Convention: only the root app-of-apps (bootstrap) auto-syncs so it picks up new/changed child Application definitions from Git. Every leaf service app (metallb, metallb-config, envoy-gateway, envoy-gateway-config, nfs-provisioner) now requires an explicit manual Sync — matches the existing argocd (self-manage) and ignis convention.