fix: per-AID version queries - module->applet mapping + chained GET RESPONSE (v3.7.1)

Two bugs in the v3.7.0 per-AID fallback, both visible in the live log
(2026-09-30 11:21):

- the candidate applet was searched by the AID prefix, but the applet
  instance AIDs are the package's module AIDs (package A113...0200 has
  modules ...0208 / ...494D4508, both present as applet instances - they
  differ from the package AID in the last byte), so that package produced no
  query at all.  ramElfAppletCandidate (pure) prefers the module AIDs and
  keeps the shared-prefix rule as a fallback;
- the single-AID expanded query answered 6134 (the card holds the data) and
  the empty response was read, so no version was derived.  The query is now
  retried with the GET RESPONSE chained into the compact command string
  (ramChainGetResponse) exactly like the ladder - a standalone GET RESPONSE
  answers 6700 on this card.

Tests: the module->applet mapping with the live AIDs (incl. the versioned
applet being skipped and the prefix fallback), plus the source guards for the
chained retry.

sw cache simple-v333; tests: 557 Python / 717 Node.

frontend/index.html

@@ -1750,7 +1750,7 @@
 // ===== Version =====
 // Single source of truth for the PWA version: shown in the header and used
 // by the server version check in pysimConnect().
-const SIMPLE_VERSION = '3.7.0';
+const SIMPLE_VERSION = '3.7.1';
 document.getElementById('app-version').textContent = 'v' + SIMPLE_VERSION;
 
 // ===== Tab switching =====
@@ -9257,6 +9257,22 @@ function ramElfVersionHint(elfForm) {
 	return t('Package versions come from the expanded registry query \u2014 this card did not return them.');
 }
 
+// The applet instance that belongs to a package (pure).  The package's module
+// AIDs are the applet instance AIDs - they can differ from the package AID in
+// the last byte (live 2026-09-30: package A113...0200 with modules ...0208 /
+// ...494D4508, all present as applet instances); a shared AID prefix is the
+// fallback rule.  Applets that already carry a version are skipped.
+function ramElfAppletCandidate(elf, apps) {
+	if (!elf || !elf.aid) return null;
+	const cands = (elf.moduleAids || []).concat([elf.aid])
+		.map(c => String(c).toUpperCase());
+	const list = (apps || []).filter(a => a && a.aid && !a.version);
+	const exact = list.find(a => cands.indexOf(String(a.aid).toUpperCase()) >= 0);
+	if (exact) return exact;
+	const pkg = String(elf.aid).toUpperCase();
+	return list.find(a => String(a.aid).toUpperCase().indexOf(pkg) === 0) || null;
+}
+
 // Fill a missing ELF version from an application entry: cards commonly return
 // the load file version (CE) on the app entry together with its package AID
 // (C4), so the package's version can be read from its applet instance (live
@@ -9668,21 +9684,35 @@ async function ramExplore(sp) {
 	// Still missing versions: query the apps listing once per applet AID (the
 	// AID search qualifier selects one entity).  The apps tag list works even
 	// where the ELF one is refused, and an applet's CE is its package's
-	// version - the applet <-> package mapping is the AID prefix (v3.7.0).
+	// version - the applet instance AIDs are the package's module AIDs
+	// (ramElfAppletCandidate).  The single-AID form answers 61xx (the card
+	// holds the data), so it is retried with the GET RESPONSE chained into the
+	// compact command string, like the ladder (v3.7.1).
 	async function elfPerAidVersions() {
 		const missing = elfs.filter(e => !e.version && e.aid);
 		for (const e of missing.slice(0, 6)) {
 			if (cntrLow) break;
-			const app = apps.find(a => a.aid && !a.version &&
-				String(a.aid).toUpperCase().indexOf(String(e.aid).toUpperCase()) === 0);
+			const app = ramElfAppletCandidate(e, apps);
 			if (!app) continue;
 			ramShowProgress(t('Version') + ' ' + e.aid + '...');
-			const res = await sendOta(ramExpandedQueryApdu('40', 'tags', false, app.aid),
-				Object.assign({}, sp, { cntr, spi2: ramListingSpi2('40') }));
-			if (res.ram_format) sp.ram_format = res.ram_format;
-			if (res.final_cntr) cntr = res.final_cntr;
-			else if (res.success && spPorAccepted(res.por)) cntr = ramIncrementCntr(cntr);
+			const apdu = ramExpandedQueryApdu('40', 'tags', false, app.aid);
+			const send = async a => {
+				const res = await sendOta(a, Object.assign({}, sp, { cntr, spi2: ramListingSpi2('40') }));
+				if (res.ram_format) sp.ram_format = res.ram_format;
+				if (res.final_cntr) cntr = res.final_cntr;
+				else if (res.success && spPorAccepted(res.por)) cntr = ramIncrementCntr(cntr);
+				return res;
+			};
+			let res = await send(apdu);
 			if (!res.success || !res.por || !spPorAccepted(res.por)) continue;
+			let sw = ((res.por.decoded && res.por.decoded.last_status_word) || '').toUpperCase();
+			if (/^61[0-9A-F]{2}$/.test(sw) && sp.ram_format !== 'expanded') {
+				// the card holds the response data: the GET RESPONSE must ride
+				// in the same compact command string (a standalone one answers
+				// 6700 on the live card)
+				res = await send(ramChainGetResponse(apdu));
+				if (!res.success || !res.por || !spPorAccepted(res.por)) continue;
+			}
 			const data = res.por.decoded ? (res.por.decoded.last_response_data || '') : '';
 			const parsed = data ? ramParseAppStatus(data) : [];
 			const hit = parsed.find(x => x.version);