From 89783a006973ac27d0106c893afaf16b7ca8e987 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 17:25:40 +0000
Subject: [PATCH] feat(events): Convert saved event automation triggers in the
 heartbeat

Each heartbeat converts up to 50 saved triggers that still have an
identifier, under the row lock, and records a version that names Junior.
A row that cannot convert keeps its identifier and saves the reason. A
dashboard edit that read the row before the conversion fails as a
conflict that says Junior changed the trigger.

Merge only after a release with #2407 and #2442 has run in production,
because older releases cannot read rows with no identifier.

Refs #2362

Co-Authored-By: David Cramer <david@sentry.io>
---
 .../src/content/docs/concepts/automations.md  |   2 +-
 packages/junior-dashboard/src/client/http.ts  |  13 +-
 .../pages/automations/AutomationEditor.tsx    |  24 ++-
 packages/junior/src/api/automations/routes.ts |   6 +-
 packages/junior/src/api/schema/automation.ts  |   2 +
 .../src/chat/agent-dispatch/heartbeat.ts      |  10 ++
 packages/junior/src/chat/automations/edit.ts  |  43 ++++-
 .../junior/src/chat/automations/revision.ts   |  13 +-
 .../junior/src/chat/automations/versions.ts   |   7 +-
 .../src/chat/event-automations/README.md      |  18 +-
 .../src/chat/event-automations/store.ts       |  55 +++++-
 .../event-automations/trigger-conversion.ts   |  54 ++++++
 .../any-resource-event-automations.test.ts    | 157 +++++++++++++++++-
 13 files changed, 376 insertions(+), 28 deletions(-)

diff --git a/packages/docs/src/content/docs/concepts/automations.md b/packages/docs/src/content/docs/concepts/automations.md
index 836a3f7149..32c2dbdbf1 100644
--- a/packages/docs/src/content/docs/concepts/automations.md
+++ b/packages/docs/src/content/docs/concepts/automations.md
@@ -61,7 +61,7 @@ whenever a pull request opens in getsentry/junior, review it
 
 Each plugin decides which events can run this way, and each plugin page lists them. Some events need a filter. For example, GitHub issue, pull request, and release events need a `repo` filter, and Linear issue events need a `teamKey` or `issueIdentifier` filter. Junior names the missing filter when it cannot save the automation. Junior saves filter values in the case that event data uses, so `getsentry/Junior` matches `getsentry/junior`. One event runs the automation once, even when the plugin publishes the event for more than one resource, such as each project of a metric alert. Slack channel-message automations always need their own channel.
 
-When you name one exact resource, Junior saves it as the filters that select the same events. For example, one pull request becomes `repo` and `pullRequest` filters. An automation keeps its exact resource when filters would miss events or match more events, and its details say why. Junior does not save a trigger whose filter can never match its resource. When you update a trigger, `match` changes only the filters that it names: a value sets a filter, `null` removes it, and other filters keep their saved values.
+When you name one exact resource, Junior saves it as the filters that select the same events. For example, one pull request becomes `repo` and `pullRequest` filters. Junior changes older automations the same way, and each change saves a new version that names Junior as the editor. An automation keeps its exact resource when filters would miss events or match more events, and its details say why. Junior does not save a trigger whose filter can never match its resource. When you update a trigger, `match` changes only the filters that it names: a value sets a filter, `null` removes it, and other filters keep their saved values.
 
 A required filter limits how much an automation covers and how noisy it is. It is not access control. Junior does not check that the person who creates the automation can see the repository, project, or team in the filter. An automation with no exact resource posts what it receives to its destination channel. For example, a broad Sentry trigger or GitHub deployment trigger can post private project or repository names in that channel. Create broad automations only in channels where everyone can see those resources.
 
