diff --git a/.github/workflows/validate-protocol-roundtrip.yml b/.github/workflows/validate-protocol-roundtrip.yml
index 74ea091..9c0df9a 100644
--- a/.github/workflows/validate-protocol-roundtrip.yml
+++ b/.github/workflows/validate-protocol-roundtrip.yml
@@ -73,6 +73,11 @@ jobs:
       - name: Run G6 wire encoder tests
         run: node tests/test-arena-wire-g6.js
 
+      - name: Validate configs/metadata controlled-vocab YAML
+        # These pick-lists are edited in the GitHub UI; a bad indent silently
+        # empties the Arena Studio experimenter dropdown (2026-08-27).
+        run: node tests/test-metadata-yaml.js
+
       - name: Run G6 sequence runner tests
         run: node tests/test-arena-runner-g6.js
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 45dfad6..f00ce17 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -226,9 +226,17 @@ fix flows to every page automatically; two hand-written HTML pages never will.
   `fetchCourseGenotypes` / the generic `fetchCourseVocab(file, key, srcId, apply)`.
   **Any NEW controlled vocab MUST follow this course-first, site-fallback pattern:**
   add a site YAML under `configs/metadata/`, load it in `populateMetaDatalists`, AND
-  add a `fetchCourseVocab(...)` call in `refreshCourseMeta` + seed the file into the
-  course repo root. The course repo (`reiserlab/cshl-2026-course`) is PRIVATE, so
-  the course override needs a token; the site files are same-origin (always work).
+  add a `fetchCourseVocab(...)` call in `refreshCourseMeta`, ADD THE FILENAME TO
+  `READABLE_EXACT` in `js/studio-github.js` (the read allowlist — a miss throws inside
+  the loader's try/catch and the override silently falls back; that is exactly how
+  ages/sexes/fly_numbers were broken until v0.70), + seed the file into the repo root.
+  The course override runs only when a token is stored (token + repo = "course-repo
+  mode") even though `reiserlab/cshl-2026-course` has been PUBLIC since 2026-08; the
+  site files are same-origin (always work). `configs/metadata/*.yaml` are parsed by
+  `tests/test-metadata-yaml.js` (pixi + CI) because they get edited in the GitHub UI.
+  Token types: org members use a fine-grained PAT scoped to the one repo; the shared
+  course guest account (`cshl-2026`, an outside collaborator) can only use a CLASSIC
+  token — see `docs/development/data-repo-token-runbook.md`.
 - **Session rig (#135, v0.4):** `Studio.currentRig` (`{name, arenaConfig,
   explicit}`) is THE bench rig for all three views — one top-bar selector,
   locked by default. Always change it via the module block's
diff --git a/arena_studio.html b/arena_studio.html
index 4cd933d..9a14e24 100644
--- a/arena_studio.html
+++ b/arena_studio.html
@@ -2917,7 +2917,7 @@ <h2 id="modalTitle">Import error</h2>
 </div>
 
 <footer id="footer">
-  <span class="foot-left">Arena Studio v0.69 | 2026-07-21 16:46 ET · <a href="https://github.com/reiserlab/webDisplayTools" target="_blank" rel="noopener" title="webDisplayTools on GitHub: source, issues, and release notes (docs/development/arena-studio-release-notes.md)">GitHub</a></span>
+  <span class="foot-left">Arena Studio v0.70 | 2026-09-04 12:14 ET · <a href="https://github.com/reiserlab/webDisplayTools" target="_blank" rel="noopener" title="webDisplayTools on GitHub: source, issues, and release notes (docs/development/arena-studio-release-notes.md)">GitHub</a></span>
   <!-- Course-repo quick-links: open protocols / logs / patterns in a new tab.
        Hrefs built from the configured repo + bench id (updateGhQuickLinks). -->
   <span id="ghQuickLinks" title="Open the course repo on GitHub (new tab)">
@@ -8184,13 +8184,19 @@ <h2 id="modalTitle">Import error</h2>
     e.stopPropagation();
     const signInBtn = $('ghSignInBtn');
     const pat = prompt(
-        'Paste a GitHub fine-grained personal access token for ' + ghTargetRepo().full +
-        '\nFor private read-only access: Contents read. For saving: Contents read/write' +
-        ' + Pull requests read/write. Public protocol/replay reads need no token.\n\n' +
+        'Paste a GitHub personal access token for ' + ghTargetRepo().full + '\n\n' +
+        'Lab / org members: a FINE-GRAINED token — Resource owner = the repo\'s org, ' +
+        'Only select repositories = this repo, Contents: Read and write (Pull requests ' +
+        'read/write only if you save as PR). Shared course account or outside ' +
+        'collaborators: a CLASSIC token (scope public_repo for a public repo, repo for ' +
+        'a private one) — fine-grained tokens cannot target an org you are not a ' +
+        'member of. Public protocol/replay reads need no token.\n\n' +
         'Stored in sessionStorage (cleared when this tab closes). The follow-up ' +
-        '"remember" option keeps it in localStorage — REQUIRED for course bench ' +
-        'setup (a sessionStorage-only token evaporates when the tab closes); ' +
-        'do NOT use it on a personal shared machine.'
