diff --git a/NOSTR.md b/NOSTR.md
index 62e438d30d..96ccb0edc0 100644
--- a/NOSTR.md
+++ b/NOSTR.md
@@ -152,7 +152,10 @@ out unless they ask for it:
   combine with OR, so `#t:["system", <label>]` does not mean "a system
   channel with this label".
 
-Push and kind:44100/44101 membership notifications skip system channels.
+Push notifications skip system channels. Every kind:44100/44101 membership
+notification carries its channel type as `t`, and a filter without `#t` sees
+only the legacy types, so system channel notices reach only a filter with
+`#t:["system"]` (see NIP-CL).
 
 Events are stored **channel-scoped** so access control applies — private channel member lists are
 only visible to members. Discover groups via historical REQ:
@@ -178,6 +181,11 @@ The relay emits relay-signed notifications when members are added or removed:
 | **44100** | Member added | `p` = target pubkey, `h` = channel UUID | Community-global |
 | **44101** | Member removed | `p` = target pubkey, `h` = channel UUID | Community-global |
 
+Each notice also has `t` = the channel type (`stream`, `forum`, `dm`,
+`workflow`, `system`). A filter with `#t` gets only the types it names. A
+filter without `#t` gets only `stream`, `forum`, `dm` and `workflow`, and so
+does an untagged notice stored before the tag existed (NIP-CL).
+
 Stored community-globally (`channel_id = None` inside the connected community) so agents and clients can subscribe without knowing channel
 UUIDs in advance. Client-submitted kind:44100/44101 events are rejected — only the relay keypair
 may sign these.
diff --git a/crates/buzz-core/src/filter.rs b/crates/buzz-core/src/filter.rs
index 32e3a7ad16..43753df94d 100644
--- a/crates/buzz-core/src/filter.rs
+++ b/crates/buzz-core/src/filter.rs
@@ -12,9 +12,9 @@ pub fn filters_match(filters: &[Filter], event: &StoredEvent) -> bool {
 }
 
 /// Result-level read authorization for relay-signed events whose content is
-/// private to a single viewer. Currently gates `KIND_DM_VISIBILITY` and
-/// `KIND_AGENT_TURN_METRIC`: the reader MUST equal the event's `#p` tag
-/// (owner). Returns `true` for every other kind.
+/// private to a single viewer: the kinds in
+/// [`crate::kind::RESULT_GATED_KINDS`]. The reader MUST equal the event's
+/// `#p` tag (owner). Returns `true` for every other kind.
 ///
 /// This guards every delivery surface — WS historical pull (`req.rs`), HTTP
 /// bridge (`bridge.rs`), and live fan-out (`event.rs`) — so a query that
@@ -22,7 +22,7 @@ pub fn filters_match(filters: &[Filter], event: &StoredEvent) -> bool {
 /// a known event id) still cannot read another user's private event.
 pub fn reader_authorized_for_event(event: &nostr::Event, reader_pubkey_hex: &str) -> bool {
     let kind = crate::kind::event_kind_u32(event);
-    if kind != crate::kind::KIND_DM_VISIBILITY && kind != crate::kind::KIND_AGENT_TURN_METRIC {
+    if !crate::kind::RESULT_GATED_KINDS.contains(&kind) {
         return true;
     }
     let p = nostr::SingleLetterTag::lowercase(nostr::Alphabet::P);
@@ -32,7 +32,77 @@ pub fn reader_authorized_for_event(event: &nostr::Event, reader_pubkey_hex: &str
         .any(|t| t.content() == Some(reader_pubkey_hex))
 }
 
