v2.37.2

v2.37.2

Static-audit fixes: four undefined-name references that silently fell back to defaults instead of erroring — the same bug class as the v2.37.0 confirm-token fix — plus a regression guard so the class stays extinct.

Fixed

• The status://mcp_version resource reported update channel "stable" unconditionally (the guarded call referenced a function that never existed). It now calls the real get_update_channel(), so beta/dev installs report their channel correctly.
• The versioning_auto_run_idle_timeout_seconds preference was silently ignored — the destructive hook called a misspelled preference-reader name inside a try/except, so the auto-run idle timeout was always 90s. Fixed with regression tests covering both the preference and default paths.
• Resolve-state snapshot tokens always fell back to a timestamp because short_hash was never imported into the server namespace; tokens are now content-stable as intended.
• The timeline-kernel live probe's MCP-stub fallback crashed with a NameError (missing types import) exactly in the only case it exists for (mcp library absent).

Added

• A static test that runs pyflakes over src/ and fails on any undefined-name report (skips when pyflakes is not installed). pyflakes is now part of the local dev toolchain.

Validation

• Offline unit suite: 1,022 tests, 0 failures, 0 errors. Static checks clean.
• None of the fixed paths call DaVinci Resolve scripting APIs; no live Resolve behavior changed.