diff --git a/packages/junior-dashboard/src/client/http.ts b/packages/junior-dashboard/src/client/http.ts
index 72c761cdaa..e25152a5c6 100644
--- a/packages/junior-dashboard/src/client/http.ts
+++ b/packages/junior-dashboard/src/client/http.ts
@@ -6,18 +6,25 @@ export class DashboardApiError extends Error {
   readonly status: number;
   readonly fields?: Record<string, string[]>;
   readonly code?: string;
+  /** Who made the newer change on a conflict, when the API knows. */
+  readonly changedBy?: string;
   readonly apiError?: string;
 
   constructor(
     path: string,
     status: number,
     apiError?: string,
-    detail?: { fields?: Record<string, string[]>; code?: string },
+    detail?: {
+      fields?: Record<string, string[]>;
+      code?: string;
+      changedBy?: string;
+    },
   ) {
     super(`${path} returned ${status}`);
     this.status = status;
     this.fields = detail?.fields;
     this.code = detail?.code;
+    this.changedBy = detail?.changedBy;
     if (apiError?.trim()) this.apiError = apiError.trim();
   }
 }
@@ -29,14 +36,17 @@ async function throwDashboardApiError(
   let apiError: string | undefined;
   let fields: Record<string, string[]> | undefined;
   let code: string | undefined;
+  let changedBy: string | undefined;
   try {
     const body = (await response.json()) as {
       error?: unknown;
       code?: unknown;
       fields?: unknown;
+      changedBy?: unknown;
     };
     if (typeof body.error === "string") apiError = body.error;
     if (typeof body.code === "string") code = body.code;
+    if (typeof body.changedBy === "string") changedBy = body.changedBy;
     if (body.fields && typeof body.fields === "object") {
       fields = Object.fromEntries(
         Object.entries(body.fields).filter(
@@ -52,6 +62,7 @@ async function throwDashboardApiError(
   throw new DashboardApiError(path, response.status, apiError, {
     fields,
     code,
+    changedBy,
   });
 }
 
diff --git a/packages/junior-dashboard/src/client/pages/automations/AutomationEditor.tsx b/packages/junior-dashboard/src/client/pages/automations/AutomationEditor.tsx
index 85925127f4..70fbe70196 100644
--- a/packages/junior-dashboard/src/client/pages/automations/AutomationEditor.tsx
+++ b/packages/junior-dashboard/src/client/pages/automations/AutomationEditor.tsx
@@ -114,6 +114,10 @@ export function AutomationEditor(props: {
   });
   const conflict =
     save.error instanceof DashboardApiError && save.error.code === "conflict";
+  const changedByJunior =
+    conflict &&
+    save.error instanceof DashboardApiError &&
+    save.error.changedBy === "junior";
   const change = (value: Partial<AutomationDraft>) =>
     setDraft((current) => ({ ...current, ...value }));
   const fieldError = (key: string) =>
@@ -171,18 +175,22 @@ export function AutomationEditor(props: {
           <FormNotice
             tone={conflict ? "warning" : "error"}
             title={
-              conflict
-                ? "This automation changed while you were editing."
-                : "Changes could not be saved."
+              changedByJunior
+                ? "Junior changed this trigger while you were editing."
+                : conflict
+                  ? "This automation changed while you were editing."
+                  : "Changes could not be saved."
             }
           >
             <p className="mt-1">
               Your edits are still here.{" "}
-              {conflict
-                ? "Review the latest version before saving again."
-                : save.error instanceof DashboardApiError
-                  ? save.error.apiError
-                  : "Check the fields below, or try again."}
+              {changedByJunior
+                ? "It now uses filters that select the same events. Review the latest version before saving again."
+                : conflict
+                  ? "Review the latest version before saving again."
+                  : save.error instanceof DashboardApiError
+                    ? save.error.apiError
+                    : "Check the fields below, or try again."}
             </p>
             {conflict ? (
               <Button
diff --git a/packages/junior/src/api/automations/routes.ts b/packages/junior/src/api/automations/routes.ts
index 0f9268ac0b..1a9e90afd5 100644
--- a/packages/junior/src/api/automations/routes.ts
+++ b/packages/junior/src/api/automations/routes.ts
@@ -59,7 +59,11 @@ function editErrorResponse(error: unknown): Response {
   if (error instanceof AutomationConflictError) {
     return jsonResponse(
       automationEditErrorSchema,
-      { error: error.message, code: "conflict" },
+      {
+        error: error.message,
+        code: "conflict",
+        ...(error.changedBy ? { changedBy: error.changedBy } : undefined),
+      },
       { status: 409 },
     );
   }
diff --git a/packages/junior/src/api/schema/automation.ts b/packages/junior/src/api/schema/automation.ts
index a16e6a98fd..75df64cfc0 100644
--- a/packages/junior/src/api/schema/automation.ts
+++ b/packages/junior/src/api/schema/automation.ts
@@ -410,6 +410,8 @@ export const automationEditErrorSchema = z
     error: z.string(),
     code: z.enum(["invalid_edit", "conflict", "not_found"]),
     fields: z.record(z.string(), z.array(z.string())).optional(),
+    /** Set on a conflict when Junior made the only newer change. */
+    changedBy: z.literal("junior").optional(),
   })
   .strict();
 