+        '"remember" option keeps it in localStorage — REQUIRED on a dedicated bench/rig ' +
+        'computer (a sessionStorage-only token evaporates when the tab closes); ' +
+        'say NO on a shared or borrowed machine. Tokens expire: when the Studio reports ' +
+        'the stored token is no longer valid, create a new one (see ' +
+        'docs/development/data-repo-token-runbook.md).'
     );
     if (!pat) return;
     const token = pat.trim();
@@ -8392,7 +8398,7 @@ <h2 id="modalTitle">Import error</h2>
             signIn.classList.toggle('gh-signin-while-locked', locked);
             signIn.title = locked
                 ? 'Sign in for course-repo read access; repo, bench, and write settings remain instructor-locked'
-                : 'Sign in to GitHub with a fine-grained personal access token';
+                : 'Sign in to GitHub with a personal access token (fine-grained for org members; classic for the shared course account) — see docs/development/data-repo-token-runbook.md';
         }
         if (ghLock) {
             ghLock.textContent = locked ? '🔒' : '🔓';
@@ -14882,7 +14888,7 @@ <h2 id="modalTitle">Import error</h2>
     '#fmOpenCourse': 'Open a protocol this bench saved (or one shared with the course) from the course repo.',
     '#fmSave': 'Save the protocol. Where it goes depends on the GitHub settings below — a local file, a Pull Request, or straight to the course repo.',
     '#fmPromote': 'Copy this bench’s saved protocol (and its patterns) to the course’s shared folder so other benches can use it.',
-    '#ghSignInBtn': 'Sign in with a GitHub token so the Studio can read and write the course repo.',
+    '#ghSignInBtn': 'Sign in with a GitHub token so the Studio can read and write the course repo. Tokens expire — if the Studio says the stored token is no longer valid, make a new one and sign in again.',
     '#ghLock': 'Instructor lock — the repo and bench settings stay fixed during a course.',
     '#ghRepoInput': 'The GitHub repo saves go to (owner/name).',
     '#ghBenchId': 'This bench’s name — saves and run logs are filed under it.',
diff --git a/configs/metadata/people.yaml b/configs/metadata/people.yaml
index 093de46..e03931d 100644
--- a/configs/metadata/people.yaml
+++ b/configs/metadata/people.yaml
@@ -13,5 +13,5 @@ people:
     name: "Hannah Santos"
   - id: loeschef
     name: "Frank Loesche"
- - id: shubhamTR
+  - id: shubhamTR
     name: "Shubham Rathore"
diff --git a/course/cshl-2026/docs/arena-studio.md b/course/cshl-2026/docs/arena-studio.md
index be3c556..0af2145 100644
--- a/course/cshl-2026/docs/arena-studio.md
+++ b/course/cshl-2026/docs/arena-studio.md
@@ -82,8 +82,9 @@ format is:
 - `&advanced=0` forces safe mode on a shared machine.
 - These links always open in the **Run** view.
 
-Loading a protocol from the private course repo needs you to be **signed in to
-GitHub once** on that browser (File ▾ → GitHub). After that, the link just works.
+Loading a protocol from the course repo works signed-out now that the repo is
+public; saving to it still needs the bench to be **signed in to GitHub once** on that
+browser (File ▾ → GitHub). After that, the link just works.
 
 ## What safe mode blocks
 
diff --git a/course/cshl-2026/docs/github-overview.md b/course/cshl-2026/docs/github-overview.md
index 01c8f49..86af02e 100644
--- a/course/cshl-2026/docs/github-overview.md
+++ b/course/cshl-2026/docs/github-overview.md
@@ -16,10 +16,11 @@ each other's data.
 
 ## The course repo
 
-Everything lives in one repository: **`reiserlab/cshl-2026-course`** (private —
-you need to be added, and Arena Studio needs to be signed in once per browser).
+Everything lives in one repository: **`reiserlab/cshl-2026-course`** (public since
+August 2026 — anyone can read it; writing from Arena Studio still needs the bench to
+be signed in once per browser).
