diff --git a/NOSTR.md b/NOSTR.md
index 96ccb0edc0..1af2bcd303 100644
--- a/NOSTR.md
+++ b/NOSTR.md
@@ -142,11 +142,15 @@ can read. It is an ordinary channel in every other way, but queries leave it
 out unless they ask for it:
 
 - A filter that does not name it, for example a REQ with no `#h`, a COUNT,
-  a NIP-50 search, or kind:39002 `#p:[me]`, does not return it.
+  a NIP-50 search, or kind:39002 `#p:[me]`, does not return it. Such a
+  filter returns only the legacy channel types (`stream`, `forum`, `dm`,
+  `workflow`), so a channel type added later is also left out.
 - A filter that names it with `#h`, or with `#d` on kinds 39000–39003, reads
-  it under the ordinary rules: the reader is a member, or it is open.
+  it under the ordinary rules: the reader is a member, or it is open. A
+  channel of a type added later is read the same way.
 - A filter on kinds 39000–39003 with `#t:["system"]` or any `#P` also
   returns the system channels the reader can read, then matches as usual.
+  It does not return channels of a type added later.
   For example, `{kinds:[39000], #P:[<creator>], #t:[<label>]}` finds one
   creator's labeled channel, system or not. Values in one tag filter
   combine with OR, so `#t:["system", <label>]` does not mean "a system
diff --git a/crates/buzz-core/src/channel.rs b/crates/buzz-core/src/channel.rs
index e9b68c17af..a74ae257ae 100644
--- a/crates/buzz-core/src/channel.rs
+++ b/crates/buzz-core/src/channel.rs
@@ -188,6 +188,19 @@ pub enum ChannelType {
     System,
 }
 
+/// The channel types that every client knew before NIP-CL added new ones.
+///
+/// A client sees a channel only if it knows the channel's type. Queries that
+/// do not ask for a type therefore return only these types. Every other type,
+/// including any type added later, stays hidden unless a filter asks for it.
+///
+/// It is also the rule for membership notices (kind 44100/44101): a filter
+/// without `#t` sees notices only about these types.
+///
+/// Frozen. Do not add a type here: a new type must stay hidden from clients
+/// that do not know it, so it needs its own opt-in.
+pub const LEGACY_CHANNEL_TYPES: [&str; 4] = ["stream", "forum", "dm", "workflow"];
+
 impl ChannelType {
     /// Canonical string representation (matches DB enum and Nostr tags).
     pub fn as_str(&self) -> &'static str {
@@ -315,10 +328,18 @@ impl FromStr for MemberRole {
 mod tests {
     use super::{
         canonical_channel_name, channel_type_from_group_state_tags, group_state_identity_tags,
-        parse_channel_labels, ChannelLabelError, ChannelType, MAX_CHANNEL_LABELS,
-        RESERVED_CHANNEL_LABELS,
+        parse_channel_labels, ChannelLabelError, ChannelType, LEGACY_CHANNEL_TYPES,
+        MAX_CHANNEL_LABELS, RESERVED_CHANNEL_LABELS,
     };
 
+    #[test]
+    fn only_the_types_from_before_nip_cl_are_legacy() {
+        for name in LEGACY_CHANNEL_TYPES {
+            let _: ChannelType = name.parse().expect("legacy type parses");
+        }
+        assert!(!LEGACY_CHANNEL_TYPES.contains(&ChannelType::System.as_str()));
+    }
+
     /// Every channel type name is reserved, so a label cannot pose as a type.
     /// The `match` has no wildcard: a new `ChannelType` variant does not
     /// compile until it is added to `ALL` here, and then this test fails
diff --git a/crates/buzz-core/src/filter.rs b/crates/buzz-core/src/filter.rs
index 43753df94d..2a0ef391f2 100644
--- a/crates/buzz-core/src/filter.rs
+++ b/crates/buzz-core/src/filter.rs
@@ -4,6 +4,7 @@
 
 use nostr::Filter;
 
+use crate::channel::LEGACY_CHANNEL_TYPES;
 use crate::event::StoredEvent;
 
 /// Returns `true` if the event matches any of the provided NIP-01 filters.
@@ -43,21 +44,14 @@ pub const MEMBERSHIP_NOTICE_KINDS: [u32; 2] = [
 /// The tag name that carries a membership notice's channel type.
 pub const NOTICE_CHANNEL_TYPE_TAG: &str = "t";
 
-/// The channel types that clients knew before NIP-CL typed membership
-/// notices. A filter without `#t` sees notices only about these types, and a
-/// notice without a type tag (stored before NIP-CL) counts as all of them.
-///
-/// Frozen. Do not add a type here: a type added later stays hidden from every
-/// client that does not name it in `#t`.
-pub const LEGACY_NOTICE_CHANNEL_TYPES: [&str; 4] = ["stream", "forum", "dm", "workflow"];
-
 /// Whether `event` is a membership notice (kind 44100/44101).
 pub fn is_membership_notice(event: &nostr::Event) -> bool {
     MEMBERSHIP_NOTICE_KINDS.contains(&crate::kind::event_kind_u32(event))
 }
 
 /// The channel types whose membership notices `filter` may see: its `#t`
-/// values, or [`LEGACY_NOTICE_CHANNEL_TYPES`] when it has no `#t`.
+/// values, or [`LEGACY_CHANNEL_TYPES`] when it has no `#t`. A notice without
+/// a type tag (stored before NIP-CL) counts as every legacy type.
 ///
 /// This is the one rule for notice visibility (NIP-CL). [`filters_match`]
 /// applies it, and `EventQuery::notice_channel_types` applies it in SQL.
@@ -76,7 +70,7 @@ pub fn notice_channel_types(filter: &Filter) -> Option<Vec<String>> {
 pub fn notice_visible(visible: Option<&[String]>, event: &nostr::Event) -> bool {
     let is_visible = |channel_type: &str| match visible {
         Some(types) => types.iter().any(|t| t == channel_type),
-        None => LEGACY_NOTICE_CHANNEL_TYPES.contains(&channel_type),
+        None => LEGACY_CHANNEL_TYPES.contains(&channel_type),
     };
     let mut tagged = false;
     for tag in event.tags.iter() {
@@ -92,7 +86,7 @@ pub fn notice_visible(visible: Option<&[String]>, event: &nostr::Event) -> bool
             return true;
         }
     }
-    !tagged && LEGACY_NOTICE_CHANNEL_TYPES.iter().any(|t| is_visible(t))
+    !tagged && LEGACY_CHANNEL_TYPES.iter().any(|t| is_visible(t))
 }
 
 fn filter_match_one(f: &Filter, ev: &StoredEvent) -> bool {
diff --git a/crates/buzz-db/src/store/artifact_postgres_tests.rs b/crates/buzz-db/src/store/artifact_postgres_tests.rs
index 90aaf69272..a6ea1d0e09 100644
--- a/crates/buzz-db/src/store/artifact_postgres_tests.rs
+++ b/crates/buzz-db/src/store/artifact_postgres_tests.rs
@@ -23,7 +23,10 @@ impl Fixture {
         if std::env::var("BUZZ_TEST_SCHEMA_MODE").as_deref() != Ok("desired") {
             crate::migration::run_migrations(&pool).await.unwrap();
         }
-        let db = Db::from_pool(pool);
+        Self::on(Db::from_pool(pool)).await
+    }
+    /// The fixture on `db`, which is already migrated.
+    async fn on(db: Db) -> Self {
         db.maintain_partitions(
             1,
             crate::partition::PartitionMaintenancePolicy {
@@ -297,6 +300,67 @@ async fn system_channel_artifacts_are_read_only_by_name() {
     }
 }
 
+/// An artifact in a channel of a type added later is read only by a query
+/// whose `#h` names that channel, like a system channel (NIP-CL).
+/// Mutation: put back `c.channel_type <> 'system'` in `query_artifacts` → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn artifacts_of_a_later_channel_type_are_read_only_by_name() {
+    use super::legacy_channel_types_postgres_tests::{scratch_db_with_future_type, FUTURE_TYPE};
+    let (db, admin, name) = scratch_db_with_future_type().await;
+    let f = Fixture::on(db).await;
+    let later = Uuid::new_v4();
+    sqlx::query("INSERT INTO channels(community_id,id,name,visibility,channel_type,created_by) VALUES($1,$2,$3,'open',$4::channel_type,$5)")
+        .bind(f.community.as_uuid())
+        .bind(later)
+        .bind(later.to_string())
+        .bind(FUTURE_TYPE)
+        .bind(f.owner.public_key().to_bytes().as_slice())
+        .execute(&f.db.pool)
+        .await
+        .unwrap();
+    let mut ds = Vec::new();
+    for home in [f.a, later] {
+        let d = Uuid::new_v4();
+        let create = f.revision(d, "create", home, None, &f.owner, vec![]);
+        assert!(matches!(
+            f.accept(&create, None).await,
+            ArtifactOutcome::Accepted(_)
+        ));
+        let update = f.revision(d, "update", home, Some(&create), &f.owner, vec![]);
+        assert!(matches!(
+            f.accept(&update, None).await,
+            ArtifactOutcome::Accepted(_)
+        ));
+        ds.push(d.to_string());
+    }
+    // History needs `#d`; both queries name both artifacts.
+    for (view, per_channel) in [("current", 1), ("history", 2)] {
+        let unnamed = serde_json::json!({ "artifact": view, "#d": ds });
+        let (events, _) = f.query(&f.owner, unnamed.clone(), false).await;
+        let homes: Vec<_> = events.iter().map(|e| e.channel_id).collect();
+        assert_eq!(homes, vec![Some(f.a); per_channel], "{view} without #h");
+        assert_eq!(f.count(&f.owner, unnamed).await, per_channel as i64);
+
+        let named = serde_json::json!({ "artifact": view, "#d": ds, "#h": [later.to_string()] });
+        let (events, _) = f.query(&f.owner, named.clone(), false).await;
+        let homes: Vec<_> = events.iter().map(|e| e.channel_id).collect();
+        assert_eq!(
+            homes,
+            vec![Some(later); per_channel],
+            "{view} #h names the channel"
+        );
+        assert_eq!(f.count(&f.owner, named).await, per_channel as i64);
+    }
+
+    f.db.pool.close().await;
+    let _ = sqlx::query(sqlx::AssertSqlSafe(format!(
+        "DROP DATABASE IF EXISTS {name} WITH (FORCE)"
+    )))
+    .execute(&admin)
+    .await;
+}
+
 #[tokio::test]
 #[ignore = "requires Postgres"]
 async fn repeated_moves_get_distinct_source_safe_markers() {
diff --git a/crates/buzz-db/src/store/artifact_query.rs b/crates/buzz-db/src/store/artifact_query.rs
index fcc4669575..c0658a0b68 100644
--- a/crates/buzz-db/src/store/artifact_query.rs
+++ b/crates/buzz-db/src/store/artifact_query.rs
@@ -46,7 +46,9 @@ impl Db {
             .collect();
         // The explicit kind lets the community/kind index exclude chat before
         // the join, even for an unfiltered current-state page.
-        qb.push("WHERE e.community_id=").push_bind(community.as_uuid()).push(" AND e.kind=45010 AND e.deleted_at IS NULL AND EXISTS (SELECT 1 FROM channels c WHERE c.community_id=e.community_id AND c.id=e.channel_id AND c.deleted_at IS NULL AND (c.channel_type<>'system' OR c.id=ANY(")
+        qb.push("WHERE e.community_id=").push_bind(community.as_uuid()).push(" AND e.kind=45010 AND e.deleted_at IS NULL AND EXISTS (SELECT 1 FROM channels c WHERE c.community_id=e.community_id AND c.id=e.channel_id AND c.deleted_at IS NULL AND (")
+            .push(crate::store::channel::legacy_channel_type_sql("c.channel_type"))
+            .push(" OR c.id=ANY(")
             .push_bind(named_channels)
             .push(")) AND (c.visibility='open' OR EXISTS (SELECT 1 FROM channel_members m WHERE m.community_id=c.community_id AND m.channel_id=c.id AND m.pubkey=")
             .push_bind(reader.to_vec()).push(" AND m.removed_at IS NULL)))");
diff --git a/crates/buzz-db/src/store/channel.rs b/crates/buzz-db/src/store/channel.rs
index e456f46dfb..a4f1148335 100644
--- a/crates/buzz-db/src/store/channel.rs
+++ b/crates/buzz-db/src/store/channel.rs
@@ -426,6 +426,20 @@ async fn insert_channel_rows(
     Ok(was_created)
 }
 