diff --git a/packages/junior/src/chat/agent-dispatch/heartbeat.ts b/packages/junior/src/chat/agent-dispatch/heartbeat.ts
index 7e2110cbaf..12308953d9 100644
--- a/packages/junior/src/chat/agent-dispatch/heartbeat.ts
+++ b/packages/junior/src/chat/agent-dispatch/heartbeat.ts
@@ -1,3 +1,6 @@
+import { getDb } from "@/chat/db";
+import { convertSavedEventAutomationTriggers } from "@/chat/event-automations/trigger-conversion";
+import { getEventCatalog } from "@/chat/events/runtime-catalog";
 import { runTimerWatchHeartbeat } from "@/chat/events/timers";
 import { getPlugins } from "@/chat/plugins/agent-hooks";
 import { logException, logInfo } from "@/chat/logging";
@@ -215,6 +218,13 @@ export async function runHeartbeat(args: {
   } catch (error) {
     logException(error, "scheduled_automations.heartbeat.failed");
   }
+  try {
+    // Saved triggers with an identifier move to filters. Slice D of #2362
+    // removes this step with the identifier column.
+    await convertSavedEventAutomationTriggers(getDb(), getEventCatalog());
+  } catch (error) {
+    logException(error, "event_automation.trigger.conversion_failed");
+  }
   try {
     await runTimerWatchHeartbeat({ nowMs: args.nowMs, queue });
   } catch (error) {
diff --git a/packages/junior/src/chat/automations/edit.ts b/packages/junior/src/chat/automations/edit.ts
index 813a876189..6d9112790a 100644
--- a/packages/junior/src/chat/automations/edit.ts
+++ b/packages/junior/src/chat/automations/edit.ts
@@ -10,6 +10,7 @@ import type { AutomationEdit, AutomationUpdate } from "@/api/schema/automation";
 import { getDb } from "@/chat/db";
 import { resolveTaskOutcomes } from "@/chat/task-outcomes";
 import {
+  getEventAutomation,
   saveEventAutomation,
   setEventAutomationStatus,
   type StoredEventAutomation,
@@ -24,7 +25,11 @@ import {
   type ScheduleIntent,
 } from "@/chat/scheduled-automations/schedule-intent";
 import type { ScheduledAutomation } from "@/chat/scheduled-automations/types";
-import { automationRevision, requireAutomationRevision } from "./revision";
+import {
+  AutomationConflictError,
+  automationRevision,
+  requireAutomationRevision,
+} from "./revision";
 import {
   resolveViewerTaskCandidate,
   ViewerTaskNotFoundError,
@@ -32,6 +37,7 @@ import {
 } from "./read";
 import {
   automationDefinition,
+  listAutomationVersions,
   readAutomationVersion,
   sameDefinitionValue,
 } from "./versions";
@@ -130,6 +136,26 @@ export async function readViewerAutomationEdit(
   return editView(automation, automation.ownedByViewer);
 }
 
