feat: Replace SSE with WebSocket for UI notifications (#36965)

* Closes #36942
* Fixes #19265 

Replaces the SSE-based push channel (`/user/events`) with a WebSocket
endpoint (`/-/ws`).

### What changes

- **New `/-/ws` endpoint** (authenticated). One WebSocket per origin,
shared across tabs via a single `SharedWorker`.
- **Pubsub broker** (`services/pubsub`) for fan-out by topic, behind a
`Broker` interface. `MemoryBroker` is the default (single process); a
Redis backend is available for multi-process setups, configured via
`[websocket].PUBSUB_TYPE` / `PUBSUB_CONN_STR`. The internal Gitea queue
was not usable here because it has FIFO/single-consumer semantics.
- **Push-only event production.** Events are emitted by write-triggered
notifiers — `NotificationCountChange`, `PublishStopwatchesForUser`, and
the logout publisher — wired into the existing `notify.Notifier`
interface. No server-side pollers.
- **Typed pub/sub on the client.** `web_src/js/modules/worker.ts` is a
singleton transport; features subscribe per event type via
`onUserEvent('notification-count', cb)` instead of branching on
`event.data.type`.
- **Wire contract** (`UserEventType` union) is shared between the worker
and consumers via `web_src/js/types.ts`, kept in sync with
`services/websocket/events.go`.
- **Client-side periodic polling fallback** kicks in only when the
WebSocket cannot be established (e.g. proxy blocks WS, browser lacks
module-SharedWorker support).

### What's removed

- `modules/eventsource` (SSE manager, run loop, messenger).
- `/user/events` route and `tests/integration/eventsource_test.go`.
- All server-side polling for stopwatches and notification counts.

### Stopwatch multi-tab fix

The navbar stopwatch icon was previously rendered conditionally on `{{if
$activeStopwatch}}`, so tabs loaded before the timer started had no DOM
element to update. The icon and popup are now always rendered (toggled
with `tw-hidden`), and the start/stop/cancel handlers POST silently so
all open tabs reflect the change in real time.

### Deployment note

WebSocket needs the upgrade headers to pass through a reverse proxy,
e.g. for nginx:

```nginx
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
```

Without them the WebSocket cannot be established, and after 3
consecutive failed opens the shared worker signals `push-unavailable`:
the notification count and stopwatch fall back to periodic polling on
the existing `[ui.notification]` timeouts. Real-time push is lost, the
features keep working. The reverse-proxy docs need the same note (see
the `docs-update-needed` label).

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Epid <rexmrj@gmail.com>

services/issue/status.go

@@ -16,6 +16,7 @@ import (
 // CloseIssue close an issue.
 func CloseIssue(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, commitID string) error {
 	var comment *issues_model.Comment
+	var stopwatchFinished bool
 	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		var err error
 		comment, err = issues_model.CloseIssue(ctx, issue, doer)
@@ -28,12 +29,17 @@ func CloseIssue(ctx context.Context, issue *issues_model.Issue, doer *user_model
 			return err
 		}
 
-		_, err = issues_model.FinishIssueStopwatch(ctx, doer, issue)
+		stopwatchFinished, err = issues_model.FinishIssueStopwatch(ctx, doer, issue)
 		return err
 	}); err != nil {
 		return err
 	}
 
+	// after the tx: publishing inside it would announce a change a rollback undoes
+	if stopwatchFinished {
+		notify_service.StopwatchChanged(ctx, doer)
+	}
+
 	notify_service.IssueChangeStatus(ctx, doer, commitID, issue, comment, true)
 