+/// SQL that is true when `column` holds a legacy channel type
+/// ([`buzz_core::channel::LEGACY_CHANNEL_TYPES`]): `<column> IN ('stream', …)`.
+///
+/// A query that a client did not ask to widen uses this, not
+/// `<> 'system'`, so a channel type added later stays hidden (NIP-CL).
+pub(crate) fn legacy_channel_type_sql(column: &str) -> String {
+    let types = buzz_core::channel::LEGACY_CHANNEL_TYPES
+        .iter()
+        .map(|channel_type| format!("'{channel_type}'"))
+        .collect::<Vec<_>>()
+        .join(", ");
+    format!("{column} IN ({types})")
+}
+
 /// Fetches a channel record by `(community_id, id)`. Returns `ChannelNotFound` if missing or deleted.
 pub async fn get_channel(
     pool: &PgPool,
diff --git a/crates/buzz-db/src/store/channel_members.rs b/crates/buzz-db/src/store/channel_members.rs
index 9e7679e0c3..b92cc4aaa4 100644
--- a/crates/buzz-db/src/store/channel_members.rs
+++ b/crates/buzz-db/src/store/channel_members.rs
@@ -1207,9 +1207,11 @@ pub async fn get_members_bulk(
 /// Includes channels where the pubkey is an active member AND all open channels.
 /// Open channels must be included in REQ filter resolution.
 ///
-/// System channels are left out of both halves: this is the implicit scope of
-/// queries that do not name a channel. A query that names a system channel,
-/// or opts in to them, adds them from [`get_readable_system_channel_ids`].
+/// Only legacy channel types are in either half
+/// ([`buzz_core::channel::LEGACY_CHANNEL_TYPES`]): this is the implicit scope
+/// of queries that do not name a channel, so system channels and any type
+/// added later stay out. A query that names such a channel, or opts in to
+/// system channels, adds them from [`get_readable_named_only_channels`].
 pub async fn get_accessible_channel_ids(
     pool: &PgPool,
     community_id: CommunityId,
@@ -1220,24 +1222,28 @@ pub async fn get_accessible_channel_ids(
         crate::observability::WriterOperation::Authorization,
     )
     .await?;
-    let rows = sqlx::query(
+    let sql = format!(
         r#"
         SELECT cm.channel_id
         FROM channel_members cm
         JOIN channels c ON cm.community_id = c.community_id AND cm.channel_id = c.id AND c.deleted_at IS NULL
         WHERE cm.community_id = $1 AND cm.pubkey = $2 AND cm.removed_at IS NULL
-          AND c.channel_type <> 'system'
+          AND {member_types}
         UNION
         SELECT id AS channel_id
         FROM channels
         WHERE community_id = $1 AND visibility = 'open' AND deleted_at IS NULL
-          AND channel_type <> 'system'
+          AND {open_types}
         "#,
-    )
-    .bind(community_id.as_uuid())
-    .bind(pubkey)
-    .fetch_all(&mut *connection)
-    .await?;
+        member_types = crate::store::channel::legacy_channel_type_sql("c.channel_type"),
+        open_types = crate::store::channel::legacy_channel_type_sql("channel_type"),
+    );
+    // Built only from the constant type list.
+    let rows = sqlx::query(sqlx::AssertSqlSafe(sql))
+        .bind(community_id.as_uuid())
+        .bind(pubkey)
+        .fetch_all(&mut *connection)
+        .await?;
 
     rows.into_iter()
         .map(|r| {
@@ -1247,24 +1253,30 @@ pub async fn get_accessible_channel_ids(
         .collect()
 }
 
-/// Get the system channels a pubkey can read: those where it is an active
-/// member, and every open system channel. Uncached, so a caller can trust it
-/// for a channel the request names.
-pub async fn get_readable_system_channel_ids(
+/// The channels of non-legacy types (system channels, and any type added
+/// later) that a pubkey can read: those where it is an active member, and
+/// every open one. Each comes with its type. Uncached, so a caller can trust
+/// it for a channel the request names.
+///
+/// These are the channels that [`get_accessible_channel_ids`] leaves out. A
+/// read reaches one only by naming it, or, for system channels, by opting in
+/// to them.
+pub async fn get_readable_named_only_channels(
     pool: &PgPool,
     community_id: CommunityId,
     pubkey: &[u8],
-) -> Result<Vec<Uuid>> {
+) -> Result<Vec<(Uuid, String)>> {
     let mut connection = crate::observability::acquire_writer(
         pool,
         crate::observability::WriterOperation::Authorization,
     )
     .await?;
-    let rows = sqlx::query(
+    let sql = format!(
         r#"
-        SELECT c.id AS channel_id
+        SELECT c.id AS channel_id, c.channel_type::text AS channel_type
         FROM channels c
-        WHERE c.community_id = $1 AND c.deleted_at IS NULL AND c.channel_type = 'system'
+        WHERE c.community_id = $1 AND c.deleted_at IS NULL
+          AND NOT {legacy_types}
           AND (
             c.visibility = 'open'
             OR EXISTS (
@@ -1274,17 +1286,17 @@ pub async fn get_readable_system_channel_ids(
             )
           )
         "#,
-    )
-    .bind(community_id.as_uuid())
-    .bind(pubkey)
-    .fetch_all(&mut *connection)
-    .await?;
+        legacy_types = crate::store::channel::legacy_channel_type_sql("c.channel_type"),
+    );
+    // Built only from the constant type list.
+    let rows = sqlx::query(sqlx::AssertSqlSafe(sql))
+        .bind(community_id.as_uuid())
+        .bind(pubkey)
+        .fetch_all(&mut *connection)
+        .await?;
 
     rows.into_iter()
-        .map(|r| {
-            let id: Uuid = r.try_get("channel_id")?;
-            Ok(id)
-        })
+        .map(|r| Ok((r.try_get("channel_id")?, r.try_get("channel_type")?)))
         .collect()
 }
 
@@ -1334,6 +1346,35 @@ pub async fn system_channel_ids_among(
     .await?)
 }
 
+/// The channels in `channel_ids` whose type is not a legacy type
+/// ([`buzz_core::channel::LEGACY_CHANNEL_TYPES`]), deleted or not, each with
+/// its type: system channels and any type added later. A filter reads them
+/// only by naming them.
+pub async fn named_only_channels_among(
+    pool: &PgPool,
+    community_id: CommunityId,
+    channel_ids: &[Uuid],
+) -> Result<Vec<(Uuid, String)>> {
+    if channel_ids.is_empty() {
+        return Ok(Vec::new());
+    }
+    let mut connection = crate::observability::acquire_writer(
+        pool,
+        crate::observability::WriterOperation::Authorization,
+    )
+    .await?;
+    let sql = format!(
+        "SELECT id, channel_type::text FROM channels \
+         WHERE community_id = $1 AND id = ANY($2) AND NOT {}",
+        crate::store::channel::legacy_channel_type_sql("channel_type")
+    );
+    Ok(sqlx::query_as(sqlx::AssertSqlSafe(sql))
+        .bind(community_id.as_uuid())
+        .bind(channel_ids)
+        .fetch_all(&mut *connection)
+        .await?)
+}
+
 /// A large channel whose canonical active-member count may need its legacy
 /// discovery snapshot repaired.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -1559,8 +1600,9 @@ pub async fn get_accessible_channels(
         WHERE c.community_id = $1 AND c.deleted_at IS NULL
           {membership_clause}
           AND (c.channel_type != 'dm' OR cm.hidden_at IS NULL)
-          AND c.channel_type <> 'system'
-    "#
+          AND {legacy_types}
+    "#,
+        legacy_types = crate::store::channel::legacy_channel_type_sql("c.channel_type"),
     );
 
     let sql = if visibility_filter.is_some() {
@@ -1965,14 +2007,15 @@ impl Db {
         get_accessible_channel_ids(&self.pool, community_id, pubkey).await
     }
 
-    /// Get the system channels a pubkey can read (member, or open).
-    #[datastore_span(name = "get_readable_system_channel_ids", system = "postgresql")]
-    pub async fn get_readable_system_channel_ids(
+    /// The channels of non-legacy types a pubkey can read (member, or open),
+    /// each with its type.
+    #[datastore_span(name = "get_readable_named_only_channels", system = "postgresql")]
+    pub async fn get_readable_named_only_channels(
         &self,
         community_id: CommunityId,
         pubkey: &[u8],
-    ) -> Result<Vec<Uuid>> {
-        get_readable_system_channel_ids(&self.pool, community_id, pubkey).await
+    ) -> Result<Vec<(Uuid, String)>> {
+        get_readable_named_only_channels(&self.pool, community_id, pubkey).await
     }
 
     /// The type of channel `channel_id`, deleted or not, or `None` when no
@@ -1996,6 +2039,17 @@ impl Db {
         system_channel_ids_among(&self.pool, community_id, channel_ids).await
     }
 
