diff --git a/docs/superpowers/specs/2026-10-28-systemic-design-course-design.md b/docs/superpowers/specs/2026-10-28-systemic-design-course-design.md
index 3bf0b3a..59dc9ea 100644
--- a/docs/superpowers/specs/2026-10-28-systemic-design-course-design.md
+++ b/docs/superpowers/specs/2026-10-28-systemic-design-course-design.md
@@ -1,6 +1,6 @@
 # Systemic Game Design Course — Design
 
-Status: **first draft for discussion** (2026-10-28)
+Status: **draft v2, owner answers on hosting and licence included** (2026-10-28)
 Repo: https://gitea.lucaswinther.info/lucasw89/systemic-game-design-course
 Research notes backing every game-rule claim: `docs/research/` (hearthstone.md, baba-is-you.md, architecture-readings.md)
 
@@ -220,7 +220,9 @@ Read `lesson.md` on the site or GitHub-style viewer; Predict answers in a learne
 
 ### 6.8 Website
 - Static docs site generated from `course/**/lesson.md` (no copied content). Rust/TS code shown in tabs. **[my call: Astro Starlight]**
-- Hosting **[open — see §8]**.
+- **Hosting [decided]:** the owner's own website, on its own subdomain, behind the owner's existing nginx-proxy.
+- **Deploy [my call]:** the site builds to static files, served by a small nginx container whose `VIRTUAL_HOST` (and, if the proxy uses its companion, `LETSENCRYPT_HOST`) env vars point at the subdomain, so nginx-proxy picks it up automatically. The subdomain name is a config value **[owner fills in]**.
+- **CI [my call]:** Gitea Actions on the existing Gitea repo. It runs both test suites, both reference solutions, the test-name sync check, the audits on reference code, and a site build. Deploying from CI to the server is **[builder]**: either CI builds and pushes the image, or the owner pulls and runs `docker compose up -d`. The documented manual path ships first.
 
 ## 7. Accuracy policy
 - Every "the real game does X" statement links to a source recorded in `docs/research/` with a quote.
@@ -230,9 +232,11 @@ Read `lesson.md` on the site or GitHub-style viewer; Predict answers in a learne
 - Teikari article quotes and GDC talk speaker attribution are re-verified before publish.
 - Third-party code (Fireplace, SabberStone, Argentum) is linked, not copied; Argentum's licence is unclear.
 
-## 8. Open questions (for the owner)
-1. **Hosting**: where the website is served and which CI runs the checks (Gitea Actions vs a GitHub mirror with Actions/Pages). Decides the CI and deploy workstream.
-2. **Licence and IP stance**: licence for prose vs code; free vs possibly monetised; quote real card text verbatim vs paraphrase. Decides LICENSE files, attribution/disclaimer page and how lessons are written.
+## 8. Licence and IP
+- **Always free. [decided]**
+- **Licence:** the owner allowed MIT or GPL-3.0. **MIT** for everything, prose and code **[my call]**: learners copy reference code into their own engines, and MIT puts no conditions on that.
+- **Real card text may be quoted verbatim. [decided]** The site carries a disclaimer page: not affiliated with Blizzard or Hempuli; Hearthstone and Baba Is You are trademarks of their owners; card text is quoted for educational commentary.
+- Third-party engine code is linked, not copied.
 
 ## 9. Left to the builder
 - Exact numeric test values, card stats for non-real cards, puzzle grid layouts (within §5 constraints).