 	return nil

services/notifications/status.go

@@ -0,0 +1,60 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Package notifications wraps activities_model notification-status mutations
+// with the matching real-time push, so route handlers cannot forget either side.
+package notifications
+
+import (
+	"context"
+
+	activities_model "gitea.dev/models/activities"
+	user_model "gitea.dev/models/user"
+	notify_service "gitea.dev/services/notify"
+)
+
+func SetIssueReadBy(ctx context.Context, issueID, userID int64) error {
+	changed, err := activities_model.SetIssueReadBy(ctx, issueID, userID)
+	if err != nil {
+		return err
+	}
+	if changed {
+		notify_service.NotificationCountChange(ctx, userID)
+	}
+	return nil
+}
+
+func SetNotificationStatus(ctx context.Context, notificationID int64, user *user_model.User, status activities_model.NotificationStatus) (*activities_model.Notification, error) {
+	notif, err := activities_model.SetNotificationStatus(ctx, notificationID, user, status)
+	if err != nil {
+		return notif, err
+	}
+	notify_service.NotificationCountChange(ctx, user.ID)
+	return notif, nil
+}
+
+func SetManyNotificationStatuses(ctx context.Context, ns []*activities_model.Notification, user *user_model.User, status activities_model.NotificationStatus) ([]*activities_model.Notification, error) {
+	out := make([]*activities_model.Notification, 0, len(ns))
+	for _, n := range ns {
+		notif, err := activities_model.SetNotificationStatus(ctx, n.ID, user, status)
+		if err != nil {
+			return out, err
+		}
+		out = append(out, notif)
+	}
+	if len(out) > 0 {
+		notify_service.NotificationCountChange(ctx, user.ID)
+	}
+	return out, nil
+}
+
+func MarkAllRead(ctx context.Context, user *user_model.User) error {
+	changed, err := activities_model.UpdateNotificationStatuses(ctx, user, activities_model.NotificationStatusUnread, activities_model.NotificationStatusRead)
+	if err != nil {
+		return err
+	}
+	if changed > 0 {
+		notify_service.NotificationCountChange(ctx, user.ID)
+	}
+	return nil
+}

services/notify/notifier.go

@@ -82,4 +82,8 @@ type Notifier interface {
 	WorkflowRunStatusUpdate(ctx context.Context, repo *repo_model.Repository, sender *user_model.User, run *actions_model.ActionRun)
 
 	WorkflowJobStatusUpdate(ctx context.Context, repo *repo_model.Repository, sender *user_model.User, job *actions_model.ActionRunJob, task *actions_model.ActionTask)
+
+	NotificationCountChange(ctx context.Context, userID int64)
+
+	StopwatchChanged(ctx context.Context, user *user_model.User)
 }

services/notify/notify.go

@@ -416,3 +416,17 @@ func WorkflowJobStatusUpdate(ctx context.Context, repo *repo_model.Repository, s
 		notifier.WorkflowJobStatusUpdate(ctx, repo, sender, job, task)
 	}
 }
+
+// Callers must invoke this after any DB write affecting the user's unread count.
+func NotificationCountChange(ctx context.Context, userID int64) {
+	for _, notifier := range notifiers {
+		notifier.NotificationCountChange(ctx, userID)
+	}
+}
+
+// Callers must invoke this after any stopwatch start/stop/cancel so the user's connected tabs refresh.
+func StopwatchChanged(ctx context.Context, user *user_model.User) {
+	for _, notifier := range notifiers {
+		notifier.StopwatchChanged(ctx, user)
+	}
+}

services/notify/null.go

@@ -219,3 +219,9 @@ func (*NullNotifier) WorkflowRunStatusUpdate(ctx context.Context, repo *repo_mod
 
 func (*NullNotifier) WorkflowJobStatusUpdate(ctx context.Context, repo *repo_model.Repository, sender *user_model.User, job *actions_model.ActionRunJob, task *actions_model.ActionTask) {
 }
+
+func (*NullNotifier) NotificationCountChange(_ context.Context, _ int64) {
+}
+
+func (*NullNotifier) StopwatchChanged(_ context.Context, _ *user_model.User) {
+}

services/pubsub/broker.go

@@ -0,0 +1,39 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Package pubsub fans real-time events out to local WebSocket subscribers.
+// Backend is chosen at boot: in-process map (single-instance) or Redis
+// (multi-process). DefaultBroker is wired by Init from setting.Websocket.
+package pubsub
+
+import "fmt"
+
+// subChanBuffer is how many messages a subscriber may fall behind before its
+// messages are dropped instead of stalling the publisher.
+const subChanBuffer = 8
+
+type Broker interface {
+	// Subscribe returns a buffered channel of messages for topic, and a cancel
+	// func that closes the channel and removes the subscription. cancel is
+	// idempotent.
+	Subscribe(topic string) (<-chan []byte, func())
+
+	// Publish delivers msg to every subscriber of topic. Non-blocking: a slow
+	// subscriber drops messages rather than stalling the publisher.
+	Publish(topic string, msg []byte)
+
+	// HasTopicSubscribers is an optimization hint for publishers that would
+	// otherwise do a DB lookup just to discover nobody is listening. Backends
+	// that cannot answer cheaply across processes return true to be safe.
+	HasTopicSubscribers(topic string) bool
+}
+
+// DefaultBroker is replaced by Init from setting.Websocket. It starts as an
+// empty memory broker so non-web entry points (e.g. CLI), which skip Init, can
+// publish without nil checks — with no subscribers every publish is a no-op.
+// Tests construct a broker explicitly (NewMemoryBroker) instead of relying on this.
+var DefaultBroker Broker = NewMemoryBroker()
+
+func UserTopic(userID int64) string {
+	return fmt.Sprintf("user-%d", userID)
+}