+    /// The channels in `channel_ids` whose type is not a legacy type, deleted
+    /// or not, each with its type.
+    #[datastore_span(name = "named_only_channels_among", system = "postgresql")]
+    pub async fn named_only_channels_among(
+        &self,
+        community_id: CommunityId,
+        channel_ids: &[Uuid],
+    ) -> Result<Vec<(Uuid, String)>> {
+        named_only_channels_among(&self.pool, community_id, channel_ids).await
+    }
+
     /// Returns large active-channel rosters whose relay-authored snapshots differ.
     #[datastore_span(
         name = "list_large_channel_rosters_needing_reconciliation",
diff --git a/crates/buzz-db/src/store/event.rs b/crates/buzz-db/src/store/event.rs
index da685f6fe6..0a7d87118c 100644
--- a/crates/buzz-db/src/store/event.rs
+++ b/crates/buzz-db/src/store/event.rs
@@ -928,9 +928,8 @@ fn push_tag_value_filters(
 /// cannot take page slots. Skipped when the query's kinds cannot match a
 /// notice.
 fn push_notice_visibility(qb: &mut QueryBuilder<sqlx::Postgres>, col_prefix: &str, q: &EventQuery) {
-    use buzz_core::filter::{
-        LEGACY_NOTICE_CHANNEL_TYPES, MEMBERSHIP_NOTICE_KINDS, NOTICE_CHANNEL_TYPE_TAG,
-    };
+    use buzz_core::channel::LEGACY_CHANNEL_TYPES;
+    use buzz_core::filter::{MEMBERSHIP_NOTICE_KINDS, NOTICE_CHANNEL_TYPE_TAG};
     if let Some(kinds) = q.kinds.as_deref() {
         if !kinds
             .iter()
@@ -941,14 +940,14 @@ fn push_notice_visibility(qb: &mut QueryBuilder<sqlx::Postgres>, col_prefix: &st
     }
     let visible: Vec<String> = match &q.notice_channel_types {
         Some(types) => types.clone(),
-        None => LEGACY_NOTICE_CHANNEL_TYPES
+        None => LEGACY_CHANNEL_TYPES
             .iter()
             .map(|t| (*t).to_owned())
             .collect(),
     };
     let untagged_visible = visible
         .iter()
-        .any(|t| LEGACY_NOTICE_CHANNEL_TYPES.contains(&t.as_str()));
+        .any(|t| LEGACY_CHANNEL_TYPES.contains(&t.as_str()));
     let [added, removed] = MEMBERSHIP_NOTICE_KINDS;
     qb.push(format!(
         " AND ({col_prefix}kind NOT IN ({added}, {removed}) OR "
diff --git a/crates/buzz-db/src/store/legacy_channel_types_postgres_tests.rs b/crates/buzz-db/src/store/legacy_channel_types_postgres_tests.rs
new file mode 100644
index 0000000000..d13823f81e
--- /dev/null
+++ b/crates/buzz-db/src/store/legacy_channel_types_postgres_tests.rs
@@ -0,0 +1,158 @@
+//! A read that does not name a channel returns only the legacy channel types
+//! (NIP-CL). The relay must leave out a channel type that it adds later, not
+//! only `system`: a client sees a channel only if it knows the channel's type.
+
+use crate::Db;
+use buzz_core::CommunityId;
+use nostr::Keys;
+use sqlx::PgPool;
+use uuid::Uuid;
+
+/// A channel type that no client knows. The test adds it to the enum of a
+/// scratch database, as a later migration would.
+pub(super) const FUTURE_TYPE: &str = "future_type";
+
+/// A migrated scratch database with [`FUTURE_TYPE`] in `channel_type`, so the
+/// shared test database keeps its schema. Returns `(db, admin, name)`.
+pub(super) async fn scratch_db_with_future_type() -> (Db, PgPool, String) {
+    let url = crate::test_support::database_url();
+    let admin = PgPool::connect(&url).await.expect("connect admin");
+    let name = format!("legacy_types_{}", Uuid::new_v4().simple());
+    sqlx::query(sqlx::AssertSqlSafe(format!("CREATE DATABASE {name}")))
+        .execute(&admin)
+        .await
+        .expect("create scratch db");
+    let base = &url[..url.rfind('/').expect("db url has a path")];
+    let pool = PgPool::connect(&format!("{base}/{name}"))
+        .await
+        .expect("connect scratch db");
+    crate::migration::run_migrations(&pool)
+        .await
+        .expect("migrate scratch db");
+    sqlx::query(sqlx::AssertSqlSafe(format!(
+        "ALTER TYPE channel_type ADD VALUE '{FUTURE_TYPE}'"
+    )))
+    .execute(&pool)
+    .await
+    .expect("add future channel type");
+    (Db::from_pool(pool), admin, name)
+}
+
+async fn insert_channel(
+    pool: &PgPool,
+    community: CommunityId,
+    channel_type: &str,
+    visibility: &str,
+    member: Option<&Keys>,
+) -> Uuid {
+    let id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO channels(community_id,id,name,visibility,channel_type,created_by)
+         VALUES($1,$2,$3,$4::channel_visibility,$5::channel_type,$6)",
+    )
+    .bind(community.as_uuid())
+    .bind(id)
+    .bind(format!("{channel_type}-{visibility}"))
+    .bind(visibility)
+    .bind(channel_type)
+    .bind(Keys::generate().public_key().to_bytes().as_slice())
+    .execute(pool)
+    .await
+    .expect("insert channel");
+    if let Some(member) = member {
+        sqlx::query(
+            "INSERT INTO channel_members(community_id,channel_id,pubkey,role)
+             VALUES($1,$2,$3,'member')",
+        )
+        .bind(community.as_uuid())
+        .bind(id)
+        .bind(member.public_key().to_bytes().as_slice())
+        .execute(pool)
+        .await
+        .expect("insert member");
+    }
+    id
+}
+
+/// Mutation: put back `channel_type <> 'system'` in
+/// `get_accessible_channel_ids`, `get_accessible_channels` or the sidebar
+/// roster → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn reads_that_name_no_channel_leave_out_a_type_added_later() {
+    let (db, admin, name) = scratch_db_with_future_type().await;
+    let pool = db.pool.clone();
+    let community = CommunityId::from_uuid(Uuid::new_v4());
+    sqlx::query("INSERT INTO communities(id,host) VALUES($1,$2)")
+        .bind(community.as_uuid())
+        .bind(format!("legacy-types-{}.test", community.as_uuid()))
+        .execute(&pool)
+        .await
+        .expect("insert community");
+    let reader = Keys::generate();
+    sqlx::query(
+        "INSERT INTO personal_read_accounts(community_id,actor,started_at)
+         VALUES($1,$2,'1900-01-01T00:00:00Z')",
+    )
+    .bind(community.as_uuid())
+    .bind(reader.public_key().to_bytes().as_slice())
+    .execute(&pool)
+    .await
+    .expect("start read account");
+
+    let mut legacy = Vec::new();
+    for channel_type in buzz_core::channel::LEGACY_CHANNEL_TYPES {
+        legacy.push(insert_channel(&pool, community, channel_type, "private", Some(&reader)).await);
+    }
+    let open_legacy = insert_channel(&pool, community, "stream", "open", None).await;
+    for (visibility, member) in [("open", None), ("private", Some(&reader))] {
+        insert_channel(&pool, community, FUTURE_TYPE, visibility, member).await;
+        insert_channel(&pool, community, "system", visibility, member).await;
+    }
+    let mut expected = legacy.clone();
+    expected.push(open_legacy);
+    expected.sort();
+
+    let reader_bytes = reader.public_key().to_bytes();
+    let mut ids = db
+        .get_accessible_channel_ids(community, &reader_bytes)
+        .await
+        .expect("accessible channel ids");
+    ids.sort();
+    assert_eq!(ids, expected, "get_accessible_channel_ids");
+
+    let mut listed: Vec<Uuid> = db
+        .get_accessible_channels(community, &reader_bytes, None, None)
+        .await
+        .expect("accessible channels")
+        .into_iter()
+        .map(|channel| channel.channel.id)
+        .collect();
+    listed.sort();
+    assert_eq!(listed, expected, "get_accessible_channels");
+
+    let mut joined: Vec<Uuid> = db
+        .personal_read_sidebar(
+            community,
+            &reader.public_key(),
+            crate::store::personal_read::DEFAULT_RETENTION_SECONDS,
+            20,
+            None,
+        )
+        .await
+        .expect("sidebar")
+        .channels
+        .into_iter()
+        .map(|channel| channel.channel_id)
+        .collect();
+    joined.sort();
+    legacy.sort();
+    assert_eq!(joined, legacy, "sidebar roster");
+
+    db.pool.close().await;
+    let _ = sqlx::query(sqlx::AssertSqlSafe(format!(
+        "DROP DATABASE IF EXISTS {name} WITH (FORCE)"
+    )))
+    .execute(&admin)
+    .await;
+}
diff --git a/crates/buzz-db/src/store/mod.rs b/crates/buzz-db/src/store/mod.rs
index f759a770a2..6850b625cf 100644
--- a/crates/buzz-db/src/store/mod.rs
+++ b/crates/buzz-db/src/store/mod.rs
@@ -81,5 +81,8 @@ mod artifact_query;
 #[cfg(test)]
 mod artifact_postgres_tests;
 
+#[cfg(test)]
+mod legacy_channel_types_postgres_tests;
+
 #[cfg(test)]
 mod admission_postgres_tests;
diff --git a/crates/buzz-db/src/store/personal_read/projection.rs b/crates/buzz-db/src/store/personal_read/projection.rs
index 873b41a71a..54f2e828e4 100644
--- a/crates/buzz-db/src/store/personal_read/projection.rs
+++ b/crates/buzz-db/src/store/personal_read/projection.rs
@@ -91,16 +91,16 @@ impl Db {
         // anything counted; the shallow probe answers only when the horizon
         // holds no top-level message. Thread replies are never the timeline's
         // latest: a timeline mark cannot use one as its anchor.
-        let rows = sqlx::query(
-            r#"WITH roster AS MATERIALIZED (
+        // `replace`, not `format!`: the SQL has regex braces.
+        let sql = r#"WITH roster AS MATERIALIZED (
                 SELECT c.id,c.channel_type::text AS channel_type
                 FROM channel_members cm JOIN channels c
                     ON c.community_id=cm.community_id AND c.id=cm.channel_id
                 WHERE cm.community_id=$1 AND cm.pubkey=$2 AND cm.removed_at IS NULL
                     AND c.deleted_at IS NULL AND ($3::uuid IS NULL OR c.id>$3)
                     AND ($9::uuid[] IS NULL OR c.id=ANY($9))
-                    -- System channels only when the request names them.
-                    AND ($9::uuid[] IS NOT NULL OR c.channel_type<>'system')
+                    -- Other channel types only when the request names them.
+                    AND ($9::uuid[] IS NOT NULL OR {legacy_types})
                 ORDER BY c.id LIMIT $4
              )
              SELECT r.*, COALESCE(e.latest_id, latest.latest_id) AS latest_id,
@@ -189,16 +189,28 @@ impl Db {
                         FILTER (WHERE NOT is_reply AND NOT unresolved))[1] AS latest_id,
                     (SELECT jsonb_agg(to_jsonb(grouped)) FROM grouped) AS evidence
                 FROM threaded
-             ) e ON true ORDER BY r.id"#,
-        ).bind(community.as_uuid()).bind(actor_bytes.as_slice()).bind(after)
-            .bind((limit+1) as i64).bind(MAX_CHANNEL_SCAN as i64)
+             ) e ON true ORDER BY r.id"#
+            .replace(
+                "{legacy_types}",
+                &crate::store::channel::legacy_channel_type_sql("c.channel_type"),
+            );
+        // Built only from the constant type list.
+        let rows = sqlx::query(sqlx::AssertSqlSafe(sql))
+            .bind(community.as_uuid())
+            .bind(actor_bytes.as_slice())
+            .bind(after)
+            .bind((limit + 1) as i64)
+            .bind(MAX_CHANNEL_SCAN as i64)
             .bind(ELIGIBLE_KINDS.as_slice())
-            .bind(DateTime::from_timestamp_millis(account.cutoff_ms)
-                .ok_or_else(|| DbError::InvalidData("invalid unread cutoff".into()))?)
+            .bind(
+                DateTime::from_timestamp_millis(account.cutoff_ms)
+                    .ok_or_else(|| DbError::InvalidData("invalid unread cutoff".into()))?,
+            )
             .bind(MAX_UNREAD_SCAN as i64)
             .bind(only)
             .bind(account.started_at)
-            .fetch_all(&mut *tx).await?;
+            .fetch_all(&mut *tx)
+            .await?;
         let has_more = rows.len() > limit;
         // An unstarted account has read every arrival, so nothing is unread.
         let started = account.started_at.is_some();
diff --git a/crates/buzz-relay/src/api/bridge.rs b/crates/buzz-relay/src/api/bridge.rs
index de54b8232c..fa9870e16f 100644
--- a/crates/buzz-relay/src/api/bridge.rs
+++ b/crates/buzz-relay/src/api/bridge.rs
@@ -1511,10 +1511,11 @@ async fn query_events_authed(
         .get_accessible_channel_ids_cached(tenant.community(), &pubkey_bytes)
         .await
         .map_err(|e| internal_error(&format!("channel access lookup: {e}")))?;
-    // System channels are outside `accessible_channels`; a filter that names
-    // one reads it in its own scope only (see `handlers::system_channels`).
-    let mut readable_system =
-        crate::handlers::system_channels::readable_system_channels_for_filters(
+    // Named-only channels (system, and types added later) are outside
+    // `accessible_channels`; a filter that names one reads it in its own
+    // scope only (see `handlers::system_channels`).
+    let mut named_only =
+        crate::handlers::system_channels::readable_named_only_channels_for_filters(
             state,
             tenant.community(),
             &pubkey_bytes,
@@ -1523,14 +1524,14 @@ async fn query_events_authed(
             None,
         )
         .await
-        .map_err(|e| internal_error(&format!("system channel access lookup: {e}")))?;
+        .map_err(|e| internal_error(&format!("named-only channel access lookup: {e}")))?;
     repair_requested_channel_access(
         state,
         tenant,
         &filters,
         &pubkey_bytes,
         &mut accessible_channels,
-        &mut readable_system,
+        &mut named_only,
     )
     .await?;
 
