fix: preserve pending sync operations during managed status updates

Managed-agent status updates can arrive on the principal with a nil .operation even while a principal-initiated sync request is still pending. The principal UpdateStatus path was previously copying incoming.Operation verbatim, which meant an early status update could clear the sync operation before the Argo CD application controller ever observed it.

That race leaves newly created applications stuck OutOfSync/Missing with no .operation or .status.operationState on either side, even though the deploy flow requested a sync.

Fix this by reusing operationToUse() in the principal UpdateStatus path so an existing operation is preserved when the incoming status payload does not carry one. The operation is still updated when the agent explicitly reports one, and terminating operations keep their existing behavior.

Also add a regression test covering the nil-operation status update case so this remains safe to cherry-pick independently.

Author: drewbailey

internal/manager/application/application.go

@@ -484,13 +484,16 @@ func (m *ApplicationManager) UpdateStatus(ctx context.Context, namespace string,
 		existing.Annotations = incoming.Annotations
 		existing.Labels = incoming.Labels
 		existing.Status = *incoming.Status.DeepCopy()
-		existing.Operation = incoming.Operation
+		// Managed-agent status updates frequently arrive without .operation.
+		// Preserve any principal-initiated sync operation until the agent
+		// explicitly reports an updated operation payload.
+		existing.Operation = operationToUse(existing, incoming)
 	}, func(existing, incoming *v1alpha1.Application) (jsondiff.Patch, error) {
 		refresh, incomingRefresh := incoming.Annotations["argocd.argoproj.io/refresh"]
 		_, existingRefresh := existing.Annotations["argocd.argoproj.io/refresh"]
 		target := &v1alpha1.Application{
 			Status:    incoming.Status,
-			Operation: incoming.Operation,
+			Operation: operationToUse(existing, incoming),
 		}
 		source := &v1alpha1.Application{
 			Status:    existing.Status,

internal/manager/application/application_test.go

@@ -342,6 +342,50 @@ func Test_ManagerUpdateStatus(t *testing.T) {
 		require.NotNil(t, updated.Operation)
 		require.Equal(t, incoming.Operation, updated.Operation)
 	})
+
+	t.Run("Preserve existing operation when incoming status update has no operation", func(t *testing.T) {
+		incoming := &v1alpha1.Application{
+			ObjectMeta: v1.ObjectMeta{
+				Name:      "foobar",
+				Namespace: "argocd",
+				Annotations: map[string]string{
+					"bar": "foo",
+				},
+			},
+			Status: v1alpha1.ApplicationStatus{
+				Sync: v1alpha1.SyncStatus{
+					Status: v1alpha1.SyncStatusCodeOutOfSync,
+				},
+			},
+		}
+		existing := &v1alpha1.Application{
+			ObjectMeta: v1.ObjectMeta{
+				Name:      "foobar",
+				Namespace: "cluster-1",
+				Annotations: map[string]string{
+					"bar": "foo",
+				},
+			},
+			Operation: &v1alpha1.Operation{
+				InitiatedBy: v1alpha1.OperationInitiator{Username: "principal-sync"},
+			},
+		}
+
+		appC, ai := fakeInformer(t, "", existing)
+		be := application.NewKubernetesBackend(appC, "", ai, true)
+		mgr, err := NewApplicationManager(be, "argocd")
+		require.NoError(t, err)
+		mgr.mode = manager.ManagerModeManaged
+		mgr.role = manager.ManagerRolePrincipal
+
+		updated, err := mgr.UpdateStatus(context.Background(), "cluster-1", incoming)
+		require.NoError(t, err)
+		require.NotNil(t, updated)
+		require.NotNil(t, updated.Operation)
+		require.Equal(t, "principal-sync", updated.Operation.InitiatedBy.Username)
+		require.Contains(t, updated.Annotations, LastUpdatedAnnotation)
+		require.NotEmpty(t, updated.Annotations[LastUpdatedAnnotation])
+	})
 }
 
 func Test_ManagerUpdateAutonomous(t *testing.T) {