services/pubsub/broker_test.go

@@ -0,0 +1,170 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pubsub
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newBrokerFunc builds a fresh Broker bound to the test's lifecycle.
+type newBrokerFunc func(t *testing.T) Broker
+
+// testBrokerBasic runs the behavior every Broker backend must share. Each backend
+// invokes it from its own *_test.go (like testQueueBasic in modules/queue) so
+// memory and redis prove identical semantics against the same scenarios.
+//
+// recvTimeout absorbs redis's network round-trip (memory delivers synchronously).
+func testBrokerBasic(t *testing.T, newBroker newBrokerFunc, recvTimeout time.Duration) {
+	t.Run("PublishWithoutSubscribers", func(t *testing.T) {
+		b := newBroker(t)
+		b.Publish("nobody", []byte("msg")) // must not block or panic
+	})
+
+	t.Run("SubscribeReceivesPublished", func(t *testing.T) {
+		b := newBroker(t)
+		ch, cancel := b.Subscribe("topic")
+		defer cancel()
+
+		b.Publish("topic", []byte("hello"))
+		assert.Equal(t, []byte("hello"), recvWithin(t, ch, recvTimeout))
+	})
+
+	t.Run("FanOutToAllSubscribers", func(t *testing.T) {
+		b := newBroker(t)
+		const n = 3
+		channels := make([]<-chan []byte, n)
+		for i := range n {
+			ch, cancel := b.Subscribe("topic")
+			defer cancel()
+			channels[i] = ch
+		}
+
+		b.Publish("topic", []byte("broadcast"))
+		for i, ch := range channels {
+			assert.Equal(t, []byte("broadcast"), recvWithin(t, ch, recvTimeout), "subscriber %d", i)
+		}
+	})
+
+	t.Run("TopicIsolation", func(t *testing.T) {
+		b := newBroker(t)
+		chA, cancelA := b.Subscribe("a")
+		defer cancelA()
+		chB, cancelB := b.Subscribe("b")
+		defer cancelB()
+
+		b.Publish("a", []byte("only-a"))
+		assert.Equal(t, []byte("only-a"), recvWithin(t, chA, recvTimeout))
+		assertQuiet(t, chB, 100*time.Millisecond) // topic b must stay silent
+	})
+
+	t.Run("CancelStopsDelivery", func(t *testing.T) {
+		b := newBroker(t)
+		ch, cancel := b.Subscribe("topic")
+
+		cancel()
+		_, ok := <-ch
+		assert.False(t, ok, "channel must be closed after cancel")
+
+		b.Publish("topic", []byte("after-cancel")) // must not panic or block
+	})
+
+	t.Run("CancelIsIdempotent", func(t *testing.T) {
+		b := newBroker(t)
+		_, cancel := b.Subscribe("topic")
+		cancel()
+		assert.NotPanics(t, cancel, "cancel must be safe to call more than once")
+	})
+
+	// What each backend reports with no live subscriber differs, so that stays in
+	// the backend's own test file.
+	t.Run("HasTopicSubscribers", func(t *testing.T) {
+		b := newBroker(t)
+		_, cancel := b.Subscribe("topic")
+		defer cancel()
+		assert.True(t, b.HasTopicSubscribers("topic"), "must report subscribers while one is live")
+	})
+
+	t.Run("SlowSubscriberDropsWithoutBlocking", func(t *testing.T) {
+		b := newBroker(t)
+		_, cancelSlow := b.Subscribe("topic") // never drained, buffer overflows
+		defer cancelSlow()
+		fast, cancelFast := b.Subscribe("topic")
+		defer cancelFast()
+
+		// Drain fast concurrently so it keeps up while slow's buffer fills.
+		got := make(chan struct{}, 1)
+		done := make(chan struct{})
+		defer close(done)
+		go func() {
+			for {
+				select {
+				case _, ok := <-fast:
+					if !ok {
+						return
+					}
+					select {
+					case got <- struct{}{}:
+					default:
+					}
+				case <-done:
+					return
+				}
+			}
+		}()
+
+		// Far more than the 8-slot buffer: Publish must never block on slow.
+		const n = 50
+		published := make(chan struct{})
+		go func() {
+			for i := range n {
+				b.Publish("topic", []byte{byte(i)})
+			}
+			close(published)
+		}()
+		select {
+		case <-published:
+		case <-time.After(recvTimeout):
+			t.Fatal("Publish blocked on slow subscriber")
+		}
+
+		// The fast subscriber still receives while slow is stuck.
+		select {
+		case <-got:
+		case <-time.After(recvTimeout):
+			t.Fatal("fast subscriber received nothing while slow subscriber stalled")
+		}
+	})
+}
+
+// recvWithin returns the next message or fails if none arrives before timeout.
+func recvWithin(t *testing.T, ch <-chan []byte, timeout time.Duration) []byte {
+	t.Helper()
+	select {
+	case msg, ok := <-ch:
+		require.True(t, ok, "channel closed before a message arrived")
+		return msg
+	case <-time.After(timeout):
+		t.Fatalf("timed out after %s waiting for a message", timeout)
+		return nil
+	}
+}
+
+// assertQuiet fails if any message arrives on ch within d.
+func assertQuiet(t *testing.T, ch <-chan []byte, d time.Duration) {
+	t.Helper()
+	select {
+	case msg := <-ch:
+		t.Fatalf("unexpected message: %s", msg)
+	case <-time.After(d):
+	}
+}
+
+func TestUserTopic(t *testing.T) {
+	assert.Equal(t, "user-42", UserTopic(42))
+	assert.Equal(t, "user-0", UserTopic(0))
+}