@@ -1546,7 +1547,7 @@ async fn query_events_authed(
             &raw_filters,
             &filters,
             &accessible_channels,
-            &readable_system,
+            &named_only,
             tenant,
             &authed_pubkey_hex,
             &pubkey_bytes,
@@ -1581,7 +1582,7 @@ async fn query_events_authed(
             let scope = crate::handlers::system_channels::filter_channel_scope(
                 filter,
                 &accessible_channels,
-                &readable_system,
+                &named_only,
             );
             events.extend(thread_roots::query(state, tenant, filter, &scope).await?);
             handled.insert(idx);
@@ -1602,7 +1603,7 @@ async fn query_events_authed(
             &crate::handlers::system_channels::filter_channel_scope(
                 filter,
                 &accessible_channels,
-                &readable_system,
+                &named_only,
             ),
             &pubkey_bytes,
             &mut events,
@@ -1728,7 +1729,7 @@ async fn query_events_authed(
         let accessible_channels = crate::handlers::system_channels::filter_channel_scope(
             filter,
             &accessible_channels,
-            &readable_system,
+            &named_only,
         );
 
         if let Some(ch_id) = extract_channel_from_filter(filter) {
@@ -1822,7 +1823,7 @@ async fn query_events_authed(
         let accessible_channels = crate::handlers::system_channels::filter_channel_scope(
             filter,
             &accessible_channels,
-            &readable_system,
+            &named_only,
         );
 
         if let Some(ch_id) = extract_channel_from_filter(filter) {
@@ -1928,7 +1929,7 @@ async fn query_events_authed(
         let accessible_channels = crate::handlers::system_channels::filter_channel_scope(
             filter,
             &accessible_channels,
-            &readable_system,
+            &named_only,
         );
         match filter_events {
             Ok(stored_events) => {
@@ -1967,7 +1968,7 @@ pub(crate) async fn repair_requested_channel_access(
     filters: &[nostr::Filter],
     pubkey_bytes: &[u8],
     accessible_channels: &mut Vec<uuid::Uuid>,
-    readable_system: &mut Vec<uuid::Uuid>,
+    named_only: &mut crate::handlers::system_channels::NamedOnlyChannels,
 ) -> Result<(), (StatusCode, Json<Value>)> {
     let repaired_from = accessible_channels.len();
     let requested: Vec<uuid::Uuid> = filters
@@ -1984,19 +1985,19 @@ pub(crate) async fn repair_requested_channel_access(
         &requested,
         None,
         accessible_channels,
-        readable_system,
+        named_only.ids(),
     )
     .await
     .map_err(|e| internal_error(&format!("channel membership confirmation: {e}")))?;
-    crate::handlers::system_channels::keep_repaired_system_channels_named(
+    crate::handlers::system_channels::keep_repaired_named_only_channels_named(
         state,
         tenant.community(),
         accessible_channels,
         repaired_from,
-        readable_system,
+        named_only,
     )
     .await
-    .map_err(|e| internal_error(&format!("system channel access lookup: {e}")))
+    .map_err(|e| internal_error(&format!("named-only channel access lookup: {e}")))
 }
 
 /// Count events via HTTP bridge (NIP-98 auth). Returns `{"count": N}`.
@@ -2154,10 +2155,11 @@ async fn count_events_authed(
         .get_accessible_channel_ids_cached(tenant.community(), &pubkey_bytes)
         .await
         .map_err(|e| internal_error(&format!("channel access lookup: {e}")))?;
-    // System channels are outside `accessible_channels`; a filter that names
-    // one reads it in its own scope only (see `handlers::system_channels`).
-    let mut readable_system =
-        crate::handlers::system_channels::readable_system_channels_for_filters(
+    // Named-only channels (system, and types added later) are outside
+    // `accessible_channels`; a filter that names one reads it in its own
+    // scope only (see `handlers::system_channels`).
+    let mut named_only =
+        crate::handlers::system_channels::readable_named_only_channels_for_filters(
             state,
             tenant.community(),
             &pubkey_bytes,
@@ -2166,14 +2168,14 @@ async fn count_events_authed(
             None,
         )
         .await
-        .map_err(|e| internal_error(&format!("system channel access lookup: {e}")))?;
+        .map_err(|e| internal_error(&format!("named-only channel access lookup: {e}")))?;
     repair_requested_channel_access(
         state,
         tenant,
         &filters,
         &pubkey_bytes,
         &mut accessible_channels,
-        &mut readable_system,
+        &mut named_only,
     )
     .await?;
 
@@ -2182,7 +2184,7 @@ async fn count_events_authed(
         let accessible_channels = crate::handlers::system_channels::filter_channel_scope(
             filter,
             &accessible_channels,
-            &readable_system,
+            &named_only,
         );
         let needs_author_only_filtering =
             crate::handlers::req::filter_can_match_author_only_kinds(filter);
@@ -2415,7 +2417,7 @@ async fn handle_bridge_search(
     raw_filters: &[Value],
     filters: &[nostr::Filter],
     implicit_channels: &[uuid::Uuid],
-    readable_system: &[uuid::Uuid],
+    named_only: &crate::handlers::system_channels::NamedOnlyChannels,
     tenant: &buzz_core::tenant::TenantContext,
     reader_pubkey_hex: &str,
     pubkey_bytes: &[u8],
@@ -2435,12 +2437,12 @@ async fn handle_bridge_search(
         if limit == 0 {
             continue;
         }
-        // Implicit channels plus the readable system channels this filter
+        // Implicit channels plus the readable named-only channels this filter
         // names; never another filter's.
         let accessible_channels = &*crate::handlers::system_channels::filter_channel_scope(
             filter,
             implicit_channels,
-            readable_system,
+            named_only,
         );
 
         // Scope by channel — push the #h tag (intersected with accessible
@@ -4506,8 +4508,15 @@ pub(crate) mod postgres_tests {
     ///
     /// Returns `None` when local Postgres is not reachable.
     pub(crate) async fn bridge_handler_test_state() -> Option<Arc<crate::state::AppState>> {
+        bridge_handler_test_state_on(&crate::test_support::database_url()).await
+    }
+
+    /// [`bridge_handler_test_state`] on the database at `database_url`.
+    pub(crate) async fn bridge_handler_test_state_on(
+        database_url: &str,
+    ) -> Option<Arc<crate::state::AppState>> {
         let mut config = crate::config::Config::for_test(); // [FI-TRACE-ENV-RACE]
-        config.database_url = crate::test_support::database_url();
+        config.database_url = database_url.to_string();
         // Use the real local Redis so enforce_http_admission can pass.
         config.redis_url =
             std::env::var("REDIS_URL").unwrap_or_else(|_| "redis://127.0.0.1:6379".to_string());
@@ -4515,9 +4524,7 @@ pub(crate) mod postgres_tests {
         config.require_auth_token = false;
         config.require_relay_membership = false;
 
-        let pool = sqlx::PgPool::connect(&crate::test_support::database_url())
-            .await
-            .ok()?;
+        let pool = sqlx::PgPool::connect(database_url).await.ok()?;
         let db = buzz_db::Db::from_pool(pool.clone());
         let redis_pool = deadpool_redis::Config::from_url(&config.redis_url)
             .create_pool(Some(deadpool_redis::Runtime::Tokio1))
diff --git a/crates/buzz-relay/src/api/bridge/thread_window.rs b/crates/buzz-relay/src/api/bridge/thread_window.rs
index c1a84d6002..06436d8cc8 100644
--- a/crates/buzz-relay/src/api/bridge/thread_window.rs
+++ b/crates/buzz-relay/src/api/bridge/thread_window.rs
@@ -85,8 +85,9 @@ fn append(events: &mut Vec<Value>, budget: &mut Budget, event: &nostr::Event) ->
 }
 