 
-Each of the 7 bench rigs has a **bench id** (`bench00`, `bench01`, …). The repo
+Each of the 7 bench rigs has a **bench id** (`bench01` … `bench07`). The repo
 is organized so no two benches ever overwrite each other's files:
 
 ```
diff --git a/dashboard/data-browser/README.md b/dashboard/data-browser/README.md
index e1acf39..f7cc9f4 100644
--- a/dashboard/data-browser/README.md
+++ b/dashboard/data-browser/README.md
@@ -8,7 +8,7 @@ CSHL 2026 course.
 - Opens one or more local JSONL files.
 - Loads a same-origin JSONL URL.
 - Browses a locally served course-repository checkout.
-- Signs in to the private GitHub course repository with the same fine-grained
+- Signs in to the GitHub course repository with the same personal access
   personal-access-token flow and storage keys used by Arena Studio.
 - Indexes run metadata without downloading complete runlogs, then loads full
   files only when selected.
@@ -101,9 +101,9 @@ relative-heading pages instead of failing import.
 
 ## Public page, private data
 
-The dashboard itself can be public while its URL is distributed through private
-course documentation. Private runlogs remain in
-`reiserlab/cshl-2026-course`.
+The dashboard itself is public. Runlogs live in `reiserlab/cshl-2026-course`,
+which was private during the course and has been public since 2026-08 (reads work
+signed-out; writes still need a token).
 
 The sign-in flow uses:
 
@@ -112,8 +112,10 @@ The sign-in flow uses:
 - `Authorization: Bearer <token>` headers to `api.github.com`
 
 The token is never placed in a URL, request body, runlog, CSV export, or console
-message. The course token should be a fine-grained PAT restricted to the course
-repository with Contents read/write access, matching Arena Studio.
+message. The shared course token is a **classic** PAT from the `cshl-2026` guest
+account (scope `public_repo`); lab members use a fine-grained PAT scoped to the one
+repo with Contents read/write — matching Arena Studio. See
+`docs/development/data-repo-token-runbook.md`.
 
 The dashboard currently performs read operations only. Write permission is
 retained on the shared course token so the same sign-in remains compatible with
diff --git a/dashboard/data-browser/github-repo.js b/dashboard/data-browser/github-repo.js
index ed7bb3f..c29a974 100644
--- a/dashboard/data-browser/github-repo.js
+++ b/dashboard/data-browser/github-repo.js
@@ -124,7 +124,7 @@
     async function signIn(repoValue) {
         const repo = parseRepo(repoValue || currentRepo());
         const pat = prompt(
-            `Paste a GitHub fine-grained personal access token for ${repo.full}.\n` +
+            `Paste a GitHub personal access token for ${repo.full} (fine-grained for org members; classic for the shared course account).\n` +
                 'The course token should have Contents read/write access.\n\n' +
                 'It is stored in sessionStorage first. The next prompt can remember it on this browser.'
         );
diff --git a/docs/development/arena-studio-release-notes.md b/docs/development/arena-studio-release-notes.md
index c0478fe..bb0bc1a 100644
--- a/docs/development/arena-studio-release-notes.md
+++ b/docs/development/arena-studio-release-notes.md
@@ -4,6 +4,25 @@ The Studio's footer used to carry the full changelog inline; it now shows one li
 history lives here. Newest first. (Per-session engineering detail stays in
 `arena-studio-handover.md` and the design docs — this file is the user-facing what-changed list.)
 
+## v0.70 (2026-09-04) · Metadata pick-lists restored; course age/sex/fly# lists load; token guidance
+
+- **The Experimenter dropdown is populated again when no data repo is signed in.**
+  A GitHub-UI edit to the site library's `configs/metadata/people.yaml` (2026-08-27)
+  left an indentation error; the Studio swallowed the parse failure and showed an
+  empty list, which blocked recorded runs. Fixed, and the metadata files are now
+  parsed in the test suite and CI so a bad edit fails loudly.
+- **Fly age / sex / fly-number lists now really load from the connected repo.** The
+  read allowlist only permitted `roster.yaml` and `genotypes.yaml`, so the three other
+  root vocab files were refused and the site list was silently kept. The opt-in
+  post-run SD pattern archive (`pattern-sets/…`) was blocked by the write allowlist the
+  same way; both are allowed now.
+- **Sign-in text explains which token to use.** Org members: a fine-grained token
+  scoped to the one repo (Contents read/write). Shared course account / outside
+  collaborators: a classic token (`public_repo` for a public repo) — GitHub does not let
+  a non-member own a fine-grained token for an org repo. Also says what an expired token
+  looks like and where the renewal runbook is
+  (`docs/development/data-repo-token-runbook.md`).
+
 ## v0.69 (2026-07-21) · ISP batch retries a failed panel twice
 
 - **A failed panel flash now gets up to two retries** (was one) before being
diff --git a/docs/development/cshl-pipeline-test-plan.md b/docs/development/cshl-pipeline-test-plan.md
index 4e3194c..2d7715d 100644
--- a/docs/development/cshl-pipeline-test-plan.md
+++ b/docs/development/cshl-pipeline-test-plan.md
@@ -81,30 +81,44 @@ in one place and its writes are attributed to a course identity.