services/pubsub/init.go

@@ -0,0 +1,29 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pubsub
+
+import (
+	"fmt"
+
+	"gitea.dev/modules/setting"
+)
+
+// Init replaces DefaultBroker according to setting.Websocket. Called from
+// websocket.Init before the notifier is registered so subscribers wire up to
+// the configured backend.
+func Init() error {
+	switch setting.Websocket.PubsubType {
+	case setting.PubsubTypeMemory:
+		DefaultBroker = NewMemoryBroker()
+	case setting.PubsubTypeRedis:
+		b, err := NewRedisBroker(setting.Websocket.PubsubConnStr)
+		if err != nil {
+			return fmt.Errorf("pubsub: init redis backend: %w", err)
+		}
+		DefaultBroker = b
+	default:
+		return fmt.Errorf("pubsub: unknown PUBSUB_TYPE %q", setting.Websocket.PubsubType)
+	}
+	return nil
+}

services/pubsub/memory.go

@@ -0,0 +1,71 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pubsub
+
+import (
+	"sync"
+
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+)
+
+// MemoryBroker fans out within a single process. Suitable for single-instance
+// deployments; multi-process deployments need a backend that crosses processes.
+type MemoryBroker struct {
+	mu   sync.RWMutex
+	subs map[string][]chan []byte
+}
+
+var _ Broker = (*MemoryBroker)(nil)
+
+func NewMemoryBroker() *MemoryBroker {
+	return &MemoryBroker{
+		subs: make(map[string][]chan []byte),
+	}
+}
+
+func (b *MemoryBroker) Subscribe(topic string) (<-chan []byte, func()) {
+	ch := make(chan []byte, subChanBuffer)
+
+	b.mu.Lock()
+	b.subs[topic] = append(b.subs[topic], ch)
+	b.mu.Unlock()
+
+	var once sync.Once
+	cancel := func() {
+		once.Do(func() {
+			b.mu.Lock()
+			defer b.mu.Unlock()
+			subs := util.SliceRemoveAll(b.subs[topic], ch)
+			if len(subs) == 0 {
+				delete(b.subs, topic)
+			} else {
+				b.subs[topic] = subs
+			}
+			close(ch)
+		})
+	}
+	return ch, cancel
+}
+
+func (b *MemoryBroker) HasTopicSubscribers(topic string) bool {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	return len(b.subs[topic]) > 0
+}
+
+// Non-blocking: slow subscribers drop. RLock held across fan-out to block
+// cancel() from closing a channel between slice read and send.
+func (b *MemoryBroker) Publish(topic string, msg []byte) {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	for _, ch := range b.subs[topic] {
+		select {
+		case ch <- msg:
+		default:
+			log.Trace("pubsub: dropping message on topic %q — subscriber channel full", topic)
+		}
+	}
+}