 /// The reader's implicit channel set and, when a request names a channel
-/// outside it, the system channels it can read. A thread window names its
-/// channel, so a readable system channel joins that request's scope only.
+/// outside it, the named-only channels it can read (system channels, and any
+/// type added later). A thread window names its channel, so a readable
+/// named-only channel joins that request's scope only.
 async fn access_sets(
     state: &AppState,
     tenant: &TenantContext,
@@ -105,9 +106,12 @@ async fn access_sets(
     {
         state
             .db
-            .get_readable_system_channel_ids(tenant.community(), &reader.to_bytes())
+            .get_readable_named_only_channels(tenant.community(), &reader.to_bytes())
             .await
             .map_err(|e| database_error(context, e))?
+            .into_iter()
+            .map(|(id, _)| id)
+            .collect()
     } else {
         Vec::new()
     };
diff --git a/crates/buzz-relay/src/api/workflows.rs b/crates/buzz-relay/src/api/workflows.rs
index 813fe434fc..5fb6494bfd 100644
--- a/crates/buzz-relay/src/api/workflows.rs
+++ b/crates/buzz-relay/src/api/workflows.rs
@@ -122,17 +122,21 @@ async fn authorize_workflow_read(
         .map_err(|error| {
             internal_error(&format!("workflow channel access lookup: {error}")).into_response()
         })?;
-    // A workflow names its channel, so a readable system channel counts.
+    // A workflow names its channel, so a readable named-only channel (a
+    // system channel, or a type added later) counts.
     let readable = accessible.contains(&channel_id)
         || state
             .db
-            .get_readable_system_channel_ids(tenant.community(), &pubkey_bytes)
+            .get_readable_named_only_channels(tenant.community(), &pubkey_bytes)
             .await
             .map_err(|error| {
-                internal_error(&format!("workflow system channel access lookup: {error}"))
-                    .into_response()
+                internal_error(&format!(
+                    "workflow named-only channel access lookup: {error}"
+                ))
+                .into_response()
             })?
-            .contains(&channel_id);
+            .iter()
+            .any(|(id, _)| *id == channel_id);
     if !readable {
         return Err(not_found());
     }
diff --git a/crates/buzz-relay/src/handlers/count.rs b/crates/buzz-relay/src/handlers/count.rs
index 6f97271cf4..5c2794a164 100644
--- a/crates/buzz-relay/src/handlers/count.rs
+++ b/crates/buzz-relay/src/handlers/count.rs
@@ -100,9 +100,10 @@ pub async fn handle_count(
     if let Some(allowed) = token_channel_ids.as_deref() {
         accessible_channels.retain(|channel_id| allowed.contains(channel_id));
     }
-    // System channels are outside `accessible_channels`; a filter that names
-    // one counts it in its own scope only, as in the WS REQ handler.
-    let mut readable_system = match super::system_channels::readable_system_channels_for_filters(
+    // Named-only channels (system, and types added later) are outside
+    // `accessible_channels`; a filter that names one counts it in its own
+    // scope only, as in the WS REQ handler.
+    let mut named_only = match super::system_channels::readable_named_only_channels_for_filters(
         &state,
         conn.tenant.community(),
         &pubkey_bytes,
@@ -114,7 +115,7 @@ pub async fn handle_count(
     {
         Ok(ids) => ids,
         Err(e) => {
-            warn!(sub_id = %sub_id, "Failed to get readable system channels: {e}");
+            warn!(sub_id = %sub_id, "Failed to get readable named-only channels: {e}");
             conn.send(RelayMessage::closed(&sub_id, "error: database error"));
             return;
         }
@@ -172,7 +173,7 @@ pub async fn handle_count(
                 &requested_channels,
                 token_channel_ids.as_deref(),
                 &mut accessible_channels,
-                &readable_system,
+                named_only.ids(),
             )
             .await
             {
@@ -180,12 +181,12 @@ pub async fn handle_count(
                 conn.send(RelayMessage::closed(&sub_id, "error: database error"));
                 return;
             }
-            if let Err(e) = super::system_channels::keep_repaired_system_channels_named(
+            if let Err(e) = super::system_channels::keep_repaired_named_only_channels_named(
                 &state,
                 conn.tenant.community(),
                 &mut accessible_channels,
                 repaired_from,
-                &mut readable_system,
+                &mut named_only,
             )
             .await
             {
@@ -196,7 +197,7 @@ pub async fn handle_count(
             let filter_scope = super::system_channels::filter_channel_scope(
                 filter,
                 &accessible_channels,
-                &readable_system,
+                &named_only,
             );
             let scope: HashSet<_> = filter_scope.iter().collect();
             let authorized_requested: Vec<_> = requested_channels
@@ -303,7 +304,7 @@ pub async fn handle_count(
                 super::system_channels::filter_channel_scope(
                     filter,
                     &accessible_channels,
-                    &readable_system,
+                    &named_only,
                 )
                 .into_owned(),
             );
diff --git a/crates/buzz-relay/src/handlers/req.rs b/crates/buzz-relay/src/handlers/req.rs
index 9c6b5d70a6..646cfe375b 100644
--- a/crates/buzz-relay/src/handlers/req.rs
+++ b/crates/buzz-relay/src/handlers/req.rs
@@ -130,9 +130,10 @@ pub async fn handle_req(
     if let Some(allowed) = token_channel_ids.as_deref() {
         accessible_channels.retain(|channel_id| allowed.contains(channel_id));
     }
-    // System channels are outside `accessible_channels`. A filter that names
-    // one adds it to its own scope only (see `system_channels`).
-    let mut readable_system = match super::system_channels::readable_system_channels_for_filters(
+    // Named-only channels (system, and types added later) are outside
+    // `accessible_channels`. A filter that names one adds it to its own scope
+    // only (see `system_channels`).
+    let mut named_only = match super::system_channels::readable_named_only_channels_for_filters(
         &state,
         conn.tenant.community(),
         &pubkey_bytes,
@@ -144,7 +145,7 @@ pub async fn handle_req(
     {
         Ok(ids) => ids,
         Err(e) => {
-            warn!(conn_id = %conn_id, "Failed to get readable system channels: {e}");
+            warn!(conn_id = %conn_id, "Failed to get readable named-only channels: {e}");
             conn.send(RelayMessage::closed(&sub_id, "error: database error"));
             return;
         }
@@ -177,7 +178,7 @@ pub async fn handle_req(
             requested,
             token_channel_ids.as_deref(),
             &mut accessible_channels,
-            &readable_system,
+            named_only.ids(),
         )
         .await
         {
@@ -193,12 +194,12 @@ pub async fn handle_req(
                 crate::conformance::record_req_authcheck(&state.tracer, state_snap, ch_id, member);
             }
         }
-        if let Err(e) = super::system_channels::keep_repaired_system_channels_named(
+        if let Err(e) = super::system_channels::keep_repaired_named_only_channels_named(
             &state,
             conn.tenant.community(),
             &mut accessible_channels,
             repaired_from,
-            &mut readable_system,
+            &mut named_only,
         )
         .await
         {
@@ -211,7 +212,7 @@ pub async fn handle_req(
     let authorized_requested_channels = requested_channel_ids.as_ref().map(|requested| {
         let authorized: HashSet<_> = accessible_channels
             .iter()
-            .chain(&readable_system)
+            .chain(named_only.ids())
             .copied()
             .collect();
         requested
@@ -344,7 +345,7 @@ pub async fn handle_req(
                 owner,
                 &filters,
                 &accessible_channels,
-                &readable_system,
+                &named_only,
                 token_channel_ids.is_none(),
                 &conn.tenant,
                 &pubkey_bytes,
@@ -446,7 +447,7 @@ pub async fn handle_req(
                     &super::system_channels::filter_channel_scope(
                         filter,
                         &accessible_channels,
-                        &readable_system,
+                        &named_only,
                     ),
                 );
                 // Shared-gated visibility pushdown: set reader bytes so query_events
@@ -482,7 +483,7 @@ pub async fn handle_req(
             let filter_scope = super::system_channels::filter_channel_scope(
                 filter,
                 &accessible_channels,
-                &readable_system,
+                &named_only,
             );
             let events = match filter_events {
                 Ok(evs) => evs,
@@ -634,7 +635,7 @@ const SEARCH_PAGE_SIZE: u32 = 100;
 const MAX_SEARCH_PAGES: u32 = (buzz_db::DEFAULT_MAX_PAGE_LIMIT as u32).div_ceil(SEARCH_PAGE_SIZE);
 
 /// Requested channels whose access needs a DB membership check: not already
-/// in the cached `accessible_channels` or `readable_system` sets, and inside
+/// in the cached `accessible_channels` or `named_only` sets, and inside
 /// the scoped-auth `token_channel_ids` bound when one is present. Deduplicated,
 /// in request order.
 ///
@@ -645,12 +646,12 @@ const MAX_SEARCH_PAGES: u32 = (buzz_db::DEFAULT_MAX_PAGE_LIMIT as u32).div_ceil(
 pub(crate) fn channels_needing_membership_check(
     requested: &[uuid::Uuid],
     accessible_channels: &[uuid::Uuid],
-    readable_system: &[uuid::Uuid],
+    named_only: &[uuid::Uuid],
     token_channel_ids: Option<&[uuid::Uuid]>,
 ) -> Vec<uuid::Uuid> {
     let mut known: HashSet<uuid::Uuid> = accessible_channels
         .iter()
-        .chain(readable_system)
+        .chain(named_only)
         .copied()
         .collect();
     let token: Option<HashSet<uuid::Uuid>> =
@@ -690,12 +691,12 @@ pub(crate) async fn confirm_requested_channel_access(
     requested: &[uuid::Uuid],
     token_channel_ids: Option<&[uuid::Uuid]>,
     accessible_channels: &mut Vec<uuid::Uuid>,
-    readable_system: &[uuid::Uuid],
+    named_only: &[uuid::Uuid],
 ) -> buzz_db::Result<Vec<(uuid::Uuid, bool)>> {
     let unconfirmed = channels_needing_membership_check(
         requested,
         accessible_channels,
-        readable_system,
+        named_only,
         token_channel_ids,
     );
     if unconfirmed.is_empty() {
@@ -762,7 +763,7 @@ async fn handle_search_req(
     owner: u64,
     filters: &[Filter],
     implicit_channels: &[uuid::Uuid],
-    readable_system: &[uuid::Uuid],
+    named_only: &super::system_channels::NamedOnlyChannels,
     include_global: bool,
     tenant: &TenantContext,
     reader_pubkey_bytes: &[u8],
@@ -772,9 +773,9 @@ async fn handle_search_req(
 ) {
     // `None` means "no accessible channels and no global access" → EOSE,
     // exactly as the legacy string-filter helper short-circuited. A filter
-    // that names a readable system channel can still match it.
+    // that names a readable named-only channel can still match it.
     if build_search_channel_scope_filter(implicit_channels, include_global).is_none()
-        && readable_system.is_empty()
+        && named_only.is_empty()
     {
         conn.send(RelayMessage::eose(sub_id));
         return;
@@ -787,13 +788,10 @@ async fn handle_search_req(
             Some(s) if !s.is_empty() => s.clone(),
             _ => continue,
         };
-        // Implicit channels plus the readable system channels this filter
+        // Implicit channels plus the readable named-only channels this filter
         // names; never another filter's.
-        let accessible_channels = &*super::system_channels::filter_channel_scope(
-            filter,
-            implicit_channels,
-            readable_system,
-        );
+        let accessible_channels =
+            &*super::system_channels::filter_channel_scope(filter, implicit_channels, named_only);
 
         let limit = filter
             .limit
diff --git a/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs b/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
index a74644e21e..66662c9cfd 100644
--- a/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
+++ b/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
@@ -79,10 +79,15 @@ async fn group_state_id(f: &Fixture, channel: Uuid, kind: i32) -> String {
 /// Run one historical REQ and return the event IDs sent before EOSE. A
 /// CLOSED reply counts as no events.
 async fn req(f: &Fixture, reader: &Keys, filter: Value) -> Vec<String> {
+    req_all(f, reader, json!([filter])).await
+}
+
+/// [`req`] with several filters in one REQ.
+async fn req_all(f: &Fixture, reader: &Keys, filters: Value) -> Vec<String> {
     let (conn, mut rx) = test_conn(&f.tenant, reader);
-    let filter: nostr::Filter = serde_json::from_value(filter).expect("filter");
-    crate::handlers::req::handle_req("s".into(), vec![filter], vec![None], conn, f.state.clone())
-        .await;
+    let filters: Vec<nostr::Filter> = serde_json::from_value(filters).expect("filters");
+    let before = vec![None; filters.len()];
+    crate::handlers::req::handle_req("s".into(), filters, before, conn, f.state.clone()).await;
     let mut ids = Vec::new();
     while let Ok(frame) = rx.try_recv() {
         let axum::extract::ws::Message::Text(text) = frame else {
@@ -100,9 +105,14 @@ async fn req(f: &Fixture, reader: &Keys, filter: Value) -> Vec<String> {
 
