@@ -49,7 +49,7 @@ A thin **cli** layer (cobra, [ADR-0005](../adrs/0005-cobra-cli-framework.md)) or
 
 `FieldMapper` is one interface (`Supports` / `ResolvePath` / `Resolve`); the run loop selects the first mapper that supports a manifest and edits the path it resolves, so later tiers slot in without touching callers. The editor (`yamledit`) is path-addressed and knows nothing about kinds.
 
-**Operator-CR translation.** Recommenders report the operator-*generated* workload — KRR sees the Deployment `otel-collector`, or a CNPG instance Pod `mycluster-1`, not the `OpenTelemetryCollector`/`Cluster` CR that lives in the repo. Each tier-2 map carries a **match rule** (workload kind + name suffix/pattern + container→component) that rewrites the reported identity to the owning CR before discovery, collapsing instance pods into a single CR — their per-instance recommendations merged by **max**, so the busiest instance's needs win — and yielding one PR. The built-in match rules are best-effort pending a real `krr -f json` sample from those operators.
+**Operator-CR translation.** Recommenders report the operator-*generated* workload — KRR sees the Deployment `otel-collector`, or a CNPG instance Pod `mycluster-1`, not the `OpenTelemetryCollector`/`Cluster` CR that lives in the repo. Each tier-2 map carries a **match rule** (workload kind + name suffix/pattern + container→component) that rewrites the reported identity to the owning CR before discovery, collapsing instance pods into a single CR — their per-instance recommendations merged by **max**, so the busiest instance's needs win — and yielding one PR. The rewrite is committed only when that CR actually exists in the repo; a raw workload whose name coincidentally matches a built-in rule (a Deployment `metrics-collector`, a Pod `foo-3`) falls back to tier-1. The built-in match rules are best-effort pending a real `krr -f json` sample from those operators.
 
 ## Scope
 
 
@@ -57,13 +57,19 @@ type workloadGroup struct {
 // the generated Deployment/Pod) to their owning CR identity before grouping, so
 // instance pods collapse into one CR. Raw workloads pass through. A no-op when
 // no field maps are configured.
-func (r *Runner) translateTargets(targets []adapter.Target) []adapter.Target {
+//
+// The rewrite is committed only when the target CR actually exists in the repo:
+// a real workload whose name coincidentally matches a built-in match rule (e.g.
+// a Deployment "metrics-collector", or a bare Pod "foo-3") would otherwise be
+// rewritten to a nonexistent CR and silently skipped, instead of being
+// right-sized by tier-1.
+func (r *Runner) translateTargets(ctx context.Context, targets []adapter.Target) []adapter.Target {
 	if len(r.FieldMaps.Maps) == 0 {
 		return targets
 	}
 	out := make([]adapter.Target, len(targets))
 	for i, t := range targets {
-		if ct, ok := fieldmap.TranslateTarget(t, r.FieldMaps); ok {
+		if ct, ok := fieldmap.TranslateTarget(t, r.FieldMaps); ok && r.crResolvable(ctx, ct) {
 			out[i] = ct
 		} else {
 			out[i] = t
@@ -72,6 +78,17 @@ func (r *Runner) translateTargets(targets []adapter.Target) []adapter.Target {
 	return out
 }
 
+// crResolvable reports whether a translated CR identity matches a manifest in
+// the repo. Anything but a definitive not-found counts as resolvable — a found
+// or even ambiguous CR is a real CR (ambiguity is surfaced later by
+// processWorkload), and a transient discover error is better handled there than
+// by silently falling back — so we only revert to the untranslated workload
+// when the CR is genuinely absent.
+func (r *Runner) crResolvable(ctx context.Context, t adapter.Target) bool {
+	_, err := r.Discoverer.Discover(ctx, discover.Workload{Namespace: t.Namespace, Kind: t.Kind, Name: t.Name})
+	return !errors.Is(err, discover.ErrNotFound)
+}
+
 // groupByWorkload collapses per-container targets into one group per workload,
 // so each workload yields a single PR.
 func groupByWorkload(targets []adapter.Target) []workloadGroup {
@@ -100,7 +117,7 @@ func (r *Runner) Run(ctx context.Context, targets []adapter.Target) error {
 	if len(r.Mappers) == 0 {
 		r.Mappers = []fieldmap.FieldMapper{fieldmap.Tier1{}}
 	}
-	targets = r.translateTargets(targets)
+	targets = r.translateTargets(ctx, targets)
 	var failed int
 	for _, grp := range groupByWorkload(targets) {
 		if err := r.processWorkload(ctx, grp); err != nil {
 
@@ -362,6 +362,39 @@ spec:
 	}
 }
 
+func TestRunner_FalsePositiveTranslationFallsBackToTier1(t *testing.T) {
+	// A plain Deployment named "metrics-collector" matches the OTel built-in's
+	// "-collector" suffix, but there is no OpenTelemetryCollector CR. It must
+	// still be right-sized by tier-1, not silently skipped (regression guard).
+	dir := t.TempDir()
+	dep := strings.Replace(deployManifest, "name: web", "name: metrics-collector", 1)
+	path := filepath.Join(dir, "dep.yaml")
+	if err := os.WriteFile(path, []byte(dep), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cfg := config.Defaults()
+	cfg.DryRun = true
+	maps := fieldmap.MergedMaps(fieldmap.MapConfig{})
+	var out bytes.Buffer
+	r := &Runner{
+		Cfg: cfg, Repo: dir,
+		Discoverer: &discover.RepoScanner{Root: dir},
+		Mappers:    []fieldmap.FieldMapper{fieldmap.Tier2{Maps: maps}, fieldmap.Tier1{}},
+		FieldMaps:  maps,
+		Out:        &out,
+	}
+	targets := []adapter.Target{{
+		Namespace: "default", Kind: "Deployment", Name: "metrics-collector", Container: "web",
+		Recommended: adapter.Recommended{Requests: adapter.ResourceValues{CPU: q("250m")}},
+	}}
+	if err := r.Run(context.Background(), targets); err != nil {
+		t.Fatalf("Run: %v", err)
+	}
+	if !strings.Contains(out.String(), "250m") {
+		t.Errorf("a Deployment matching a built-in suffix but with no CR must be tier-1 right-sized:\n%s", out.String())
+	}
+}
+
 func TestRunner_Tier2OperatorCR(t *testing.T) {
 	// The recommender names the generated Deployment "otel-collector"; rere must
 	// translate that to the OpenTelemetryCollector CR "otel" and edit its