services/pubsub/memory_test.go

@@ -0,0 +1,99 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pubsub
+
+import (
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestMemoryBroker runs the shared broker scenarios against MemoryBroker.
+// Memory delivers synchronously and tracks live subscribers exactly.
+func TestMemoryBroker(t *testing.T) {
+	testBrokerBasic(t, func(t *testing.T) Broker {
+		return NewMemoryBroker()
+	}, time.Second)
+}
+
+// MemoryBroker tracks live subscribers exactly, so it reports none once the last cancels.
+func TestMemoryBroker_HasNoTopicSubscribers(t *testing.T) {
+	b := NewMemoryBroker()
+	assert.False(t, b.HasTopicSubscribers("topic"))
+	_, cancel := b.Subscribe("topic")
+	cancel()
+	assert.False(t, b.HasTopicSubscribers("topic"))
+}
+
+// Backend-specific: MemoryBroker prunes empty topics from its internal map so
+// idle-user entries don't accumulate.
+func TestMemoryBroker_CancelDeletesEmptyTopic(t *testing.T) {
+	b := NewMemoryBroker()
+	_, cancel := b.Subscribe("topic")
+	cancel()
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	_, present := b.subs["topic"]
+	assert.False(t, present, "empty topic must be removed from the map so idle-user entries don't accumulate")
+}
+
+// Backend-specific: stresses MemoryBroker's cancel/Publish mutex interlock that
+// prevents send-on-closed-channel panics.
+func TestMemoryBroker_ConcurrentPublishSubscribeCancel(t *testing.T) {
+	b := NewMemoryBroker()
+
+	const writers = 4
+	const readers = 8
+	const duration = 200 * time.Millisecond
+
+	stop := make(chan struct{})
+	var wg sync.WaitGroup
+
+	var published atomic.Int64
+	for range writers {
+		wg.Go(func() {
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+					b.Publish("topic", []byte("x"))
+					published.Add(1)
+				}
+			}
+		})
+	}
+
+	for range readers {
+		wg.Go(func() {
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+					ch, cancel := b.Subscribe("topic")
+					// Drain a few messages then cancel - this exercises the
+					// cancel/Publish interlock that prevents send-on-closed.
+					for range 3 {
+						select {
+						case <-ch:
+						case <-time.After(10 * time.Millisecond):
+						}
+					}
+					cancel()
+				}
+			}
+		})
+	}
+
+	time.Sleep(duration)
+	close(stop)
+	wg.Wait()
+
+	// Test passes if no panic (send on closed channel) and no deadlock.
+	assert.Positive(t, published.Load())
+}