 /// Run one WebSocket COUNT and return the count. A CLOSED reply counts as 0.
 async fn count(f: &Fixture, reader: &Keys, filter: Value) -> u64 {
+    count_all(f, reader, json!([filter])).await
+}
+
+/// [`count`] with several filters in one COUNT.
+async fn count_all(f: &Fixture, reader: &Keys, filters: Value) -> u64 {
     let (conn, mut rx) = test_conn(&f.tenant, reader);
-    let filter: nostr::Filter = serde_json::from_value(filter).expect("filter");
-    crate::handlers::count::handle_count("c".into(), vec![filter], conn, f.state.clone()).await;
+    let filters: Vec<nostr::Filter> = serde_json::from_value(filters).expect("filters");
+    crate::handlers::count::handle_count("c".into(), filters, conn, f.state.clone()).await;
     while let Ok(frame) = rx.try_recv() {
         let axum::extract::ws::Message::Text(text) = frame else {
             continue;
@@ -341,7 +351,7 @@ async fn system_channels_are_read_only_by_name() {
 /// re-check then confirms membership. The channel must stay in the scope of
 /// the filter that names it, not the request-wide implicit set, so a sibling
 /// filter that never names it cannot read it.
-/// Mutation: drop `keep_repaired_system_channels_named` from
+/// Mutation: drop `keep_repaired_named_only_channels_named` from
 /// `repair_requested_channel_access` → RED (the sibling filter's scope gets
 /// the channel).
 #[tokio::test]
@@ -365,7 +375,7 @@ async fn a_system_channel_joined_mid_request_stays_in_its_named_filter() {
         .expect("implicit channels");
     assert_eq!(implicit, [ordinary]);
     // The request's system-channel lookup ran before the join.
-    let mut readable_system = Vec::new();
+    let mut named_only = crate::handlers::system_channels::NamedOnlyChannels::default();
 
     crate::api::bridge::repair_requested_channel_access(
         &f.state,
@@ -373,21 +383,291 @@ async fn a_system_channel_joined_mid_request_stays_in_its_named_filter() {
         &filters,
         &owner.public_key().to_bytes(),
         &mut implicit,
-        &mut readable_system,
+        &mut named_only,
     )
     .await
     .expect("repair");
 
     assert_eq!(implicit, [ordinary], "implicit set stays ordinary");
-    assert_eq!(readable_system, [system]);
+    assert_eq!(named_only.ids(), [system]);
     let scope = |filter| {
-        crate::handlers::system_channels::filter_channel_scope(filter, &implicit, &readable_system)
+        crate::handlers::system_channels::filter_channel_scope(filter, &implicit, &named_only)
             .into_owned()
     };
     assert_eq!(scope(&filters[0]), [ordinary, system], "naming filter");
     assert_eq!(scope(&filters[1]), [ordinary], "sibling filter");
 }
 
+/// A [`Fixture`] on a migrated scratch database with a `future_type` value in
+/// `channel_type`, as a later migration would add, so the shared test
+/// database keeps its schema.
+struct LaterTypeFixture {
+    f: Fixture,
+    pool: sqlx::PgPool,
+    admin: sqlx::PgPool,
+    name: String,
+}
+
+impl LaterTypeFixture {
+    async fn new() -> Self {
+        let url = crate::test_support::database_url();
+        let admin = sqlx::PgPool::connect(&url).await.expect("connect admin");
+        let name = format!("later_type_{}", Uuid::new_v4().simple());
+        sqlx::query(sqlx::AssertSqlSafe(format!("CREATE DATABASE {name}")))
+            .execute(&admin)
+            .await
+            .expect("create scratch db");
+        let scratch_url = format!("{}/{name}", &url[..url.rfind('/').expect("db url path")]);
+        let pool = sqlx::PgPool::connect(&scratch_url)
+            .await
+            .expect("connect scratch db");
+        buzz_db::migration::run_migrations(&pool)
+            .await
+            .expect("migrate scratch db");
+        sqlx::query("ALTER TYPE channel_type ADD VALUE 'future_type'")
+            .execute(&pool)
+            .await
+            .expect("add future channel type");
+        let state = crate::api::bridge::postgres_tests::bridge_handler_test_state_on(&scratch_url)
+            .await
+            .expect("scratch Postgres and local Redis");
+        let host = format!("later-type-{}.local", Uuid::new_v4().simple());
+        let community = state
+            .db
+            .ensure_configured_community(&host)
+            .await
+            .expect("ensure community")
+            .id;
+        let tenant = TenantContext::resolved(community, &host);
+        Self {
+            f: Fixture {
+                state,
+                tenant,
+                host,
+            },
+            pool,
+            admin,
+            name,
+        }
+    }
+
+    /// Give `channel` the later type, and drop cached access sets built
+    /// while it was a stream.
+    async fn retype(&self, channel: Uuid) {
+        sqlx::query("UPDATE channels SET channel_type = 'future_type' WHERE id = $1")
+            .bind(channel)
+            .execute(&self.pool)
+            .await
+            .expect("retype channel");
+        self.f
+            .state
+            .invalidate_all_accessible_channels_local(self.f.tenant.community());
+    }
+
+    async fn drop_database(self) {
+        drop(self.f);
+        self.pool.close().await;
+        let _ = sqlx::query(sqlx::AssertSqlSafe(format!(
+            "DROP DATABASE IF EXISTS {} WITH (FORCE)",
+            self.name
+        )))
+        .execute(&self.admin)
+        .await;
+    }
+}
+
+/// A filter that names a channel of a type added later reads it under the
+/// ordinary rules (member, or open), by `#h` on any kinds or by `#d` on
+/// group-state kinds, on every read path. No sibling filter in the same
+/// request gains it, including a group-state filter that opts in to system
+/// channels with `#P` or `#t:["system", <label>]` (NIP-CL).
+/// Mutation: load only `system` channels in
+/// `get_readable_named_only_channels` → RED (an open channel's non-member,
+/// and `#d`, read nothing). Add every named-only channel on opt-in in
+/// `filter_channel_scope` → RED (the `#P` and `#t` siblings list it).
+#[tokio::test]
+#[ignore = "requires Postgres and Redis"]
+async fn channels_of_a_later_type_are_read_only_by_name() {
+    let later = LaterTypeFixture::new().await;
+    let f = &later.f;
+    let owner = Keys::generate();
+    let outsider = Keys::generate();
+    let owner_hex = owner.public_key().to_hex();
+    let label = "shared-label";
+
+    let private = create_channel(
+        &f.state,
+        &f.tenant,
+        &owner,
+        &[&["visibility", "private"], &["t", label]],
+    )
+    .await;
+    let open = create_channel(&f.state, &f.tenant, &owner, &[&["visibility", "open"]]).await;
+    let ordinary = create_channel(&f.state, &f.tenant, &owner, &[&["t", label]]).await;
+    let mut message = std::collections::HashMap::new();
+    for channel in [private, open, ordinary] {
+        let id = publish(f, &owner, 9, "hello", &[&["h", &channel.to_string()]]).await;
+        message.insert(channel, id);
+    }
+    let ordinary_meta = group_state_id(f, ordinary, 39000).await;
+    later.retype(private).await;
+    later.retype(open).await;
+
+    // A read that names no channel leaves both out.
+    assert_eq!(
+        req(f, &owner, json!({"kinds": [9]})).await,
+        vec![message[&ordinary].clone()],
+        "REQ without #h"
+    );
+
+    for reader in [&owner, &outsider] {
+        let who = if std::ptr::eq(reader, &owner) {
+            "member"
+        } else {
+            "outsider"
+        };
+        for (channel, readable) in [(private, std::ptr::eq(reader, &owner)), (open, true)] {
+            let h = channel.to_string();
+            let expected_message = if readable {
+                vec![message[&channel].clone()]
+            } else {
+                Vec::new()
+            };
+            let expected_count = u64::from(readable);
+            let by_h = json!({"kinds": [9], "#h": [h]});
+            assert_eq!(
+                req(f, reader, by_h.clone()).await,
+                expected_message,
+                "{who}: REQ #h {channel}"
+            );
+            assert_eq!(
+                count(f, reader, by_h.clone()).await,
+                expected_count,
+                "{who}: COUNT #h {channel}"
+            );
+            assert_eq!(
+                bridge_ids(bridge(f, reader, "/query", json!([by_h])).await),
+                expected_message,
+                "{who}: bridge /query #h {channel}"
+            );
+            assert_eq!(
+                bridge_count(bridge(f, reader, "/count", json!([by_h])).await),
+                expected_count,
+                "{who}: bridge /count #h {channel}"
+            );
+            let expected_meta = if readable {
+                vec![group_state_id(f, channel, 39000).await]
+            } else {
+                Vec::new()
+            };
+            let by_d = json!({"kinds": [39000], "#d": [h]});
+            assert_eq!(
+                req(f, reader, by_d.clone()).await,
+                expected_meta,
+                "{who}: REQ #d {channel}"
+            );
+            assert_eq!(
+                bridge_ids(bridge(f, reader, "/query", json!([by_d])).await),
+                expected_meta,
+                "{who}: bridge /query #d {channel}"
+            );
+        }
+    }
+
+    // A sibling that opts in to system channels finds the creator's or the
+    // label's ordinary channel, but not the later-type one that the first
+    // filter names.
+    for sibling in [
+        json!({"kinds": [39000], "#P": [owner_hex]}),
+        json!({"kinds": [39000], "#t": ["system", label]}),
+    ] {
+        let filters = json!([{"kinds": [9], "#h": [private.to_string()]}, sibling]);
+        let expected = sorted(vec![message[&private].clone(), ordinary_meta.clone()]);
+        assert_eq!(
+            sorted(req_all(f, &owner, filters.clone()).await),
+            expected,
+            "REQ with {sibling}"
+        );
+        assert_eq!(
+            count_all(f, &owner, filters.clone()).await,
+            2,
+            "COUNT with {sibling}"
+        );
+        assert_eq!(
+            sorted(bridge_ids(
+                bridge(f, &owner, "/query", filters.clone()).await
+            )),
+            expected,
+            "bridge /query with {sibling}"
+        );
+        assert_eq!(
+            bridge_count(bridge(f, &owner, "/count", filters).await),
+            2,
+            "bridge /count with {sibling}"
+        );
+    }
+
+    later.drop_database().await;
+}
+
+/// A reader can join a channel of a type added later after the request loads
+/// its named-only channels and before it re-checks a named channel. The
+/// re-check must keep it in the scope of the filter that names it: a sibling
+/// that names no channel reads only the legacy types, and a sibling that opts
+/// in to system channels (`#P`) does not gain it either (NIP-CL).
+/// Mutation: classify the repaired tail as legacy in
+/// `keep_repaired_named_only_channels_named` → RED (the plain sibling gets
+/// it); count every repaired named-only channel as system → RED (the `#P`
+/// sibling gets it).
+#[tokio::test]
+#[ignore = "requires Postgres and Redis"]
+async fn a_named_channel_of_a_later_type_stays_in_its_named_filter() {
+    let later_type = LaterTypeFixture::new().await;
+    let (state, tenant) = (&later_type.f.state, &later_type.f.tenant);
+    let community = tenant.community();
+
+    let owner = Keys::generate();
+    let ordinary = create_channel(state, tenant, &owner, &[]).await;
+    let later = create_channel(state, tenant, &owner, &[]).await;
+    later_type.retype(later).await;
+
+    let filters: Vec<nostr::Filter> = serde_json::from_value(json!([
+        {"kinds": [9], "#h": [later.to_string()]},
+        {"kinds": [39000]},
+        {"kinds": [39000], "#P": [owner.public_key().to_hex()]},
+    ]))
+    .expect("filters");
+    let mut implicit = state
+        .db
+        .get_accessible_channel_ids(community, &owner.public_key().to_bytes())
+        .await
+        .expect("implicit channels");
+    assert_eq!(implicit, [ordinary]);
+    let mut named_only = crate::handlers::system_channels::NamedOnlyChannels::default();
+
+    crate::api::bridge::repair_requested_channel_access(
+        state,
+        tenant,
+        &filters,
+        &owner.public_key().to_bytes(),
+        &mut implicit,
+        &mut named_only,
+    )
+    .await
+    .expect("repair");
+
+    assert_eq!(implicit, [ordinary], "implicit set stays legacy");
+    let scope = |filter| {
+        crate::handlers::system_channels::filter_channel_scope(filter, &implicit, &named_only)
+            .into_owned()
+    };
+    assert_eq!(scope(&filters[0]), [ordinary, later], "naming filter");
+    assert_eq!(scope(&filters[1]), [ordinary], "sibling filter");
+    assert_eq!(scope(&filters[2]), [ordinary], "system opt-in sibling");
+
+    later_type.drop_database().await;
+}
+
 /// A request that names channels the cached access set lacks confirms them
 /// all in one membership query. Members join the request-local set in request
 /// order, each once; a channel the reader is not in stays out.
@@ -411,7 +691,7 @@ async fn named_channels_missing_from_the_cache_are_confirmed_together() {
     .expect("filters");
     // The request's cached lookup ran before the reader joined either channel.
     let mut implicit = Vec::new();
-    let mut readable_system = Vec::new();
+    let mut named_only = crate::handlers::system_channels::NamedOnlyChannels::default();
 
