Record API version delivery and validation

docs/implementation.md

@@ -788,3 +788,43 @@ and absence of outgoing bearer metadata over plaintext and optional TLS.
 Resend API key. No email was sent; full product deployment still awaits the API
 key and configured sender. Delivery continues on `dev-env-42` in
 [PR #43](https://git.sendico.io/tech/sxchnge/pulls/43).
+
+## Independently installed product API versions — task #44
+
+[Task #44](https://git.sendico.io/tech/sxchnge/issues/44), branch
+`product-api-44`, is delivered in
+[PR #45](https://git.sendico.io/tech/sxchnge/pulls/45). The PR targets
+`dev-env-42`: merge [PR #43](https://git.sendico.io/tech/sxchnge/pulls/43) into
+`main` first, then retarget #45 to `main` before merging. Owner: `tech`; project:
+SXCHNGE; label: backend.
+
+The product registry explicitly installs v1 and supports independently selected
+future versions through YAML. Runtime owns shared stores, customer/auth/factor
+services and the notification connection; middleware owns HTTP concerns.
+Version-owned transports retain their existing contracts and operate on scoped
+routers with explicit cookie paths and URL providers. Unknown versions and
+invalid, duplicate or overlapping mounts fail startup. Failed installation does
+not publish application routes, and cleanup runs once on failure or shutdown.
+An architecture test prevents generic runtime imports of concrete transports.
+
+Backend review covered the entire task contribution, including transport moves,
+service reuse, DTO/model separation, project errors and structured lifecycle
+logging. Initial focused checks exposed compile references after renaming and a
+missing leading slash in relative route registration; these were fixed. Review
+also tightened mounts to characters safe in both HTTP and cookie paths, validated
+origins, preserved cleanup errors and avoided duplicate shutdown error logging.
+
+Final validation passed: `make test` (backend race tests and all frontend suites),
+`make lint-backend` and `git diff --check`. Tests cover independently behaving
+versions, dependency identity, disabled routes, YAML selection, mount rejection,
+scoped URLs and cookie set/delete, bootstrap/installation failure cleanup and
+concurrent/repeated shutdown. The Mongo-backed default v1 startup and existing
+moved auth/factor contract tests pass. Implementation commit: `d04c8b1`.
+
+Only v1 ships; simultaneous versions are demonstrated with distinct test
+installers. Default v1 paths, JSON and operational URLs remain compatible. No
+database migration is needed. Internal Go composition APIs changed, and moving an
+existing mount requires reauthentication at its new cookie path. Notification
+activation URLs remain configured frontend URLs. No live deployment, optional
+security scans or merge were performed. The unrelated local notifications sender
+configuration remains uncommitted. See [API version installation](api-versions.md).