+/// The membership notice kinds (44100 added, 44101 removed). Only the relay
+/// signs them, and it tags each one with its channel's type:
+/// `["t", <channel_type>]` (NIP-CL).
+pub const MEMBERSHIP_NOTICE_KINDS: [u32; 2] = [
+    crate::kind::KIND_MEMBER_ADDED_NOTIFICATION,
+    crate::kind::KIND_MEMBER_REMOVED_NOTIFICATION,
+];
+
+/// The tag name that carries a membership notice's channel type.
+pub const NOTICE_CHANNEL_TYPE_TAG: &str = "t";
+
+/// The channel types that clients knew before NIP-CL typed membership
+/// notices. A filter without `#t` sees notices only about these types, and a
+/// notice without a type tag (stored before NIP-CL) counts as all of them.
+///
+/// Frozen. Do not add a type here: a type added later stays hidden from every
+/// client that does not name it in `#t`.
+pub const LEGACY_NOTICE_CHANNEL_TYPES: [&str; 4] = ["stream", "forum", "dm", "workflow"];
+
+/// Whether `event` is a membership notice (kind 44100/44101).
+pub fn is_membership_notice(event: &nostr::Event) -> bool {
+    MEMBERSHIP_NOTICE_KINDS.contains(&crate::kind::event_kind_u32(event))
+}
+
+/// The channel types whose membership notices `filter` may see: its `#t`
+/// values, or [`LEGACY_NOTICE_CHANNEL_TYPES`] when it has no `#t`.
+///
+/// This is the one rule for notice visibility (NIP-CL). [`filters_match`]
+/// applies it, and `EventQuery::notice_channel_types` applies it in SQL.
+pub fn notice_channel_types(filter: &Filter) -> Option<Vec<String>> {
+    filter
+        .generic_tags
+        .get(&nostr::SingleLetterTag::lowercase(nostr::Alphabet::T))
+        .map(|values| values.iter().map(ToString::to_string).collect())
+}
+
+/// Whether a filter whose visible types are `visible` (see
+/// [`notice_channel_types`]) may see membership notice `event`.
+///
+/// A tagged notice matches when one of its types is visible. An untagged
+/// notice is a legacy type, so it matches when a legacy type is visible.
+pub fn notice_visible(visible: Option<&[String]>, event: &nostr::Event) -> bool {
+    let is_visible = |channel_type: &str| match visible {
+        Some(types) => types.iter().any(|t| t == channel_type),
+        None => LEGACY_NOTICE_CHANNEL_TYPES.contains(&channel_type),
+    };
+    let mut tagged = false;
+    for tag in event.tags.iter() {
+        let tag = tag.as_slice();
+        if tag.first().map(String::as_str) != Some(NOTICE_CHANNEL_TYPE_TAG) {
+            continue;
+        }
+        tagged = true;
+        if tag
+            .get(1)
+            .is_some_and(|channel_type| is_visible(channel_type))
+        {
+            return true;
+        }
+    }
+    !tagged && LEGACY_NOTICE_CHANNEL_TYPES.iter().any(|t| is_visible(t))
+}
+
 fn filter_match_one(f: &Filter, ev: &StoredEvent) -> bool {
+    // A membership notice's `#t` is its channel type, matched by the notice
+    // rule above instead of the plain tag match below.
+    let notice = is_membership_notice(&ev.event);
+    if notice && !notice_visible(notice_channel_types(f).as_deref(), &ev.event) {
+        return false;
+    }
+
     if let Some(kinds) = &f.kinds {
         if !kinds.contains(&ev.event.kind) {
             return false;
@@ -67,6 +137,9 @@ fn filter_match_one(f: &Filter, ev: &StoredEvent) -> bool {
 
     for (tag_key, tag_values) in f.generic_tags.iter() {
         let tag_key_str = tag_key.to_string();
+        if notice && tag_key_str == NOTICE_CHANNEL_TYPE_TAG {
+            continue;
+        }
         let has_match = tag_values.iter().any(|filter_val| {
             ev.event
                 .tags
@@ -119,6 +192,88 @@ mod tests {
         StoredEvent::with_received_at(event, Utc::now(), None, true)
     }
 