services/pubsub/redis.go

@@ -0,0 +1,190 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pubsub
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/nosql"
+	"gitea.dev/modules/util"
+
+	"github.com/redis/go-redis/v9"
+)
+
+const (
+	redisPingTimeout    = 3 * time.Second
+	redisPingRetries    = 10
+	redisPingRetryDelay = time.Second
+	redisPublishTimeout = 2 * time.Second
+)
+
+// RedisBroker fans out across processes via Redis pub/sub. Each topic is
+// backed by a single Redis SUBSCRIBE shared between local subscribers; the
+// last local Unsubscribe tears the Redis subscription down.
+type RedisBroker struct {
+	client redis.UniversalClient
+
+	mu     sync.RWMutex
+	topics map[string]*redisTopic
+}
+
+type redisTopic struct {
+	ps     *redis.PubSub
+	subs   []*redisSub
+	cancel context.CancelFunc
+}
+
+// redisSub pairs a delivery channel with the once that guards its close, so
+// either cancel() or readLoop's error-exit path can safely close it.
+type redisSub struct {
+	ch   chan []byte
+	once sync.Once
+}
+
+func (s *redisSub) close() { s.once.Do(func() { close(s.ch) }) }
+
+var _ Broker = (*RedisBroker)(nil)
+
+func redisChannelForTopic(s string) string {
+	return "gitea-ws-topic:" + s
+}
+
+func NewRedisBroker(connStr string) (*RedisBroker, error) {
+	client := nosql.GetManager().GetRedisClient(connStr)
+	// context.Background not graceful.ShutdownContext: shutdown ctx may not be initialized at boot.
+	// Retry to ride out docker-compose start-order races (matches modules/queue).
+	var err error
+	for range redisPingRetries {
+		pingCtx, cancel := context.WithTimeout(context.Background(), redisPingTimeout)
+		err = client.Ping(pingCtx).Err()
+		cancel()
+		if err == nil {
+			break
+		}
+		log.Warn("pubsub redis: not ready, retrying in 1s: %v", err)
+		time.Sleep(redisPingRetryDelay)
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &RedisBroker{
+		client: client,
+		topics: make(map[string]*redisTopic),
+	}, nil
+}
+
+func (b *RedisBroker) Subscribe(topic string) (<-chan []byte, func()) {
+	sub := &redisSub{ch: make(chan []byte, subChanBuffer)}
+
+	// Fast path: topic already has a Redis subscription, just attach locally.
+	b.mu.Lock()
+	if state, exists := b.topics[topic]; exists {
+		state.subs = append(state.subs, sub)
+		b.mu.Unlock()
+		return sub.ch, b.makeCancel(topic, sub)
+	}
+	b.mu.Unlock()
+
+	// Slow path: create the Redis subscription outside the broker mutex so
+	// other Subscribe/cancel calls aren't blocked on the network round-trip.
+	// graceful.ShutdownContext so the reader loop dies cleanly on Gitea
+	// shutdown even if every local subscriber has already cancelled.
+	// readLoop consumes the SUBSCRIBE ack; don't wait for it here, a direct
+	// ps.Receive blocks for its whole timeout instead of returning on the ack.
+	ctx, cancelCtx := context.WithCancel(graceful.GetManager().ShutdownContext())
+	ps := b.client.Subscribe(ctx, redisChannelForTopic(topic))
+	b.mu.Lock()
+	if existing, exists := b.topics[topic]; exists {
+		// Another goroutine won the create race; merge into theirs and discard ours.
+		existing.subs = append(existing.subs, sub)
+		b.mu.Unlock()
+		cancelCtx()
+		_ = ps.Close()
+		return sub.ch, b.makeCancel(topic, sub)
+	}
+	b.topics[topic] = &redisTopic{ps: ps, cancel: cancelCtx, subs: []*redisSub{sub}}
+	b.mu.Unlock()
+	go b.readLoop(ctx, topic, ps)
+	return sub.ch, b.makeCancel(topic, sub)
+}
+
+func (b *RedisBroker) makeCancel(topic string, sub *redisSub) func() {
+	return func() {
+		b.mu.Lock()
+		state, ok := b.topics[topic]
+		if !ok {
+			b.mu.Unlock()
+			sub.close()
+			return
+		}
+		state.subs = util.SliceRemoveAll(state.subs, sub)
+		if len(state.subs) == 0 {
+			state.cancel()
+			_ = state.ps.Close()
+			delete(b.topics, topic)
+		}
+		b.mu.Unlock()
+		sub.close()
+	}
+}
+
+func (b *RedisBroker) readLoop(ctx context.Context, topic string, ps *redis.PubSub) {
+	for {
+		msg, err := ps.ReceiveMessage(ctx)
+		if err != nil {
+			if ctx.Err() != nil {
+				return
+			}
+			// Transport blip: tear the topic down so a fresh Subscribe rebuilds it.
+			// Closing each subscriber's channel wakes the WebSocket handler, which
+			// will reconnect and re-Subscribe.
+			b.mu.Lock()
+			if cur, ok := b.topics[topic]; ok && cur.ps == ps {
+				for _, s := range cur.subs {
+					s.close()
+				}
+				cur.cancel()
+				_ = cur.ps.Close()
+				delete(b.topics, topic)
+			}
+			b.mu.Unlock()
+			log.Trace("pubsub redis: receive on %q: %v", topic, err)
+			return
+		}
+		payload := []byte(msg.Payload)
+		b.mu.RLock()
+		state, ok := b.topics[topic]
+		if !ok {
+			b.mu.RUnlock()
+			return
+		}
+		for _, s := range state.subs {
+			select {
+			case s.ch <- payload:
+			default:
+				log.Trace("pubsub redis: dropping message on topic %q — subscriber channel full", topic)
+			}
+		}
+		b.mu.RUnlock()
+	}
+}
+
+func (b *RedisBroker) Publish(topic string, msg []byte) {
+	ctx, cancel := context.WithTimeout(graceful.GetManager().HammerContext(), redisPublishTimeout)
+	defer cancel()
+	if err := b.client.Publish(ctx, redisChannelForTopic(topic), msg).Err(); err != nil {
+		log.Error("pubsub redis: publish to %q: %v", topic, err)
+	}
+}
+
+// HasTopicSubscribers conservatively returns true: cross-process subscriber
+// discovery via PUBSUB NUMSUB is per-node and would silently miss subscribers
+// in cluster mode. Publishers do the upstream lookup unconditionally.
+func (b *RedisBroker) HasTopicSubscribers(topic string) bool {
+	return true
+}