+/**
+ * Return whether the only change after `revision` is Junior's trigger change:
+ * the newest version is Junior's, and the event automation with the trigger
+ * of the version before it has that revision.
+ */
+async function changedOnlyByJunior(
+  id: string,
+  revision: string,
+): Promise<boolean> {
+  const db = getDb();
+  const task = await getEventAutomation(db, id);
+  const [latest, previous] = await listAutomationVersions(db, id, 2);
+  if (!task || latest?.editedBy !== "junior" || previous?.kind !== "event")
+    return false;
+  return (
+    automationRevision({ ...task, trigger: previous.definition.trigger }) ===
+    revision
+  );
+}
+
 /** Save a partial edit against the read revision, without dispatching work. */
 export async function updateViewerAutomation(
   user: User,
@@ -139,8 +165,19 @@ export async function updateViewerAutomation(
   const current = await requireEditableAutomation(user, id);
   if (input.kind !== current.kind)
     throw new AutomationEditError("The trigger type cannot change.", "kind");
-  requireAutomationRevision(current.task, input.revision);
-  return saveViewerEdit(user, current, input);
+  try {
+    requireAutomationRevision(current.task, input.revision);
+    return await saveViewerEdit(user, current, input);
+  } catch (error) {
+    if (
+      error instanceof AutomationConflictError &&
+      input.kind === "event" &&
+      (await changedOnlyByJunior(id, input.revision))
+    ) {
+      throw new AutomationConflictError("junior");
+    }
+    throw error;
+  }
 }
 
 /** `restored` carries version values that edit input cannot express, such as a cleared title. */
diff --git a/packages/junior/src/chat/automations/revision.ts b/packages/junior/src/chat/automations/revision.ts
index bc66a01390..bc7ccc490c 100644
--- a/packages/junior/src/chat/automations/revision.ts
+++ b/packages/junior/src/chat/automations/revision.ts
@@ -4,12 +4,21 @@ import { ToolInputError } from "@/chat/tools/execution/tool-input-error";
 import type { EventAutomation } from "@/chat/event-automations/types";
 import type { ScheduledAutomation } from "@/chat/scheduled-automations/types";
 
+/**
+ * A stale edit. `changedBy` is `"junior"` when the only newer change is
+ * Junior's own trigger change, so the editor can say who changed it.
+ */
 export class AutomationConflictError extends ToolInputError {
-  constructor() {
+  readonly changedBy?: "junior";
+
+  constructor(changedBy?: "junior") {
     super(
-      "This Automation changed after it was loaded. Reload it before saving.",
+      changedBy === "junior"
+        ? "Junior changed this Automation's trigger to filters that select the same events after it was loaded. Reload it before saving."
+        : "This Automation changed after it was loaded. Reload it before saving.",
     );
     this.name = "AutomationConflictError";
+    if (changedBy) this.changedBy = changedBy;
   }
 }
 
diff --git a/packages/junior/src/chat/automations/versions.ts b/packages/junior/src/chat/automations/versions.ts
index 5ff4fe63cc..09ee7e64c7 100644
--- a/packages/junior/src/chat/automations/versions.ts
+++ b/packages/junior/src/chat/automations/versions.ts
@@ -13,6 +13,11 @@ import { canonicalJson } from "./revision";
 
 type VersionedAutomation = ScheduledAutomation | EventAutomation;
 
+/** The person who saves a version, or `"junior"` when Junior saves it. */
+export type AutomationVersionEditor = NonNullable<
+  AutomationVersion["editedBy"]
+>;
+
 /** Return the versioned part of an Automation. Lifecycle and run state are excluded. */
 export function automationDefinition(task: VersionedAutomation) {
   const common = {
@@ -43,7 +48,7 @@ export async function recordAutomationVersion(
   db: JuniorDatabase,
   task: VersionedAutomation,
   current: VersionedAutomation | undefined,
-  editedBy?: EventAutomation["createdBy"],
+  editedBy?: AutomationVersionEditor,
 ): Promise<void> {
   const definition = automationDefinition(task);
   if (current && sameDefinitionValue(automationDefinition(current), definition))
diff --git a/packages/junior/src/chat/event-automations/README.md b/packages/junior/src/chat/event-automations/README.md
index 88e090dd05..a3427e1889 100644
--- a/packages/junior/src/chat/event-automations/README.md
+++ b/packages/junior/src/chat/event-automations/README.md
@@ -68,12 +68,18 @@ After a conversion the scope lives in `match`, so replacing the whole object
 would make the trigger broader. The dashboard sends the whole trigger from
 its form, which shows every saved filter.
 