+    #[test]
+    fn a_notice_matches_only_filters_that_know_its_channel_type() {
+        let relay = Keys::generate();
+        let member = Keys::generate().public_key();
+        let notice = |kind: u32, channel_type: Option<&str>| {
+            let mut tags = vec![
+                Tag::parse(["p", &member.to_hex()]).unwrap(),
+                Tag::parse(["h", "c"]).unwrap(),
+            ];
+            if let Some(channel_type) = channel_type {
+                tags.push(Tag::parse([NOTICE_CHANNEL_TYPE_TAG, channel_type]).unwrap());
+            }
+            let event = EventBuilder::new(Kind::Custom(kind as u16), "")
+                .tags(tags)
+                .sign_with_keys(&relay)
+                .expect("sign");
+            StoredEvent::with_received_at(event, Utc::now(), None, true)
+        };
+        let filter = |json: serde_json::Value| -> Filter { serde_json::from_value(json).unwrap() };
+        let p = member.to_hex();
+        let all = ["stream", "forum", "dm", "workflow", "system"];
+        // (filter, sees untagged, stream, system, a type added later)
+        let cases = [
+            (
+                serde_json::json!({"kinds": [44100, 44101], "#p": [p]}),
+                [true, true, false, false],
+            ),
+            (serde_json::json!({"#p": [p]}), [true, true, false, false]),
+            (serde_json::json!({}), [true, true, false, false]),
+            (
+                serde_json::json!({"#t": ["other"]}),
+                [false, false, false, false],
+            ),
+            (
+                serde_json::json!({"kinds": [44100, 44101], "#p": [p], "#t": all}),
+                [true, true, true, false],
+            ),
+            (
+                serde_json::json!({"#t": ["system"]}),
+                [false, false, true, false],
+            ),
+            (
+                serde_json::json!({"#t": ["dm"]}),
+                [true, false, false, false],
+            ),
+            (
+                serde_json::json!({"#t": ["future"]}),
+                [false, false, false, true],
+            ),
+        ];
+        for kind in MEMBERSHIP_NOTICE_KINDS {
+            let notices = [
+                notice(kind, None),
+                notice(kind, Some("stream")),
+                notice(kind, Some("system")),
+                notice(kind, Some("future")),
+            ];
+            for (json, expected) in &cases {
+                let f = filter(json.clone());
+                for (ev, expected) in notices.iter().zip(expected) {
+                    assert_eq!(
+                        filters_match(std::slice::from_ref(&f), ev),
+                        *expected,
+                        "kind {kind}, filter {json}, notice {:?}",
+                        ev.event.tags
+                    );
+                }
+            }
+        }
+        // Other kinds keep the plain `#t` match.
+        let other = notice(44200, Some("system"));
+        assert!(filters_match(&[filter(serde_json::json!({}))], &other));
+        assert!(filters_match(
+            &[filter(serde_json::json!({"#t": ["system"]}))],
+            &other
+        ));
+        assert!(!filters_match(
+            &[filter(serde_json::json!({"#t": ["stream"]}))],
+            &other
+        ));
+    }
+
     #[test]
     fn kind_author_since_until_tag_matching() {
         let keys = Keys::generate();
diff --git a/crates/buzz-core/src/kind.rs b/crates/buzz-core/src/kind.rs
index e645dea011..e9e2dfa5e7 100644
--- a/crates/buzz-core/src/kind.rs
+++ b/crates/buzz-core/src/kind.rs
@@ -169,9 +169,20 @@ pub fn k_tag_kinds(event: &nostr::Event) -> impl Iterator<Item = u32> + '_ {
 /// `#p` tag to receive the event. This closes the kindless `{ids:[…]}` read
 /// path for events whose existence must not be leaked.
 ///
-/// Used by `filter_can_match_result_gated_kinds` to force the per-event
-/// fallback path in COUNT rather than the fast SQL `count_events()`.
-pub const RESULT_GATED_KINDS: &[u32] = &[KIND_DM_VISIBILITY, KIND_AGENT_TURN_METRIC];
+/// Membership notices (44100/44101) are here because the relay signs them, so
+/// their id is not author-bound, and they name the target, the channel and
+/// the actor. A system channel's notice must not reach anyone but its target.
+///
+/// This is the one list every delivery surface reads: the filter-level `ids`
+/// exemption, `reader_authorized_for_event` (WS/HTTP history, push), live
+/// fan-out (same pod and Redis), and the COUNT fallback
+/// (`filter_can_match_result_gated_kinds`).
+pub const RESULT_GATED_KINDS: &[u32] = &[
+    KIND_DM_VISIBILITY,
+    KIND_AGENT_TURN_METRIC,
+    KIND_MEMBER_ADDED_NOTIFICATION,
+    KIND_MEMBER_REMOVED_NOTIFICATION,
+];
 