services/pubsub/redis_test.go

@@ -0,0 +1,71 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pubsub
+
+import (
+	"testing"
+	"time"
+
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRedisBroker runs the shared broker scenarios against a real Redis-backed
+// RedisBroker, plus the backend-specific ones. Delivery crosses a Redis
+// round-trip (hence the wider timeout) and HasTopicSubscribers answers
+// conservatively true, so subscriber tracking is not exact.
+// One redis-server is shared by all of them; starting one per test dominated
+// the package runtime.
+func TestRedisBroker(t *testing.T) {
+	redisConn := test.PrepareTestRedis(t)
+
+	newBroker := func(t *testing.T) Broker {
+		broker, err := NewRedisBroker(redisConn)
+		require.NoError(t, err)
+		return broker
+	}
+	testBrokerBasic(t, newBroker, 2*time.Second)
+
+	// RedisBroker cannot see other processes' subscribers, so it answers true even
+	// with none locally rather than risk dropping a push.
+	t.Run("HasTopicSubscribersWithoutAny", func(t *testing.T) {
+		assert.True(t, newBroker(t).HasTopicSubscribers("topic"))
+	})
+
+	// RedisBroker tears down its per-topic Redis subscription and internal
+	// state once the last local subscriber cancels.
+	t.Run("CancelCleansTopicState", func(t *testing.T) {
+		b := newBroker(t).(*RedisBroker)
+		ch, cancel := b.Subscribe("topic")
+		cancel()
+
+		_, ok := <-ch
+		assert.False(t, ok, "channel must be closed after cancel")
+
+		b.mu.RLock()
+		_, present := b.topics["topic"]
+		b.mu.RUnlock()
+		assert.False(t, present, "topic state must be removed after last subscriber cancels")
+	})
+
+	// Two RedisBroker instances sharing one Redis simulate two Gitea processes -
+	// a publish on one must reach a subscriber on the other.
+	t.Run("CrossBroker", func(t *testing.T) {
+		publisher, subscriber := newBroker(t), newBroker(t)
+
+		ch, cancel := subscriber.Subscribe("topic")
+		defer cancel()
+
+		publisher.Publish("topic", []byte("cross-process"))
+
+		select {
+		case msg := <-ch:
+			assert.Equal(t, []byte("cross-process"), msg)
+		case <-time.After(2 * time.Second):
+			t.Fatal("subscriber on second broker did not receive message")
+		}
+	})
+}

services/uinotification/notify.go

@@ -51,9 +51,15 @@ func NewNotifier() notify_service.Notifier {
 }
 
 func handler(items ...issueNotificationOpts) []issueNotificationOpts {
+	ctx := graceful.GetManager().ShutdownContext()
 	for _, opts := range items {
-		if err := activities_model.CreateOrUpdateIssueNotifications(graceful.GetManager().ShutdownContext(), opts.IssueID, opts.CommentID, opts.NotificationAuthorID, opts.ReceiverID); err != nil {
+		notifiedIDs, err := activities_model.CreateOrUpdateIssueNotifications(ctx, opts.IssueID, opts.CommentID, opts.NotificationAuthorID, opts.ReceiverID)
+		if err != nil {
 			log.Error("Was unable to create issue notification: %v", err)
+			continue
+		}
+		for _, userID := range notifiedIDs {
+			notify_service.NotificationCountChange(ctx, userID)
 		}
 	}
 	return nil

services/user/user.go

@@ -16,7 +16,6 @@ import (
 	repo_model "gitea.dev/models/repo"
 	system_model "gitea.dev/models/system"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/eventsource"
 	"gitea.dev/modules/git/gitrepo"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -29,6 +28,7 @@ import (
 	"gitea.dev/services/packages"
 	container_service "gitea.dev/services/packages/container"
 	repo_service "gitea.dev/services/repository"
+	websocket_service "gitea.dev/services/websocket"
 )
 
 // RenameUser renames a user
@@ -148,9 +148,7 @@ func DeleteUser(ctx context.Context, u *user_model.User, purge bool) error {
 
 		// Force any logged in sessions to log out
 		// FIXME: We also need to tell the session manager to log them out too.
-		eventsource.GetManager().SendMessage(u.ID, &eventsource.Event{
-			Name: "logout",
-		})
+		websocket_service.PublishLogout(u.ID, "")
 
