no concrete security or logic blockers.
 - Browser visual capture was blocked by Chrome remote-debugging permission; no permission dialog was clicked.