 /// Kinds whose stored events have `#p`-bound read access — readable only by
 /// subscribers whose pubkey appears in the event's `#p` tag.
diff --git a/crates/buzz-db/src/store/channel_members.rs b/crates/buzz-db/src/store/channel_members.rs
index 4855d32ccc..9e7679e0c3 100644
--- a/crates/buzz-db/src/store/channel_members.rs
+++ b/crates/buzz-db/src/store/channel_members.rs
@@ -1288,8 +1288,29 @@ pub async fn get_readable_system_channel_ids(
         .collect()
 }
 
+/// The type of channel `channel_id`, deleted or not, or `None` when no such
+/// channel exists. Membership notices carry it as their `t` tag (NIP-CL).
+pub async fn channel_type_of(
+    pool: &PgPool,
+    community_id: CommunityId,
+    channel_id: Uuid,
+) -> Result<Option<String>> {
+    let mut connection = crate::observability::acquire_writer(
+        pool,
+        crate::observability::WriterOperation::Authorization,
+    )
+    .await?;
+    Ok(sqlx::query_scalar(
+        "SELECT channel_type::text FROM channels WHERE community_id = $1 AND id = $2",
+    )
+    .bind(community_id.as_uuid())
+    .bind(channel_id)
+    .fetch_optional(&mut *connection)
+    .await?)
+}
+
 /// The IDs in `channel_ids` that name system channels, deleted or not.
-/// Push matching and membership notifications use it to skip them.
+/// Push matching uses it to skip them.
 pub async fn system_channel_ids_among(
     pool: &PgPool,
     community_id: CommunityId,
@@ -1954,6 +1975,17 @@ impl Db {
         get_readable_system_channel_ids(&self.pool, community_id, pubkey).await
     }
 
+    /// The type of channel `channel_id`, deleted or not, or `None` when no
+    /// such channel exists.
+    #[datastore_span(name = "channel_type_of", system = "postgresql")]
+    pub async fn channel_type_of(
+        &self,
+        community_id: CommunityId,
+        channel_id: Uuid,
+    ) -> Result<Option<String>> {
+        channel_type_of(&self.pool, community_id, channel_id).await
+    }
+
     /// The IDs in `channel_ids` that name system channels, deleted or not.
     #[datastore_span(name = "system_channel_ids_among", system = "postgresql")]
     pub async fn system_channel_ids_among(
diff --git a/crates/buzz-db/src/store/event.rs b/crates/buzz-db/src/store/event.rs
index 209f09e573..da685f6fe6 100644
--- a/crates/buzz-db/src/store/event.rs
+++ b/crates/buzz-db/src/store/event.rs
@@ -125,6 +125,12 @@ pub struct EventQuery {
     /// containment alone would also admit decoys like `["x","shared","true"]`.
     /// `event_visible_to_reader` remains the post-filter.
     pub shared_gated_reader: Option<Vec<u8>>,
+    /// The channel types whose membership notices (44100/44101) the query may
+    /// return: the filter's `#t` values
+    /// ([`buzz_core::filter::notice_channel_types`]). `None` means the legacy
+    /// types only, so a read path that does not set it never returns a notice
+    /// about a type added later, such as a system channel (NIP-CL).
+    pub notice_channel_types: Option<Vec<String>>,
 }
 