 - Org note: if `reiserlab` restricts outside collaborators, an org owner may
   need to approve the invite first.
 
-**1c. Generate the shared fine-grained PAT** (signed in as `cshl-2026`)
-1. Settings → Developer settings → **Fine-grained tokens** → **Generate new
-   token**.
-2. **Token name**: `cshl-2026-benches`.
-3. **Expiration**: set it to just past the course (e.g. the Monday after) so a
-   forgotten token can't linger.
-4. **Resource owner**: `cshl-2026` (the guest account itself).
-5. **Repository access** → **Only select repositories** →
-   `reiserlab/cshl-2026-course`. (If the repo isn't listed, the invite in
-   1b wasn't accepted yet.)
-6. **Permissions** → Repository permissions → **Contents: Read and write**
-   (leave everything else "No access"). Metadata auto-selects read-only —
-   that's fine.
-7. Generate; **copy the `github_pat_…` string now** (shown once). Store it in
-   the shared inbox / a password manager.
-8. This single token is what you paste into each bench in P3. Students never
+**1c. Generate the shared token — it must be a CLASSIC token** (signed in as
+`cshl-2026`)
+
+> **Correction (2026-09-04).** An earlier version of this step described a
+> *fine-grained* token. That cannot work here: `cshl-2026` is an *outside
+> collaborator* of `reiserlab`, and GitHub only lets a fine-grained token name
+> an organization as resource owner when the token's owner is an org *member*
+> ("Only personal access tokens (classic) have write access for public
+> repositories that are not owned by you"). Do NOT make the guest account an
+> org member to work around this — the org grants members write on every repo.
+> The course token that ran the 2026 course was a classic token. Full recipe
+> and the lab-member (fine-grained) alternative:
+> `docs/development/data-repo-token-runbook.md`.
+
+1. Settings → Developer settings → **Personal access tokens → Tokens (classic)**
+   → **Generate new token (classic)**.
+2. **Note**: `cshl-2026-benches`.
+3. **Expiration**: pick a date and put it in the calendar. For the course, just
+   past the course (e.g. the Monday after) so a forgotten token can't linger;
+   for ongoing post-course use, ≤ 1 year.
+4. **Scopes**: `reiserlab/cshl-2026-course` is **public** (since 2026-08), so tick
+   only **`public_repo`** (read/write code on public repos). Only if the repo is
+   ever made private again would the full **`repo`** scope be needed.
+5. Generate; **copy the `ghp_…` string now** (shown once). Store it in the lab
+   password manager. (The account itself was registered to Michael's Janelia
+   address, not a separate shared inbox — password resets go there.)
+6. This single token is what you paste into each bench in P3. Students never
    see it.
 
-**1d. Revoke path** (know it before the course): signed in as `cshl-2026` →
-Developer settings → Fine-grained tokens → the token → **Revoke**. All benches
-stop writing immediately; issue a new one and re-paste per P3.
+**1d. Revoke / renew path**: signed in as `cshl-2026` → Developer settings →
+Tokens (classic) → the token → **Delete** (or **Regenerate** to get a new value
+with a new expiry). All benches stop writing immediately — the Studio shows
+"The stored GitHub token is no longer valid. Sign in again from File ▾." on the
+next load — issue a new one and re-paste per P3.
 
 ### P2. Repo — DONE
-- `reiserlab/cshl-2026-course` exists (private), seeded with `README.md`,
+- `reiserlab/cshl-2026-course` exists (private during the course; made **public**
+  in 2026-08 — reads no longer need a token, writes still do), seeded with `README.md`,
   `roster.yaml` (test entries: michael/frank/isabel/hannah_marie + guest) and a
   course `genotypes.yaml` (lab set + wild-type + none), plus the
   `protocols/shared/` + `runlogs/` skeleton. Edit `roster.yaml` for the real
diff --git a/docs/development/data-repo-token-runbook.md b/docs/development/data-repo-token-runbook.md
new file mode 100644
index 0000000..871879a
--- /dev/null
+++ b/docs/development/data-repo-token-runbook.md
@@ -0,0 +1,86 @@
+# Data-repo tokens — renewal and setup runbook
+
+Arena Studio, the Pattern Designer and the data-browser dashboard write protocols,
+patterns and run logs to a GitHub **data repo** (the CSHL course repo today; the lab's
+`reiserlab/arena-experiments` next) using a personal access token pasted once per
+browser (File ▾ → GitHub → **Sign in…**). The token is stored in that browser only
+(`studio_gh_pat`, sessionStorage or localStorage) and sent only as an
+`Authorization` header. This page is the operational how-to; design background is in
+`studio-github-save-proposal.md`, the course-week checklist in
+`cshl-pipeline-test-plan.md`.
