PR #1822 - kelos-dev/kelos

What type of PR is this?

/kind feature

What this PR does / why we need it:

Reading a Session result in one browser leaves its unread marker visible in other browsers. Store the latest acknowledged completion with the Session so read state is shared across browsers and devices for the same signed-in user. Token-authenticated browsers share one read state.

The Console acknowledges a result only when its ending is visible in the focused Conversation. Other browsers receive the acknowledgment on their next Session refresh, normally within five seconds. Temporary save failures keep the marker unread and retry on refresh. Rejected requests (400, 403, and 404) stop retrying for that result until the page is reloaded; polling and visibility events do not restart them. A result seen before its status is published remains pending even if the user leaves that conversation.

Before — the second browser still shows the result as unread after it was read in the first browser

After — the same second browser clears the marker and count on refresh

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

Acknowledgments are stored in Session annotations, one value per authenticated username. They survive Console restarts and are removed with the Session. Each write prunes receipts for superseded results while preserving current readers and unrelated annotations. No CRD changes or new storage service are required.
The endpoint checks get sessions and patch sessions, verifies the Session UID and current completion ID, and uses optimistic locking. Stale acknowledgments cannot clear newer results or results from a replaced Session.
Removed browser-only receipt storage, pruning, storage-event synchronization, and their tests. The tests and reference now describe shared read state.
Tests cover permanent rejection suppression, transient retries, receipt pruning, user isolation, and concurrent updates. Invalid annotation writes return 400 so they are not retried as server outages.
Validation: make update, make verify, and make test passed. Unit tests ran with agent-specific CODEX_HOME and CODEX_AUTH_JSON variables unset.
make test-integration TEST_FLAGS='-run TestConsole' passed: Console membership, OIDC, and GitHub authentication tests. The proxy tests use separate authenticated cookie jars to verify shared acknowledgments against Kubernetes.
Chromium checked the actual frontend with API and WebSocket fixtures in independent browser contexts, reproduced the baseline behavior, verified synchronization and reload persistence, and captured the matching screenshots above. Screenshots are PR attachments, not repository files.

Does this PR introduce a user-facing change?

Session unread markers synchronize across browsers and devices for the same signed-in user. Reading a result clears its marker in other browsers on their next refresh. Token-authenticated browsers share a common read state.

Summary by cubic

Reading a Session result in one browser no longer leaves its unread marker visible in other browsers. Read acknowledgments are now stored with the Session, so browsers and devices for the same signed-in user share the read state; token-authenticated browsers share one state.

Key changes

The frontend acknowledges a result only when its ending is visible in the focused conversation, and other browsers pick it up on the next Session refresh, normally within five seconds.
A new POST /api/sessions/{namespace}/{name}/read endpoint stores the acknowledgment as a Session annotation using optimistic locking, and now requires get sessions and patch sessions permissions; stale acknowledgments cannot clear newer results or replaced Sessions.
Failed saves keep the marker unread and retry on refresh; the previous browser-local receipt storage, pruning, and storage-event synchronization were removed along with their tests.