Merge pull request 'docs(website): settle the module loader's trigger and its collision check' (#127) from docs/module-loader into main

Reviewed-on: #127

website/MODULE_SYSTEM.md

@@ -453,9 +453,23 @@ too (API §7.2).
 Exit criterion: `routes.manifest.json` diff is zero lines and every existing test passes. If Phase 2
 changes one URL, it is wrong.
 
-**Progress: PR 1 done** — `installed_modules` and the state machine, with the stored shape and the
-boot rules settled in §2.4 above. No loader, no routes, no boot wiring yet, so it changes nothing an
-operator or a client can see.
+**Progress: PRs 1-2 done.**
+
+- **PR 1** — `installed_modules` and the state machine, with the stored shape and the boot rules
+  settled in §2.4 above.
+- **PR 2** — `server/src/modules/loader.js`: the filesystem scan, manifest validation, prefix and
+  table-name collision rejection, per-module try/catch and the tier mount, behind the §4.5 dispatch
+  guard. Two decisions landed with it, both recorded in [`MODULE_API.md`](MODULE_API.md): the load
+  trigger is **one explicit `modules.load(tierRouters)` call in `app.js`**, never a lazy scan
+  (API §7.6); and the "does core own this prefix" check **probes the live tier routers** rather than
+  a hardcoded table, so it cannot drift when core adds a capability router (API §4.3). The three
+  de-entanglement registries and the two lifecycle hooks throw `not available until phase 2 PR 4/5`
+  rather than no-op — an accepting stub would let a module believe it had registered something.
+  28 tests, all on the failure paths.
+
+There is still no module on the volume, no schema replay and no boot wiring, so this changes nothing
+an operator or a client can see: 842 tests pass and `routes.manifest.json` is unchanged at 229
+routes.
 
 **Phase 3 — Extract `module-uo`.** Moves out of `website/`: the 8 model directories and their 25
 tables; the nine UO `utils/` files plus `newsGump.js`; the 13 router/controller files;