 impl EventQuery {
@@ -158,6 +164,7 @@ impl EventQuery {
             channel_ids_include_global: true,
             max_limit: None,
             shared_gated_reader: None,
+            notice_channel_types: None,
         }
     }
 }
@@ -655,6 +662,7 @@ fn build_query_events_sql(q: &EventQuery) -> QueryBuilder<sqlx::Postgres> {
         let table = if q.p_tag_hex.is_some() { "e" } else { "events" };
         qb.push(format!(" AND NOT ({table}.kind = 45010 AND NOT EXISTS (SELECT 1 FROM artifact_heads ah WHERE ah.community_id={table}.community_id AND ah.event_id={table}.id))"));
     }
+    push_notice_visibility(&mut qb, col_prefix, q);
 
     if let Some(ch) = q.channel_id {
         qb.push(format!(" AND {col_prefix}channel_id = "))
@@ -912,6 +920,55 @@ fn push_tag_value_filters(
     }
 }
 
+/// Return only membership notices whose channel type the query may see
+/// (NIP-CL), as [`buzz_core::filter::notice_visible`] does in `filters_match`:
+/// `AND (kind NOT IN (44100, 44101) OR <type tag in visible types>
+/// [OR <no type tag>])`. An untagged notice is a legacy type, so it is kept
+/// only when a legacy type is visible. Pushed before `LIMIT` so hidden rows
+/// cannot take page slots. Skipped when the query's kinds cannot match a
+/// notice.
+fn push_notice_visibility(qb: &mut QueryBuilder<sqlx::Postgres>, col_prefix: &str, q: &EventQuery) {
+    use buzz_core::filter::{
+        LEGACY_NOTICE_CHANNEL_TYPES, MEMBERSHIP_NOTICE_KINDS, NOTICE_CHANNEL_TYPE_TAG,
+    };
+    if let Some(kinds) = q.kinds.as_deref() {
+        if !kinds
+            .iter()
+            .any(|kind| MEMBERSHIP_NOTICE_KINDS.contains(&(*kind as u32)))
+        {
+            return;
+        }
+    }
+    let visible: Vec<String> = match &q.notice_channel_types {
+        Some(types) => types.clone(),
+        None => LEGACY_NOTICE_CHANNEL_TYPES
+            .iter()
+            .map(|t| (*t).to_owned())
+            .collect(),
+    };
+    let untagged_visible = visible
+        .iter()
+        .any(|t| LEGACY_NOTICE_CHANNEL_TYPES.contains(&t.as_str()));
+    let [added, removed] = MEMBERSHIP_NOTICE_KINDS;
+    qb.push(format!(
+        " AND ({col_prefix}kind NOT IN ({added}, {removed}) OR "
+    ));
+    if visible.is_empty() {
+        qb.push("FALSE");
+    } else {
+        push_exact_tag_match(qb, col_prefix, NOTICE_CHANNEL_TYPE_TAG, &visible);
+    }
+    if untagged_visible {
+        qb.push(format!(
+            " OR NOT EXISTS (SELECT 1 FROM jsonb_array_elements({col_prefix}tags) AS tag \
+             WHERE tag->>0 = "
+        ))
+        .push_bind(NOTICE_CHANNEL_TYPE_TAG.to_owned())
+        .push(")");
+    }
+    qb.push(")");
+}
+
 /// Match `#d` on artifact rows before `LIMIT` while leaving other kinds to the
 /// caller's post-filter: `(kind NOT IN (artifact kinds) OR <exact d match>)`.
 fn push_artifact_d_tag_predicate(
@@ -1030,6 +1087,7 @@ pub(crate) async fn count_events_on(conn: &mut sqlx::PgConnection, q: &EventQuer
         let table = if q.p_tag_hex.is_some() { "e" } else { "events" };
         qb.push(format!(" AND NOT ({table}.kind = 45010 AND NOT EXISTS (SELECT 1 FROM artifact_heads ah WHERE ah.community_id={table}.community_id AND ah.event_id={table}.id))"));
     }
+    push_notice_visibility(&mut qb, col_prefix, q);
 