-Saved rows keep their identifiers until a later change converts them. Saved
-versions keep their old triggers, and the version schema still reads
-`identifier` and `resourceType`. The version schema also reads
-`editedBy: "junior"` for a version that Junior saves when it changes a trigger
-itself. Nothing writes it yet. The reader comes first, so a release that
-writes it can roll back to this one and keep version history readable.
+Each heartbeat checks at most 50 saved rows that have an identifier, no
+saved reason, and the same identifier in the row and the trigger. It saves
+each row with the revision that it read, under the row lock, and records a
+version with `editedBy: "junior"`. A row that changed after the read is left
+for the next heartbeat. A row that cannot convert keeps its identifier, stays
+active, and saves the reason, so later heartbeats skip it. A dashboard edit
+that read the row before the conversion fails as a conflict, and the dashboard
+says that Junior changed the trigger. The edit API checks this by giving the
+saved row the trigger of the version before Junior's and comparing its
+revision. Slice D of #2362 decides what happens to kept rows before the
+identifier column goes away. Saved versions keep their old triggers, and the
+version schema still reads `identifier` and `resourceType`.
 
 `searchEventTypes` exposes the same enabled plugin catalog used by
 watches and event automations. Create and update tools accept only
diff --git a/packages/junior/src/chat/event-automations/store.ts b/packages/junior/src/chat/event-automations/store.ts
index 80aba23238..b87478b922 100644
--- a/packages/junior/src/chat/event-automations/store.ts
+++ b/packages/junior/src/chat/event-automations/store.ts
@@ -1,5 +1,8 @@
 import { requireAutomationRevision } from "@/chat/automations/revision";
-import { recordAutomationVersion } from "@/chat/automations/versions";
+import {
+  recordAutomationVersion,
+  type AutomationVersionEditor,
+} from "@/chat/automations/versions";
 import {
   eventMatches,
   type Event,
@@ -7,7 +10,18 @@ import {
   type EventMatch,
   type User,
 } from "@sentry/junior-plugin-api";
-import { and, asc, desc, eq, inArray, isNull, ne, or, sql } from "drizzle-orm";
+import {
+  and,
+  asc,
+  desc,
+  eq,
+  inArray,
+  isNotNull,
+  isNull,
+  ne,
+  or,
+  sql,
+} from "drizzle-orm";
 import type { JuniorDatabase } from "@/db/db";
 import { juniorAutomations } from "@/db/schema/automations";
 import {
@@ -200,13 +214,14 @@ export async function createEventAutomation(
 
 /**
  * Replace an existing non-deleted event automation under a row lock.
- * Pass `editedBy` when a person changes the definition so its version names them.
+ * Pass `editedBy` when a person or Junior changes the definition so its
+ * version names them.
  */
 export async function saveEventAutomation(
   db: JuniorDatabase,
   task: EventAutomation,
   expectedRevision?: string,
-  editedBy?: EventAutomation["createdBy"],
+  editedBy?: AutomationVersionEditor,
 ): Promise<StoredEventAutomation | undefined> {
   const columns = eventAutomationColumns(task);
   return db.transaction(async (tx) => {
@@ -284,6 +299,38 @@ export async function listDeletedEventAutomationsCreatedBy(
   return rows.map(parseEventAutomationRow);
 }
 
