The dashboard was green. Every app reconciled, every commit picked up — on paper. Then a config change just… did not land. No error, no drift warning, no degraded state. The kind of silent failure your monitoring is confident about.

The wrong turn was assuming a live conflict — some controller fighting ArgoCD over the same field. That would at least show up as OutOfSync churn. It did not.

The real cause: a branch merge had quietly reverted an Application’s ignoreDifferences back to a broad /spec ignore and dropped RespectIgnoreDifferences. ArgoCD computed the diff, saw everything it was told to ignore, concluded “nothing to do,” and reported Synced — while applying none of the actual changes. Six days of a no-op pipeline behind a green light.

The lesson that generalizes: “Synced” is a statement about diff, not about reality. A too-broad ignore rule turns your GitOps controller into a very confident no-op. Pin ignoreDifferences to precise jqPathExpressions and keep RespectIgnoreDifferences explicit — a vague ignore is indistinguishable from a working pipeline until the day it matters.

This is exactly the failure class cleta’s signed receipts make visible: every applied change leaves cryptographic proof, so “we synced” and “we actually changed the cluster” stop being the same unverified claim.