 		// Delete all repos belonging to this user
 		// Now this is not within a transaction because there are internal transactions within the DeleteRepository

services/websocket/events.go

@@ -0,0 +1,53 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package websocket
+
+import (
+	"bytes"
+
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/pubsub"
+)
+
+// Wire contract with web_src/js/user-events.sharedworker.ts — keep in sync.
+const (
+	EventNotificationCount = "notification-count"
+	EventStopwatches       = "stopwatches"
+	EventLogout            = "logout"
+)
+
+type UserEventMessage[T any] struct {
+	EventType string `json:"eventType"`
+	EventData T      `json:"eventData"`
+}
+
+func publishUserEvent(userID int64, eventType string, eventData any) {
+	if pubsub.DefaultBroker == nil {
+		return
+	}
+	b := MakeUserEventMessage(eventType, eventData)
+	if b == nil {
+		return
+	}
+	pubsub.DefaultBroker.Publish(pubsub.UserTopic(userID), b)
+}
+
+func MakeUserEventMessage(eventType string, eventData any) []byte {
+	buf := &bytes.Buffer{}
+	buf.WriteString(eventType)
+	buf.WriteByte('\n')
+	err := json.MarshalWrite(buf, &UserEventMessage[any]{EventType: eventType, EventData: eventData})
+	payloadBytes := bytes.TrimSuffix(buf.Bytes(), []byte("\n")) // json v1 adds extra "\n" but we don't want it
+	if err != nil {
+		setting.PanicInDevOrTesting("websocket: marshal event: %v", err)
+		return nil
+	}
+	return payloadBytes
+}
+
+func ExtractUserEventMessage(b []byte) (string, []byte) {
+	eventType, eventDataBytes, _ := bytes.Cut(b, []byte("\n"))
+	return string(eventType), eventDataBytes
+}

services/websocket/logout_publisher.go

@@ -0,0 +1,12 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package websocket
+
+type LogoutEventData struct {
+	SessionID string `json:"sessionID,omitempty"`
+}
+
+func PublishLogout(userID int64, sessionID string) {
+	publishUserEvent(userID, EventLogout, LogoutEventData{SessionID: sessionID})
+}

services/websocket/notification_notifier.go

@@ -0,0 +1,39 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package websocket
+
+import (
+	"context"
+
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	notify_service "gitea.dev/services/notify"
+	"gitea.dev/services/pubsub"
+)
+
+type notificationCountEventData struct {
+	Count int64 `json:"count"`
+}
+
+type wsNotifier struct {
+	notify_service.NullNotifier
+}
+
+var _ notify_service.Notifier = &wsNotifier{}
+
+func (n *wsNotifier) NotificationCountChange(ctx context.Context, userID int64) {
+	if !pubsub.DefaultBroker.HasTopicSubscribers(pubsub.UserTopic(userID)) {
+		return
+	}
+	count, err := db.Count[activities_model.Notification](ctx, activities_model.FindNotificationOptions{
+		UserID: userID,
+		Status: []activities_model.NotificationStatus{activities_model.NotificationStatusUnread},
+	})
+	if err != nil {
+		log.Error("websocket: count notifications for user %d: %v", userID, err)
+		return
+	}
+	publishUserEvent(userID, EventNotificationCount, notificationCountEventData{Count: count})
+}

services/websocket/notifier.go

@@ -0,0 +1,18 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package websocket
+
+import (
+	notify_service "gitea.dev/services/notify"
+	"gitea.dev/services/pubsub"
+)
+
+func Init() error {
+	// the pubsub broker must be ready before the notifier starts publishing to it
+	if err := pubsub.Init(); err != nil {
+		return err
+	}
+	notify_service.RegisterNotifier(&wsNotifier{})
+	return nil
+}

services/websocket/stopwatch_notifier.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package websocket
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/pubsub"
+)
+
+func (n *wsNotifier) StopwatchChanged(ctx context.Context, user *user_model.User) {
+	if !pubsub.DefaultBroker.HasTopicSubscribers(pubsub.UserTopic(user.ID)) {
+		return
+	}
+
+	sws, err := issues_model.GetUserStopwatches(ctx, user.ID, db.ListOptions{})
+	if err != nil {
+		log.Error("websocket: GetUserStopwatches %d: %v", user.ID, err)
+		return
+	}
+
+	apiStopWatches, err := convert.ToStopWatches(ctx, user, sws)
+	if err != nil {
+		if !issues_model.IsErrIssueNotExist(err) {
+			log.Error("websocket: ToStopWatches: %v", err)
+		}
+		return
+	}
+	publishUserEvent(user.ID, EventStopwatches, util.SliceNilAsEmpty(apiStopWatches))
+}