+/**
+ * List up to `limit` live event automations whose trigger still has an
+ * identifier and no saved reason to keep it. Skip a row whose identifier
+ * column and saved trigger disagree, because ingest never runs it and a save
+ * could make it broad. Skip a row that does not parse; ingest logs it when an
+ * event reaches it.
+ */
+export async function listEventAutomationsToConvert(
+  db: JuniorDatabase,
+  limit: number,
+): Promise<StoredEventAutomation[]> {
+  const rows = await db
+    .select()
+    .from(juniorAutomations)
+    .where(
+      and(
+        activeEventAutomationWhere(),
+        isNotNull(juniorAutomations.identifier),
+        sql`${juniorAutomations.record}->'trigger'->>'identifier' = ${juniorAutomations.identifier}`,
+        sql`${juniorAutomations.record}->'trigger'->'identifierReason' is null`,
+      ),
+    )
+    .orderBy(asc(juniorAutomations.createdAtMs), asc(juniorAutomations.id))
+    .limit(limit);
+  return rows.flatMap((row) => {
+    const parsed = eventAutomationSchema.safeParse(
+      eventAutomationRowInput(row),
+    );
+    return parsed.success ? [withRowFields(row, parsed.data)] : [];
+  });
+}
+
 /**
  * Select live rows whose identifier is one of these, and rows with no
  * identifier. A row with no identifier runs for every resource of its
diff --git a/packages/junior/src/chat/event-automations/trigger-conversion.ts b/packages/junior/src/chat/event-automations/trigger-conversion.ts
index 3a08b656e9..ce28d1c708 100644
--- a/packages/junior/src/chat/event-automations/trigger-conversion.ts
+++ b/packages/junior/src/chat/event-automations/trigger-conversion.ts
@@ -12,11 +12,18 @@ import {
   stableEventMatchKey,
   type EventMatch,
 } from "@sentry/junior-plugin-api";
+import {
+  AutomationConflictError,
+  automationRevision,
+} from "@/chat/automations/revision";
 import {
   automationEventCatalog,
   registeredEventTriggerProblems,
   type EventCatalog,
 } from "@/chat/events/catalog";
+import { logException, logInfo } from "@/chat/logging";
+import type { JuniorDatabase } from "@/db/db";
+import { listEventAutomationsToConvert, saveEventAutomation } from "./store";
 import type { EventAutomation } from "./types";
 
