[Volyarosh94]

What

• After each auto-accept pass, mender_snapshot.py reads the whole fleet from Mender (devauth v2 plus inventory v1, paged at 500, no status filter). It POSTs one snapshot to each target in RETINA_SYNC_TARGETS, following the contract in retina-server's docs/mender-snapshot.md.
• Each POST sends a browser User-Agent, as retina-server's own scripts do, since Cloudflare refuses a script's default one (error 1010). It has a 10 s timeout. One failing target doesn't stop the others, and a 409 counts as delivered. The counts (accepted, rejected, absent) are printed per target. There is no retry queue.
• auto_accept.py only gains the call after main(). Acceptance, deployment and NODE_ID_PREFIX are untouched, and the snapshot itself isn't filtered.
• The README and .env.example document RETINA_SYNC_TARGETS, with test as an optional third target.
• The retina-server side (mirror table, endpoint, MENDER_SOURCE switch, Fleet page) is Mirror Mender's fleet for registration and the admin Fleet page retina-server#683. This one is safe to merge first, because nothing is pushed until RETINA_SYNC_TARGETS is set.

Calls I made

• Auth status follows retina-server's _record, but fails closed where _record would pass junk through. A junk device status (null, empty, not a string), or an accepted set without an id or pubkey, goes out as ambiguous. A missing status key still defaults to accepted. A disagreeing device status is passed through, so registration still refuses it.
• If any Mender page fails, or a page repeats after a full one, nothing is pushed that sweep. A partial fleet would mark real devices absent.
• The snapshot runs after main() even if the pass raises, and never changes the exit code.
• Each target is the full endpoint URL, https only (http for localhost). It is split at the first =, and bad entries are reported by position so a token can't reach the journal. A token or PAT with a space, control or non-ASCII character is refused, so it can't end up in an error line. Redirects are not followed.
• Timestamps go out as UTC whole seconds with Z. The source is mender-auto-accept@<short hostname>.
• An empty node_id is sent as null. Two devices on one node_id are both sent, with a warning.

Tested

pytest: 228 passed (145 new, mocks only), each new rule caught by a broken copy, ruff 0.16.2 and the dead-code hook clean.