     crate::api::bridge::repair_requested_channel_access(
         &f.state,
@@ -419,13 +699,13 @@ async fn named_channels_missing_from_the_cache_are_confirmed_together() {
         &filters,
         &reader.public_key().to_bytes(),
         &mut implicit,
-        &mut readable_system,
+        &mut named_only,
     )
     .await
     .expect("repair");
 
     assert_eq!(implicit, [second, first]);
-    assert!(readable_system.is_empty());
+    assert!(named_only.is_empty());
 }
 
 /// Every membership notice is a stored kind:44100/44101 tagged with its
diff --git a/crates/buzz-relay/src/handlers/system_channels.rs b/crates/buzz-relay/src/handlers/system_channels.rs
index 99042c0234..13ad914fd3 100644
--- a/crates/buzz-relay/src/handlers/system_channels.rs
+++ b/crates/buzz-relay/src/handlers/system_channels.rs
@@ -1,22 +1,26 @@
-//! Query scope for system channels.
+//! Query scope for channels that a read reaches only by naming them.
 //!
-//! A system channel (`channel_type = 'system'`) exists only for access
-//! control. The implicit channel set of a query, from
-//! `get_accessible_channel_ids`, leaves system channels out. A filter adds
-//! the system channels that the reader can read (member, or open) only when
-//! it names them:
+//! The implicit channel set of a query, from `get_accessible_channel_ids`,
+//! holds only the legacy channel types
+//! ([`buzz_core::channel::LEGACY_CHANNEL_TYPES`]). It leaves out system
+//! channels (`channel_type = 'system'`, which exist only for access control)
+//! and every type added later. These are **named-only** channels. A filter
+//! adds the named-only channels that the reader can read (member, or open)
+//! only when it names them:
 //!
 //! - `#h` lists the channel, on any kinds;
 //! - `#d` lists the channel, on a filter whose kinds are all 39000–39003.
 //!
 //! A filter whose kinds are all 39000–39003 also opts in to every readable
-//! system channel when it has `#t:["system"]` (the channel type tag) or any
-//! `#P` (the creator tag). The filter then matches as usual, so
+//! **system** channel when it has `#t:["system"]` (the channel type tag) or
+//! any `#P` (the creator tag). The filter then matches as usual, so
 //! `{kinds:[39000], #P:[creator], #t:[label]}` finds one creator's labeled
-//! channel, system or not. Existing clients send neither on these kinds.
+//! channel, system or not. Existing clients send neither on these kinds. The
+//! opt-in never adds a channel of another named-only type: each new type needs
+//! its own opt-in.
 //!
 //! The addition is per filter. Another filter in the same request keeps the
-//! implicit set, so naming one system channel cannot widen a sibling filter.
+//! implicit set, so naming one channel cannot widen a sibling filter.
 
 use std::borrow::Cow;
 use std::collections::HashSet;
@@ -28,6 +32,51 @@ use buzz_core::CommunityId;
 
 use crate::state::AppState;
 
+/// The named-only channels a request may add to a filter's scope: the
+/// readable channels of non-legacy types, and which of them are system
+/// channels. A filter reads one only by naming it; a filter that opts in also
+/// reads every system one (see the module docs).
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub(crate) struct NamedOnlyChannels {
+    ids: Vec<Uuid>,
+    system: Vec<Uuid>,
+}
+
+impl NamedOnlyChannels {
+    /// From `(id, channel_type)` rows of non-legacy channels.
+    pub(crate) fn from_typed(rows: impl IntoIterator<Item = (Uuid, String)>) -> Self {
+        let mut channels = Self::default();
+        for (id, channel_type) in rows {
+            channels.insert(id, &channel_type);
+        }
+        channels
+    }
+
+    fn insert(&mut self, id: Uuid, channel_type: &str) {
+        if self.ids.contains(&id) {
+            return;
+        }
+        self.ids.push(id);
+        if channel_type == buzz_core::channel::ChannelType::System.as_str() {
+            self.system.push(id);
+        }
+    }
+
+    /// Every readable named-only channel, of any non-legacy type.
+    pub(crate) fn ids(&self) -> &[Uuid] {
+        &self.ids
+    }
+
+    pub(crate) fn is_empty(&self) -> bool {
+        self.ids.is_empty()
+    }
+
+    fn retain(&mut self, allowed: &[Uuid]) {
+        self.ids.retain(|id| allowed.contains(id));
+        self.system.retain(|id| allowed.contains(id));
+    }
+}
+
 /// Whether every kind in `filter` is a NIP-29 group-state kind (39000–39003).
 pub(crate) fn filter_is_group_state_only(filter: &Filter) -> bool {
     filter.kinds.as_ref().is_some_and(|kinds| {
@@ -60,7 +109,8 @@ fn named_channels(filter: &Filter) -> impl Iterator<Item = Uuid> + '_ {
 }
 
 /// Whether `filter` opts in to every readable system channel: its kinds are
-/// all group-state kinds, and it has `#t:["system"]` or any `#P`.
+/// all group-state kinds, and it has `#t:["system"]` or any `#P`. It opts in
+/// to system channels only, never to another named-only type.
 fn filter_opts_in(filter: &Filter) -> bool {
     if !filter_is_group_state_only(filter) {
         return false;
@@ -80,8 +130,8 @@ fn filter_opts_in(filter: &Filter) -> bool {
     system_type || creator
 }
 
-/// Whether `filter` could need a system channel added to its scope.
-fn filter_needs_system_channels(filter: &Filter, implicit: &[Uuid]) -> bool {
+/// Whether `filter` could need a named-only channel added to its scope.
+fn filter_needs_named_only_channels(filter: &Filter, implicit: &[Uuid]) -> bool {
     if filter_opts_in(filter) {
         return true;
     }
@@ -90,29 +140,26 @@ fn filter_needs_system_channels(filter: &Filter, implicit: &[Uuid]) -> bool {
 }
 
 /// The channels `filter` may read: the implicit set, plus the readable
-/// system channels the filter names, or all of them when it opts in.
+/// named-only channels the filter names, plus every readable system channel
+/// when it opts in.
 pub(crate) fn filter_channel_scope<'a>(
     filter: &Filter,
     implicit: &'a [Uuid],
-    readable_system: &[Uuid],
+    named_only: &NamedOnlyChannels,
 ) -> Cow<'a, [Uuid]> {
-    if readable_system.is_empty() {
+    if named_only.is_empty() {
         return Cow::Borrowed(implicit);
     }
-    let opted_in = filter_opts_in(filter);
-    let mut extra: Vec<Uuid> = Vec::new();
-    let candidates: Vec<Uuid> = if opted_in {
-        readable_system.to_vec()
-    } else {
-        named_channels(filter).collect()
-    };
-    let readable: HashSet<Uuid> = readable_system.iter().copied().collect();
-    let mut seen: HashSet<Uuid> = implicit.iter().copied().collect();
-    for id in candidates {
-        if readable.contains(&id) && seen.insert(id) {
-            extra.push(id);
-        }
+    let readable: HashSet<Uuid> = named_only.ids.iter().copied().collect();
+    let mut candidates: Vec<Uuid> = named_channels(filter).collect();
+    if filter_opts_in(filter) {
+        candidates.extend(&named_only.system);
     }
+    let mut seen: HashSet<Uuid> = implicit.iter().copied().collect();
+    let extra: Vec<Uuid> = candidates
+        .into_iter()
+        .filter(|id| readable.contains(id) && seen.insert(*id))
+        .collect();
     if extra.is_empty() {
         return Cow::Borrowed(implicit);
     }
@@ -121,51 +168,54 @@ pub(crate) fn filter_channel_scope<'a>(
     Cow::Owned(scope)
 }
 
-/// Load the system channels the reader can read, narrowed to the token's
+/// Load the named-only channels the reader can read, narrowed to the token's
 /// channel scope, when at least one filter could use them. Returns an empty
 /// set, without a database read, when no filter opts in or names a channel
 /// outside the implicit set.
-pub(crate) async fn readable_system_channels_for_filters(
+pub(crate) async fn readable_named_only_channels_for_filters(
     state: &AppState,
     community: CommunityId,
     pubkey: &[u8],
     filters: &[Filter],
     implicit: &[Uuid],
     token_channel_ids: Option<&[Uuid]>,
-) -> Result<Vec<Uuid>, buzz_db::DbError> {
+) -> Result<NamedOnlyChannels, buzz_db::DbError> {
     if !filters
         .iter()
-        .any(|filter| filter_needs_system_channels(filter, implicit))
+        .any(|filter| filter_needs_named_only_channels(filter, implicit))
     {
-        return Ok(Vec::new());
+        return Ok(NamedOnlyChannels::default());
     }
-    let mut readable = state
-        .db
-        .get_readable_system_channel_ids(community, pubkey)
-        .await?;
+    let mut readable = NamedOnlyChannels::from_typed(
+        state
+            .db
+            .get_readable_named_only_channels(community, pubkey)
+            .await?,
+    );
     if let Some(allowed) = token_channel_ids {
-        readable.retain(|id| allowed.contains(id));
+        readable.retain(allowed);
     }
     Ok(readable)
 }
 