 type EventAutomationTrigger = EventAutomation["trigger"];
@@ -121,3 +128,50 @@ export function triggerWithoutIdentifier(
   if (problems.length > 0) return keep("no filters select the same events");
   return { converted: true, trigger: { ...rest, match } };
 }
+
+/** Most saved triggers that one heartbeat checks. */
+const CONVERSION_BATCH_LIMIT = 50;
+
+/**
+ * Check saved event automation triggers that have an identifier and no saved
+ * reason, at most `CONVERSION_BATCH_LIMIT` in one call. Save each one with
+ * no identifier when `triggerWithoutIdentifier` can convert it. Otherwise
+ * save the reason, so later calls skip it and people can see why. Each save
+ * locks the row, checks that the row did not change after it was read, and
+ * records a new version with Junior as its editor. A row that changed is
+ * left for the next call. Every trigger stays active.
+ */
+export async function convertSavedEventAutomationTriggers(
+  db: JuniorDatabase,
+  catalog: EventCatalog,
+): Promise<{ converted: string[]; kept: string[] }> {
+  const converted: string[] = [];
+  const kept: string[] = [];
+  const tasks = await listEventAutomationsToConvert(db, CONVERSION_BATCH_LIMIT);
+  for (const task of tasks) {
+    try {
+      const conversion = triggerWithoutIdentifier(catalog, task.trigger);
+      const saved = await saveEventAutomation(
+        db,
+        { ...task, trigger: conversion.trigger },
+        automationRevision(task),
+        "junior",
+      );
+      if (!saved) continue;
+      (conversion.converted ? converted : kept).push(task.id);
+      logInfo(
+        conversion.converted
+          ? "event_automation.trigger.converted"
+          : "event_automation.trigger.identifier_kept",
+        { "app.task.id": task.id, "app.task.type": "event" },
+      );
+    } catch (error) {
+      if (error instanceof AutomationConflictError) continue;
+      logException(error, "event_automation.trigger.conversion_failed", {
+        "app.task.id": task.id,
+        "app.task.type": "event",
+      });
+    }
+  }
+  return { converted, kept };
+}
diff --git a/packages/junior/tests/integration/any-resource-event-automations.test.ts b/packages/junior/tests/integration/any-resource-event-automations.test.ts
index c693b1e2a2..cd95ac3255 100644
--- a/packages/junior/tests/integration/any-resource-event-automations.test.ts
+++ b/packages/junior/tests/integration/any-resource-event-automations.test.ts
@@ -1,14 +1,27 @@
 import { githubPlugin } from "@sentry/junior-github";
+import type { EventMatch } from "@sentry/junior-plugin-api";
 import { eq, sql } from "drizzle-orm";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { createApp, defineJuniorPlugins } from "@/app";
+import { runHeartbeat } from "@/chat/agent-dispatch/heartbeat";
 import { getDispatchRecord } from "@/chat/agent-dispatch/store";
 import { migrateSchema } from "@/chat/conversations/sql/migrations";
-import { getConversationStore } from "@/chat/db";
+import {
+  readViewerAutomationEdit,
+  updateViewerAutomation,
+} from "@/chat/automations/edit";
+import { listAutomationVersions } from "@/chat/automations/versions";
+import { getConversationStore, getDb } from "@/chat/db";
 import { ingestEventAutomations } from "@/chat/event-automations/ingest";
+import {
+  createEventAutomation,
+  getEventAutomation,
+} from "@/chat/event-automations/store";
 import { getEventCatalog } from "@/chat/events/runtime-catalog";
+import { resolveViewerUser } from "@/chat/plugins/viewer";
 import { disconnectStateAdapter } from "@/chat/state/adapter";
 import { createEventAutomationTool } from "@/chat/tools/create-event-automation";
+import { createListEventAutomationsTool } from "@/chat/tools/list-event-automations";
 import { createUpdateEventAutomationTool } from "@/chat/tools/update-event-automation";
 import type { EventAutomationRecord } from "@/chat/event-automations/types";
 import { juniorAutomations } from "@/db/schema/automations";
@@ -305,6 +318,148 @@ describe("event automations with no identifier", () => {
       expect(repoOnly.automation.trigger.match).toEqual({
         repo: "getsentry/junior",
       });
+
+      // Rows saved before this change still name one resource. The heartbeat
+      // converts each one under its row lock and saves a version that names
+      // Junior. A saved list that has the identifier's value becomes that
+      // value. A row whose saved filter never matches its identifier never
+      // ran, so it keeps its identifier, saves the reason, and stays active.
+      const base = (await getEventAutomation(getDb(), created.automation.id))!;
+      const savePullRequest = (id: string, match?: EventMatch) =>
+        createEventAutomation(getDb(), {
+          ...base,
+          id,
+          trigger: {
+            ...base.trigger,
+            identifier: "getsentry/junior#8",
+            resourceType: "pull_request",
+            match,
+          },
+        });
+      await savePullRequest("evt_saved_pull_request");
+      await savePullRequest("evt_saved_list_filter", { pullRequest: [8, 9] });