+
+## Which token type — the one rule
+
+| Who | Token type | Why |
+|---|---|---|
+| A `reiserlab` **org member** (lab members, incl. Michael) | **Fine-grained** PAT, resource owner `reiserlab`, only the repo(s) needed, *Contents: Read and write* | Narrowest possible scope; expires; attributed to the person |
+| The shared course guest account **`cshl-2026`** (an *outside collaborator*) | **Classic** PAT, scope **`public_repo`** (the course repo is public) | GitHub only lets a fine-grained token target an org when the token owner is an org *member*. Never make the guest an org member — the org grants members write on every repo |
+| Any other non-member collaborator on a **private** data repo | Classic PAT, scope `repo` | Same reason; `public_repo` cannot see private repos |
+
+What an expired or revoked token looks like: on the next page load the Studio shows
+**"The stored GitHub token is no longer valid. Sign in again from File ▾."** and drops
+the stored token; a save or run-log commit made with a dead token falls back to
+"saved locally". Nothing else breaks — reads of a public repo keep working signed-out.
+
+## A. Renew the shared course token (guest account `cshl-2026`)
+
+1. Sign in to GitHub as `cshl-2026`. The account was registered on 2026-07-04 to
+   Michael's Janelia address (its commits carry `reiserm@janelia.hhmi.org`), so a
+   forgotten password is reset via <https://github.com/password_reset> with that
+   address, and any 2FA recovery codes were saved by whoever set it up (check the
+   password manager / the 2026-07-04 GitHub emails). Sign out of your own account
+   or use a private window first — GitHub keeps one session per browser profile.
+2. Settings → Developer settings → Personal access tokens → **Tokens (classic)**.
+   Delete the expired `cshl-2026-benches` token (or **Regenerate** it — same effect,
+   new value).
+3. **Generate new token (classic)**: Note `cshl-2026-benches`, **Expiration** = a date
+   you put in the calendar (≤ 1 year), scopes = **`public_repo` only**. Copy the
+   `ghp_…` value once; store it in the lab password manager.
+4. On each bench browser (served from `http://127.0.0.1:8000/`, not `file://`):
+   File ▾ → **Sign in…** → paste → **YES** to "Remember this token" → 🛡 advanced
+   (instructor password) → 🔓 in the GitHub block → **Repo** `reiserlab/cshl-2026-course`,
+   **Bench id** `bench01`…`bench07` (must match `roster.yaml`), tick **Commit
+   directly to default branch** → 🔒. Connect the arena; the roster pre-fills the
+   experimenter.
+5. Check: the run log shows `ages list from the course repo (… 5 entries)` and no
+   "unreadable" lines; a test save lands in `protocols/<bench-id>/`.
+
+## B. Lab member recipe (the recommendation going forward)
+
+1. GitHub → Settings → Developer settings → Personal access tokens →
+   **Fine-grained tokens** → **Generate new token**.
+2. Name it after the machine (`rig-3e229-a` or `laptop`), **Expiration** ≤ 366 days
+   (calendar reminder), **Resource owner = `reiserlab`** (if `reiserlab` is missing you
+   are not an org member — ask Michael to add you, or use a classic token per row 3).
+3. **Repository access → Only select repositories** → `reiserlab/arena-experiments`
+   (add `reiserlab/cshl-2026-course` only if you still write there).
+4. **Repository permissions → Contents: Read and write**. Metadata read is added
+   automatically. Add *Pull requests: Read and write* only if you use "Save as Pull
+   Request" against `reiserlab/webDisplayTools`. Nothing else.
+5. Generate. If the org policy requires approval, the token is pending until an org
+   owner approves it (Organization settings → Personal access tokens → Pending
+   requests). Copy the `github_pat_…` value once.
+6. In the Studio: File ▾ → **Sign in…** → paste. Answer **YES** to "Remember" only on a
+   rig computer you control or your own laptop; answer **NO** (session-only) on a
+   shared or borrowed machine. **Sign out** clears the token everywhere.
+7. Set **Repo** and your **Rig id** once (🔓 needed); saves go to `protocols/<rig-id>/`,
+   run logs to `runlogs/<rig-id>/`, and your commits carry your GitHub identity.
+
+Sharing across the lab needs no extra permission: everyone with a token sees every
+rig's folder, **File ▾ → Promote to shared…** copies a protocol and its patterns into
+`protocols/shared/`, and the Pattern Designer's **Save to Repo → library** writes the
+root `patterns/` library.