     if let Some(ch) = q.channel_id {
         qb.push(format!(" AND {col_prefix}channel_id = "))
diff --git a/crates/buzz-relay/src/handlers/count.rs b/crates/buzz-relay/src/handlers/count.rs
index 733449d925..6f97271cf4 100644
--- a/crates/buzz-relay/src/handlers/count.rs
+++ b/crates/buzz-relay/src/handlers/count.rs
@@ -154,7 +154,7 @@ pub async fn handle_count(
         // shared-tag check. A fast count over those kinds would include foreign
         // unshared events, leaking the existence of private agent activity.
         let needs_shared_gate_filtering = filter_can_match_shared_gated_kinds(filter);
-        // Determine if this filter can match result-gated kinds (44200, 30622)
+        // Determine if this filter can match result-gated kinds (`RESULT_GATED_KINDS`)
         // that require a per-event owner check. When the fast SQL path would
         // count matching rows without calling reader_authorized_for_event, a
         // non-owner learns the existence of events they are not allowed to see.
diff --git a/crates/buzz-relay/src/handlers/event.rs b/crates/buzz-relay/src/handlers/event.rs
index f57c10b150..3222f896b4 100644
--- a/crates/buzz-relay/src/handlers/event.rs
+++ b/crates/buzz-relay/src/handlers/event.rs
@@ -174,14 +174,13 @@ pub async fn filter_fanout_by_access(
         matches
     };
 
-    // Owner-only kinds (kind:30622 DM visibility, kind:44200 agent turn
-    // metrics) reach only the pubkey named in their `p` tag. Same predicate as
-    // the pull paths, applied here so local and Redis delivery share it — a
-    // kindless `ids:[…]` subscription can otherwise match these events.
+    // Owner-only kinds (`RESULT_GATED_KINDS`: DM visibility, agent turn
+    // metrics, membership notices) reach only the pubkey named in their `p`
+    // tag. Same predicate as the pull paths, applied here so local and Redis
+    // delivery share it — a kindless `ids:[…]` subscription can otherwise
+    // match these events.
     let kind = event_kind_u32(&stored_event.event);
-    let matches = if kind == buzz_core::kind::KIND_DM_VISIBILITY
-        || kind == buzz_core::kind::KIND_AGENT_TURN_METRIC
-    {
+    let matches = if buzz_core::kind::RESULT_GATED_KINDS.contains(&kind) {
         matches
             .into_iter()
             .filter(|(conn_id, _)| {
diff --git a/crates/buzz-relay/src/handlers/req.rs b/crates/buzz-relay/src/handlers/req.rs
index 3180f227e3..9c6b5d70a6 100644
--- a/crates/buzz-relay/src/handlers/req.rs
+++ b/crates/buzz-relay/src/handlers/req.rs
@@ -7,9 +7,8 @@ use tracing::{debug, warn};
 
 use buzz_core::filter::filters_match;
 use buzz_core::kind::{
-    is_unshared_gated_event, AUTHOR_ONLY_KINDS, KIND_AGENT_ENGRAM, KIND_AGENT_TURN_METRIC,
-    KIND_DELETION, KIND_DM_VISIBILITY, KIND_HUDDLE_LIVENESS, P_GATED_KINDS, RESULT_GATED_KINDS,
-    SHARED_GATED_KINDS,
+    is_unshared_gated_event, AUTHOR_ONLY_KINDS, KIND_AGENT_ENGRAM, KIND_DELETION,
+    KIND_HUDDLE_LIVENESS, P_GATED_KINDS, RESULT_GATED_KINDS, SHARED_GATED_KINDS,
 };
 use buzz_core::tenant::TenantContext;
 use buzz_db::EventQuery;
@@ -1254,8 +1253,12 @@ fn filter_to_query_params(
         .map(|values| values.iter().map(|v| v.to_string()).collect());
 
     let tag_values = group_state_tag_values(filter);
+    // NIP-CL: a membership notice's `#t` is its channel type. SQL keeps only
+    // the types this filter may see; a filter without `#t` sees legacy types.
+    let notice_channel_types = buzz_core::filter::notice_channel_types(filter);
 