+      await savePullRequest("evt_saved_conflict", { pullRequest: 5 });
+      // Its saved trigger has no identifier, so ingest never runs it.
+      // Conversion must not save it as a broad row.
+      await fixture.sql
+        .db()
+        .insert(juniorAutomations)
+        .values({
+          ...row!,
+          id: "evt_saved_column_only",
+          identifier: "getsentry/junior#8",
+        });
+      // A dashboard edit that read the row before the heartbeat.
+      await getConversationStore().recordActivity({
+        conversationId: `slack:${teamId}:U123:edit`,
+        actor: {
+          platform: "slack",
+          slackUserId: "U123",
+          email: "creator@example.com",
+          teamId,
+        },
+        destination: { platform: "slack", channelId: "C123", teamId },
+        channelName: "automations",
+        visibility: "public",
+      });
+      const viewer = (await resolveViewerUser("creator@example.com"))!;
+      const read = await readViewerAutomationEdit(
+        viewer,
+        "evt_saved_pull_request",
+      );
+
+      await runHeartbeat({ nowMs: Date.now(), conversationWorkQueue: queue });
+      const saved = (id: string) => getEventAutomation(getDb(), id);
+      const versions = (id: string) => listAutomationVersions(getDb(), id, 5);
+      expect((await saved("evt_saved_pull_request"))?.trigger).toMatchObject({
+        match: { repo: "getsentry/junior", pullRequest: 8 },
+      });
+      expect((await saved("evt_saved_list_filter"))?.trigger).toMatchObject({
+        match: { repo: "getsentry/junior", pullRequest: 8 },
+      });
+      expect(await versions("evt_saved_pull_request")).toMatchObject([
+        { version: 2, editedBy: "junior" },
+        {
+          version: 1,
+          definition: { trigger: { identifier: "getsentry/junior#8" } },
+        },
+      ]);
+      const reason =
+        "Kept its exact pull request because its pullRequest filter never matches its events.";
+      expect(await saved("evt_saved_conflict")).toMatchObject({
+        status: "active",
+        trigger: { identifier: "getsentry/junior#8", identifierReason: reason },
+      });
+      expect(
+        (await saved("evt_saved_column_only"))?.trigger.identifier,
+      ).toBeUndefined();
+      // The saved reason is a note on the trigger, not a problem. Listing
+      // reads every row of the team, so remove the row that does not parse.
+      await fixture.sql
+        .db()
+        .delete(juniorAutomations)
+        .where(eq(juniorAutomations.id, "evt_bad_record"));
+      const listed = (await execute(
+        createListEventAutomationsTool(context(), catalog),
+        {},
+        "list-kept",
+      )) as {
+        automations: { id: string; trigger: Record<string, unknown> }[];
+      };
+      expect(
+        listed.automations.find(({ id }) => id === "evt_saved_conflict")
+          ?.trigger,
+      ).toMatchObject({ available: true, notes: [reason] });
+      // The next heartbeat does not save the kept row again.
+      await runHeartbeat({ nowMs: Date.now(), conversationWorkQueue: queue });
+      expect(await versions("evt_saved_conflict")).toHaveLength(2);
+      expect(await versions("evt_saved_column_only")).toEqual([]);
+
+      // The stale dashboard edit fails and says that Junior changed the
+      // trigger.
+      await expect(
+        updateViewerAutomation(viewer, "evt_saved_pull_request", {
+          kind: "event",
+          revision: read.revision,
+          title: "Renamed",
+        }),
+      ).rejects.toMatchObject({ changedBy: "junior" });
+
+      // Both converted rows run once for their pull request, and not for
+      // another pull request.
+      const dispatchedIds = async (pullRequest: number) => {
+        const before = queue.sentRecords().length;
+        for (const identifier of [
+          `getsentry/junior#${pullRequest}`,
+          "getsentry/junior",
+        ]) {
+          await ingestEventAutomations(
+            {
+              eventKey: `github:saved-${pullRequest}`,
+              eventType: "pull_request.opened",
+              occurredAtMs: Date.now(),
+              namespace: "github",
+              identifier,
+              trustedSummary: "A pull request was opened.",
+              data: { pullRequest, repo: "getsentry/junior" },
+            },
+            { queue, teamId },
+          );
+        }
+        const ids = [];
+        for (const sentRecord of queue.sentRecords().slice(before)) {
+          const dispatched = await getDispatchRecord(
+            sentRecord.conversationId.replace(/^agent-dispatch:/, ""),
+          );
+          ids.push(dispatched?.metadata?.eventAutomationId);
+        }
+        return ids.filter((id) => id?.startsWith("evt_saved_")).sort();
+      };
+      expect(await dispatchedIds(8)).toEqual([
+        "evt_saved_list_filter",
+        "evt_saved_pull_request",
+      ]);
+      expect(await dispatchedIds(9)).toEqual([]);
     } finally {
       vi.unstubAllEnvs();
     }