+
+## C. Org-owner checklist (Michael)
+
+- **PAT policy**: Organization settings → Third-party access → Personal access
+  tokens. Confirm fine-grained tokens are allowed; choose "no approval required" for
+  members or approve each request. Optionally set a maximum lifetime.
+- **New private data repo**: no branch protection on the default branch (the Studio
+  commits straight to it). Org members already have write via the org default
+  (`default_repository_permission = write`); invite non-members per repo.
+- **Someone leaves**: remove them from the org (or the repo) — their tokens lose
+  access immediately. For the shared guest account, delete/regenerate its classic
+  token (§A) so every bench stops writing at once.
+- **Never** ask for a token in a URL, issue, chat, or run log; the Studio only ever
+  sends it as an `Authorization` header.
diff --git a/js/studio-github.js b/js/studio-github.js
index 8d9d20b..73aacc7 100644
--- a/js/studio-github.js
+++ b/js/studio-github.js
@@ -16,15 +16,21 @@
  *      PUT  /repos/{o}/{r}/contents/{path}      → create/update file on the branch
  *   5. POST /repos/{o}/{r}/pulls                → open the PR
  *
- * DIRECT-COMMIT flow (course-data repos, CSHL pipeline): directCommit() skips
- * the branch + PR — GET /repos (default_branch) → GET contents (sha) → PUT on
- * the default branch. Safe there because RIG-ID namespacing means no two rigs
- * write the same file.
+ * DIRECT-COMMIT flow (data repos — the CSHL course repo or a lab repo such as
+ * reiserlab/arena-experiments): directCommit() skips the branch + PR — GET
+ * /repos (default_branch) → GET contents (sha) → PUT on the default branch.
+ * Safe there because bench/rig-id namespacing means no two rigs write the
+ * same file.
  *
  * Security: the token lives ONLY in the Authorization header — never in a URL,
- * never in the body. Writable paths are allowlisted to protocols/, runlogs/,
- * and configs/metadata/ (mirrors the URL-state path-traversal guard); reads
- * additionally allow the course repo's root-level roster.yaml.
+ * never in the body. Writable paths are allowlisted (WRITABLE_PREFIXES:
+ * protocols/, runlogs/, configs/metadata/, patterns/, pattern-sets/ — mirrors
+ * the URL-state path-traversal guard); reads additionally allow the data
+ * repo's root-level controlled-vocabulary YAMLs (READABLE_EXACT: roster,
+ * genotypes, ages, sexes, fly_numbers). Keep BOTH lists in sync with every
+ * path the Studio reads/writes — a miss throws inside a try/catch and shows up
+ * only as a "… unreadable" / "… skipped" log line (that is how the age/sex/
+ * fly-number course override silently failed until 2026-09).
  *
  * LOADING: classic <script src> (window-global + CommonJS dual-export, no ES `export`).
  */
@@ -33,11 +39,25 @@
 
     const API = 'https://api.github.com';
     const API_VERSION = '2022-11-28';
-    // patterns/ = the shared pattern library (Pattern Designer "Save to Repo").
-    const WRITABLE_PREFIXES = ['protocols/', 'runlogs/', 'configs/metadata/', 'patterns/'];
-    // Read-only extras: exact root paths readable but never writable — the
-    // course roster + genotype vocabulary (instructor-edited on GitHub).
-    const READABLE_EXACT = ['roster.yaml', 'genotypes.yaml'];
+    // patterns/ = the shared pattern library (Pattern Designer "Save to Repo");
+    // pattern-sets/<hash>/patterns.zip = the opt-in post-run SD snapshot.
+    const WRITABLE_PREFIXES = [
+        'protocols/',
+        'runlogs/',
+        'configs/metadata/',
+        'patterns/',
+        'pattern-sets/'
+    ];
+    // Read-only extras: exact root paths readable but never writable — the data
+    // repo's controlled vocabularies (roster/genotypes/ages/sexes/fly_numbers),
+    // edited on GitHub. MUST list every file Studio.refreshCourseMeta() reads.
+    const READABLE_EXACT = [
+        'roster.yaml',
+        'genotypes.yaml',
+        'ages.yaml',
+        'sexes.yaml',
+        'fly_numbers.yaml'
+    ];
 
     // UTF-8-safe base64 (Node Buffer or browser btoa+encodeURIComponent).
