The cup board asked for itself and got the gore board

The GET filter spelled its modes out as a literal `[^gzc]` character class, so
`?m=u` sanitised to nothing, fell back to 'g', and the server answered the cup
board's request with the gore board — which the client then printed in the cup
board's words: 7121 kills as LEAGUE 7121. The filter is derived from MODES now,
where the mode list has lived all along.

And the client checks the answer it got: the response names the board it is,
so a server that does not know a board (an old one, mid-deploy) makes the
screen say THIS BOARD IS NOT UP YET instead of mislabelling another board's
rows. Nothing beats something wrong on a leaderboard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server.py

@@ -320,8 +320,12 @@ class Handler(SimpleHTTPRequestHandler):
         if path == '/ws':
             return self.handle_ws()
         if path == '/api/scores':
-            want = re.sub(r'[^gzc]', '', (self.path.split('m=')[1].split('&')[0]
-                                          if 'm=' in self.path else ''))[:1] or 'g'
+            # DERIVED FROM MODES, never spelled out again (2026-08-31): this filter was a literal
+            # `[^gzc]` character class, so the day the cup board was added the server answered its
+            # requests with the GORE board — and the client printed 7121 kills as "LEAGUE 7121".
+            want = (self.path.split('m=')[1].split('&')[0] if 'm=' in self.path else '')[:1]
+            if want not in MODES:
+                want = 'g'                   # an unknown board is the default one, never a new one
             with lock:
                 return self.reply(200, {'m': want,
                                         'scores': public([r for r in load() if mode_of(r) == want])})