-/// Move system channels out of the repaired tail of the implicit set.
+/// Move named-only channels out of the repaired tail of the implicit set.
 ///
 /// A request re-checks membership for named channels missing from its first
 /// lookups, and [`super::req::confirm_requested_channel_access`] appends each
-/// confirmed one to the implicit set. A system channel lands there when the
-/// reader joins it between the lookups and the re-check. This moves it to
-/// `readable_system`, so only the filters that name it can read it.
+/// confirmed one to the implicit set. Only legacy types
+/// ([`buzz_core::channel::LEGACY_CHANNEL_TYPES`]) may stay there. A named-only
+/// channel lands in the tail when the reader joins it between the lookups and
+/// the re-check. This moves it to `named_only`, so only the filters that name
+/// it can read it (and, for a system channel, the filters that opt in).
 ///
 /// `repaired_from` is the length of `implicit` before the re-check. The tail
-/// after it holds the repaired channels; nothing before it is a system
-/// channel.
-pub(crate) async fn keep_repaired_system_channels_named(
+/// after it holds the repaired channels; nothing before it is named-only.
+pub(crate) async fn keep_repaired_named_only_channels_named(
     state: &AppState,
     community: CommunityId,
     implicit: &mut Vec<Uuid>,
     repaired_from: usize,
-    readable_system: &mut Vec<Uuid>,
+    named_only: &mut NamedOnlyChannels,
 ) -> Result<(), buzz_db::DbError> {
     let Some(repaired) = implicit
         .get(repaired_from..)
@@ -173,29 +223,28 @@ pub(crate) async fn keep_repaired_system_channels_named(
     else {
         return Ok(());
     };
-    let system = state
+    let typed = state
         .db
-        .system_channel_ids_among(community, repaired)
+        .named_only_channels_among(community, repaired)
         .await?;
-    move_system_channels(implicit, repaired_from, &system, readable_system);
+    move_named_only_channels(implicit, repaired_from, &typed, named_only);
     Ok(())
 }
 
-fn move_system_channels(
+fn move_named_only_channels(
     implicit: &mut Vec<Uuid>,
     repaired_from: usize,
-    system: &[Uuid],
-    readable_system: &mut Vec<Uuid>,
+    typed: &[(Uuid, String)],
+    named_only: &mut NamedOnlyChannels,
 ) {
-    if system.is_empty() {
+    if typed.is_empty() {
         return;
     }
     let repaired = implicit.split_off(repaired_from);
     for id in repaired {
-        if !system.contains(&id) {
-            implicit.push(id);
-        } else if !readable_system.contains(&id) {
-            readable_system.push(id);
+        match typed.iter().find(|(named, _)| *named == id) {
+            Some((_, channel_type)) => named_only.insert(id, channel_type),
+            None => implicit.push(id),
         }
     }
 }
@@ -209,12 +258,16 @@ mod tests {
         serde_json::from_value(json).expect("filter")
     }
 
+    fn of_type(channel_type: &str, ids: &[Uuid]) -> NamedOnlyChannels {
+        NamedOnlyChannels::from_typed(ids.iter().map(|id| (*id, channel_type.to_owned())))
+    }
+
     #[test]
     fn named_system_channel_widens_only_its_own_filter() {
         let open = Uuid::new_v4();
         let system = Uuid::new_v4();
         let implicit = vec![open];
-        let readable = vec![system];
+        let readable = of_type("system", &[system]);
 
         let by_h = filter(serde_json::json!({"#h": [system.to_string()]}));
         assert_eq!(
@@ -258,10 +311,15 @@ mod tests {
         let repaired_open = Uuid::new_v4();
         let joined_system = Uuid::new_v4();
         let mut implicit = vec![open, repaired_open, joined_system];
-        let mut readable = Vec::new();
-        move_system_channels(&mut implicit, 1, &[joined_system], &mut readable);
+        let mut readable = NamedOnlyChannels::default();
+        move_named_only_channels(
+            &mut implicit,
+            1,
+            &[(joined_system, "system".to_owned())],
+            &mut readable,
+        );
         assert_eq!(implicit, [open, repaired_open]);
-        assert_eq!(readable, [joined_system]);
+        assert_eq!(readable, of_type("system", &[joined_system]));
 
         let names_it = filter(serde_json::json!({"#h": [joined_system.to_string()]}));
         assert_eq!(
@@ -278,9 +336,10 @@ mod tests {
     #[test]
     fn system_type_or_creator_on_group_state_kinds_opts_in() {
         let open = Uuid::new_v4();
-        let system = vec![Uuid::new_v4(), Uuid::new_v4()];
+        let system_ids = vec![Uuid::new_v4(), Uuid::new_v4()];
+        let system = of_type("system", &system_ids);
         let implicit = vec![open];
-        let all = [vec![open], system.clone()].concat();
+        let all = [vec![open], system_ids.clone()].concat();
         let creator = Keys::generate().public_key().to_hex();
 
         for opt_in in [
@@ -290,7 +349,7 @@ mod tests {
             serde_json::json!({"kinds": [39000], "#P": [creator], "#t": ["agent-attention"]}),
         ] {
             let f = filter(opt_in.clone());
-            assert!(filter_needs_system_channels(&f, &implicit), "{opt_in}");
+            assert!(filter_needs_named_only_channels(&f, &implicit), "{opt_in}");
             assert_eq!(
                 filter_channel_scope(&f, &implicit, &system).as_ref(),
                 all.as_slice(),
@@ -305,7 +364,10 @@ mod tests {
             serde_json::json!({"#t": ["system"]}),
         ] {
             let f = filter(no_opt_in.clone());
-            assert!(!filter_needs_system_channels(&f, &implicit), "{no_opt_in}");
+            assert!(
+                !filter_needs_named_only_channels(&f, &implicit),
+                "{no_opt_in}"
+            );
             assert_eq!(
                 filter_channel_scope(&f, &implicit, &system).as_ref(),
                 &[open],
@@ -314,27 +376,63 @@ mod tests {
         }
     }
 
+    /// A channel of a type added later is named-only like a system channel,
+    /// but the system opt-in (`#t:["system"]`, `#P`) never adds it: only a
+    /// filter that names it reads it.
+    /// Mutation: add every named-only channel on opt-in → RED.
+    #[test]
+    fn a_later_type_is_read_only_by_name_even_by_an_opted_in_filter() {
+        let open = Uuid::new_v4();
+        let system = Uuid::new_v4();
+        let later = Uuid::new_v4();
+        let implicit = vec![open];
+        let mut readable = of_type("system", &[system]);
+        readable.insert(later, "future_type");
+        let creator = Keys::generate().public_key().to_hex();
+
+        for names_it in [
+            serde_json::json!({"#h": [later.to_string()]}),
+            serde_json::json!({"kinds": [39000], "#d": [later.to_string()]}),
+        ] {
+            assert_eq!(
+                filter_channel_scope(&filter(names_it.clone()), &implicit, &readable).as_ref(),
+                &[open, later],
+                "{names_it}"
+            );
+        }
+        for opt_in in [
+            serde_json::json!({"kinds": [39000], "#t": ["system", "shared-label"]}),
+            serde_json::json!({"kinds": [39000], "#P": [creator]}),
+        ] {
+            assert_eq!(
+                filter_channel_scope(&filter(opt_in.clone()), &implicit, &readable).as_ref(),
+                &[open, system],
+                "{opt_in}"
+            );
+        }
+    }
+
     #[test]
     fn lookup_runs_only_when_a_filter_names_a_channel_outside_the_implicit_set() {
         let open = Uuid::new_v4();
         let implicit = vec![open];
-        assert!(!filter_needs_system_channels(
+        assert!(!filter_needs_named_only_channels(
             &filter(serde_json::json!({"kinds": [9]})),
             &implicit
         ));
-        assert!(!filter_needs_system_channels(
+        assert!(!filter_needs_named_only_channels(
             &filter(serde_json::json!({"#h": [open.to_string()]})),
             &implicit
         ));
-        assert!(filter_needs_system_channels(
+        assert!(filter_needs_named_only_channels(
             &filter(serde_json::json!({"#h": [Uuid::new_v4().to_string()]})),
             &implicit
         ));
-        assert!(filter_needs_system_channels(
+        assert!(filter_needs_named_only_channels(
             &filter(serde_json::json!({"kinds": [39002], "#d": [Uuid::new_v4().to_string()]})),
             &implicit
         ));
-        assert!(!filter_needs_system_channels(
+        assert!(!filter_needs_named_only_channels(
             &filter(serde_json::json!({"kinds": [1], "#d": [Uuid::new_v4().to_string()]})),
             &implicit
         ));
diff --git a/docs/nips/NIP-CL.md b/docs/nips/NIP-CL.md
index b7c415a73d..10d395d90b 100644
--- a/docs/nips/NIP-CL.md
+++ b/docs/nips/NIP-CL.md
@@ -170,21 +170,33 @@ NIP-29 `hidden` tag.
 
 The relay leaves system channels out of every read that does not name them.
 Clients that do not know about system channels then stay correct with no
-change. This applies to:
+change.
+
+A client sees a channel only if it knows the channel's type. A read that does
+not name a channel returns only the **legacy types**: `stream`, `forum`, `dm`
+and `workflow`, the types that every client knew before this NIP. This list is
+frozen. The relay leaves out every other type, so a channel type added later
+is also hidden from clients that do not know it. A filter that names such a
+channel (see below) reads it under the ordinary rules, and no other filter in
+the same request gains it. The opt-in in "Asking for system channels"
+(`#t:["system"]` or `#P`) adds system channels only, never a channel of
+another type. Each new type needs its own way to ask for all its channels.
+This applies to:
 
 - a filter without `#h`, for example the channels or messages a reader can see;
 - kind:39002 `#p:["<reader>"]`, the channels a reader belongs to;
 - COUNT and NIP-50 search; and
 - any relay-specific query API that does the same reads.
 
-A filter **names** a system channel when it has the channel ID in `#h`, or in
-`#d` on a filter whose kinds are all 39000–39003. Then the ordinary read rules
-apply: the reader can read the channel if they are a member or if it is open.
+A filter **names** a channel when it has the channel ID in `#h`, or in `#d` on
+a filter whose kinds are all 39000–39003. This is the same for a system
+channel and for a type added later. Then the ordinary read rules apply: the
+reader can read the channel if they are a member or if it is open.
 A client that has the ID, for example from a link, can open the channel. Thus
 a system channel stays an ordinary NIP-29 group.
 
-The relay decides this for each filter. A filter that names a system channel
-does not add it to another filter in the same request.
+The relay decides this for each filter. A filter that names a channel does
+not add it to another filter in the same request.
 
 The relay MUST NOT send push notifications for system channels.
 
@@ -243,7 +255,8 @@ the reader can read when it has:
   result, so it does not fill generic channel lists.
 
 The filter then matches as usual. A label alone does not ask for system
-channels.
+channels. These filters add only system channels. A channel of a type added
+later reaches only a filter that names it.
 
 | To find | Filter |
 | --- | --- |