     function b64(text) {
diff --git a/pixi.toml b/pixi.toml
index efce9ac..7e3557b 100644
--- a/pixi.toml
+++ b/pixi.toml
@@ -16,7 +16,7 @@ serve = "python -m http.server 8000 --bind 127.0.0.1"
 # The full test suite. yaml is vendored (js/vendor/yaml), so no package install.
 # The v3 suite pulls in ESM modules that `import 'yaml'`; --import maps that bare
 # specifier to the vendored copy (tests/vendor-yaml.register.mjs).
-test = "node tests/validate-arena-calculations.js && node tests/test-protocol-roundtrip.js && node --import ./tests/vendor-yaml.register.mjs tests/test-protocol-roundtrip-v3.js && node --import ./tests/vendor-yaml.register.mjs tests/test-runtime-controls.js && node tests/test-plugin-registry.js && node tests/test-arena-wire-g6.js && node tests/test-arena-link.js && node tests/test-arena-runner-g6.js && node tests/test-arena-session.js && node tests/test-fictrac-bridge-client.js && node tests/test-run-log.js && node tests/test-bin-classifier.js && node tests/test-pattern-set.js && node tests/test-pat-preview.js && node tests/test-studio-meta.js && node tests/test-studio-url-state.js && node tests/test-studio-runlog-adapter.js && node tests/test-studio-github.js && node tests/test-studio-canmutate.js && node tests/test-studio-protocols-index.js && node tests/test-g6-tall-rigs.js && node tests/test-arena-studio-alt.js && node tests/test-three-viewer-led-glow.js && node tests/test-three-viewer-preview-omissions.js && node tests/test-arena-replay-viewer-protocol.js && node tests/test-kinematics.js && node tests/test-runlog-replay.js && python tests/test-bridge-behavior.py"
+test = "node tests/validate-arena-calculations.js && node tests/test-protocol-roundtrip.js && node --import ./tests/vendor-yaml.register.mjs tests/test-protocol-roundtrip-v3.js && node --import ./tests/vendor-yaml.register.mjs tests/test-runtime-controls.js && node tests/test-plugin-registry.js && node tests/test-arena-wire-g6.js && node tests/test-arena-link.js && node tests/test-arena-runner-g6.js && node tests/test-arena-session.js && node tests/test-fictrac-bridge-client.js && node tests/test-run-log.js && node tests/test-bin-classifier.js && node tests/test-pattern-set.js && node tests/test-pat-preview.js && node tests/test-studio-meta.js && node tests/test-studio-url-state.js && node tests/test-studio-runlog-adapter.js && node tests/test-studio-github.js && node tests/test-studio-canmutate.js && node tests/test-studio-protocols-index.js && node tests/test-g6-tall-rigs.js && node tests/test-arena-studio-alt.js && node tests/test-three-viewer-led-glow.js && node tests/test-three-viewer-preview-omissions.js && node tests/test-arena-replay-viewer-protocol.js && node tests/test-kinematics.js && node tests/test-runlog-replay.js && node tests/test-metadata-yaml.js && python tests/test-bridge-behavior.py"
 format = "prettier --write \"**/*.js\""
 format-check = "prettier --check \"**/*.js\""
 
diff --git a/tests/test-arena-studio-alt.js b/tests/test-arena-studio-alt.js
index 747ebe7..26f8003 100644
--- a/tests/test-arena-studio-alt.js
+++ b/tests/test-arena-studio-alt.js
@@ -585,7 +585,9 @@ check(
         alt.includes("const ALT_BUILD_STAMP = '2026-07-13 18:55 ET';") &&
         alt.includes("stampNode.nodeValue = ALT_TOOL_VERSION + ' | ' + ALT_BUILD_STAMP + ' · ';") &&
         alt.includes('Studio.TOOL_VERSION = ALT_TOOL_VERSION;') &&
-        studio.includes('Arena Studio v0.69 | 2026-07-21 16:46 ET')
+        // Classic footer keeps its own version/stamp line (shape, not a pinned
+        // literal — the Classic footer is bumped on every Studio edit).
+        /Arena Studio v0\.\d+ \| \d{4}-\d{2}-\d{2} \d{2}:\d{2} ET · /.test(studio)
 );
 
 console.log('=== scoped presentation ===');
diff --git a/tests/test-metadata-yaml.js b/tests/test-metadata-yaml.js
new file mode 100644
index 0000000..79e637f
--- /dev/null
+++ b/tests/test-metadata-yaml.js
@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * Guard for configs/metadata/*.yaml — the site-library controlled vocabularies
+ * (experimenter / genotype / age / sex / fly-number pick-lists) that Arena Studio
+ * loads at page start (populateMetaDatalists) and falls back to whenever no data
+ * repo is signed in.
+ *
+ * Why: these files are edited in the GitHub web UI. A one-space indent slip in
+ * people.yaml (2026-08-27) made the vendored YAML parser throw; the Studio's
+ * loadVocab() swallows parse errors, so the ONLY symptom was an empty Experimenter
+ * dropdown — which blocks recorded runs. Nothing in CI parsed these files.
+ *
+ * Parses each file with the SAME vendored `yaml` build the browser uses and checks
+ * the expected top-level key holds a non-empty list of the expected shape.
+ *
+ * Run: node tests/test-metadata-yaml.js   (wired into `pixi run test` + CI)
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const META_DIR = path.join(__dirname, '..', 'configs', 'metadata');
+// file → { key, shape }. shape 'people' = [{id,name}], 'strings' = non-empty
+// scalars (numbers allowed for fly_numbers).
+const EXPECTED = {
+    'people.yaml': { key: 'people', shape: 'people' },
+    'genotypes.yaml': { key: 'genotypes', shape: 'strings' },
+    'ages.yaml': { key: 'ages', shape: 'strings' },
+    'sexes.yaml': { key: 'sexes', shape: 'strings' },
+    'fly_numbers.yaml': { key: 'fly_numbers', shape: 'strings' }
+};
+
+let totalChecks = 0;
+let failures = 0;
+function check(name, ok, info) {
+    totalChecks++;
+    console.log(`  ${ok ? 'PASS' : 'FAIL'}  ${name}${info ? ' — ' + info : ''}`);
+    if (!ok) failures++;
+}
+
+(async () => {
+    // The browser build is ESM; dynamic import works from CommonJS on Node >= 22.12.
+    const mod = await import('../js/vendor/yaml/browser/dist/index.js');
+    const YAML = mod.default || mod;
+
+    const files = fs.readdirSync(META_DIR).filter((f) => /\.ya?ml$/i.test(f));
+    console.log('=== configs/metadata/*.yaml parse + shape ===');
+    for (const f of files) {
+        const exp = EXPECTED[f];
+        check(f + ' is a known vocab file', !!exp, exp ? '' : 'add it to EXPECTED in this test');
+        if (!exp) continue;
+        let data = null;
+        let err = null;
+        try {
+            data = YAML.parse(fs.readFileSync(path.join(META_DIR, f), 'utf8'));
+        } catch (e) {
+            err = e;
+        }
+        check(f + ' parses', !err, err ? String(err.message).split('\n')[0] : '');
+        if (err) continue;
+        const list = data && data[exp.key];
+        check(f + ' has non-empty `' + exp.key + ':` list', Array.isArray(list) && list.length > 0);
+        if (!Array.isArray(list)) continue;
+        if (exp.shape === 'people') {
+            const bad = list.filter((p) => !p || typeof p !== 'object' || !p.id || !p.name);
+            check(
+                f + ' entries all have id + name',
+                bad.length === 0,
+                bad.length ? JSON.stringify(bad[0]) : ''
+            );
+            const ids = list.map((p) => p && p.id);
+            check(f + ' ids unique', new Set(ids).size === ids.length);
+        } else {
+            const bad = list.filter(
+                (v) => !(typeof v === 'string' ? v.trim() : Number.isFinite(v))
+            );
+            check(
+                f + ' entries are non-empty scalars',
+                bad.length === 0,
+                bad.length ? JSON.stringify(bad[0]) : ''
+            );
+        }
+    }
+    for (const f of Object.keys(EXPECTED)) {
+        check(f + ' exists', files.includes(f));
+    }
+
+    console.log('\n=== Summary ===');
+    console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
+    process.exit(failures ? 1 : 0);
+})();
diff --git a/tests/test-studio-github.js b/tests/test-studio-github.js
index 93e346a..dae3d4e 100644
--- a/tests/test-studio-github.js
+++ b/tests/test-studio-github.js
@@ -92,6 +92,23 @@ check('other dir still blocked', G.isAllowedReadPath('js/evil.js'), false);
 check('nested roster blocked', G.isAllowedReadPath('secrets/roster.yaml'), false);
 check('genotypes NOT writable', G.isAllowedPath('genotypes.yaml'), false);
 check('traversal blocked', G.isAllowedReadPath('roster.yaml/../js/evil.js'), false);
+// Every root vocab file Studio.refreshCourseMeta() reads must be readable (a miss
+// throws inside its try/catch and the course override silently falls back).
+for (const f of ['ages.yaml', 'sexes.yaml', 'fly_numbers.yaml']) {
+    check(f + ' readable', G.isAllowedReadPath(f), true);
+    check(f + ' NOT writable', G.isAllowedPath(f), false);
+}
+check(
+    'pattern-sets snapshot writable',
+    G.isAllowedPath('pattern-sets/0123abcd/patterns.zip'),
+    true
+);
+check(
+    'pattern-sets snapshot readable (dedup)',
+    G.isAllowedReadPath('pattern-sets/0123abcd/patterns.zip'),
+    true
+);
+check('bare pattern-sets dir listable', G.isAllowedReadPath('pattern-sets'), true);
 
 // ── branch naming ────────────────────────────────────────────────────────────
 console.log('=== branchName ===');