     EventQuery {
+        notice_channel_types,
         channel_id,
         kinds,
         pubkey,
@@ -1656,13 +1659,14 @@ pub(crate) fn p_gated_filters_authorized(filters: &[Filter], authed_pubkey_hex:
         // when `ids` is present. KIND_AGENT_TURN_METRIC events are long-lived
         // and their cleartext envelope (pubkey, agent tag, created_at) leaks
         // turn-activity metadata — knowing an event id is NOT authorization
-        // (NIP-AM §Relay Behavior). Only filters that explicitly name the kind
-        // lose the exemption — a kindless `ids` lookup is unaffected.
+        // (NIP-AM §Relay Behavior). Membership notices are relay-signed and
+        // name the target and channel. All of these are RESULT_GATED_KINDS.
+        // Only filters that explicitly name the kind lose the exemption — a
+        // kindless `ids` lookup is admitted and then gated per result by
+        // `reader_authorized_for_event`.
         let explicitly_no_ids_exemption = filter.kinds.as_ref().is_some_and(|ks| {
-            ks.iter().any(|kind| {
-                let k = kind.as_u16() as u32;
-                k == KIND_DM_VISIBILITY || k == KIND_AGENT_TURN_METRIC
-            })
+            ks.iter()
+                .any(|kind| RESULT_GATED_KINDS.contains(&(kind.as_u16() as u32)))
         });
         if !explicitly_no_ids_exemption && filter.ids.as_ref().is_some_and(|ids| !ids.is_empty()) {
             return true;
@@ -1761,8 +1765,7 @@ pub(crate) fn filter_can_match_shared_gated_kinds(filter: &Filter) -> bool {
 
 /// Returns `true` if the filter CAN match result-gated kinds — meaning it
 /// either has no `kinds` constraint (wildcard) or includes at least one kind
-/// that carries a per-event result-level read gate (currently
-/// `KIND_DM_VISIBILITY` and `KIND_AGENT_TURN_METRIC`).
+/// that carries a per-event result-level read gate (`RESULT_GATED_KINDS`).
 ///
 /// Used by the COUNT handler to force the per-event fallback path instead of
 /// the fast SQL `count_events()`, which cannot enforce the owner-only result
@@ -2952,13 +2955,22 @@ mod tests {
         let owner = Filter::new().kind(dm_vis).custom_tags(p_tag, [authed]);
         assert!(p_gated_filters_authorized(&[owner], authed));
 
-        // The ids exemption still applies to other p-gated kinds (member notifs).
-        let member_notif_ids = Filter::new()
-            .kind(nostr::Kind::Custom(
-                buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION as u16,
-            ))
-            .id(nostr::EventId::from_hex(snapshot_id).unwrap());
-        assert!(p_gated_filters_authorized(&[member_notif_ids], authed));
+        // Membership notices are relay-signed too: knowing one's id is not
+        // authorization (a system channel's notice names a hidden channel).
+        for kind in [
+            buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION,
+            buzz_core::kind::KIND_MEMBER_REMOVED_NOTIFICATION,
+        ] {
+            let ids_only = Filter::new()
+                .kind(nostr::Kind::Custom(kind as u16))
+                .id(nostr::EventId::from_hex(snapshot_id).unwrap());
+            assert!(!p_gated_filters_authorized(&[ids_only], authed));
+            let own = Filter::new()
+                .kind(nostr::Kind::Custom(kind as u16))
+                .id(nostr::EventId::from_hex(snapshot_id).unwrap())
+                .custom_tags(p_tag, [authed]);
+            assert!(p_gated_filters_authorized(&[own], authed));
+        }
     }
 
     /// NIP-AM: kind 44200 must deny `{kinds:[44200], ids:[...]}` by non-owner.
diff --git a/crates/buzz-relay/src/handlers/side_effects.rs b/crates/buzz-relay/src/handlers/side_effects.rs
index 38d035910b..f5b55410d3 100644
--- a/crates/buzz-relay/src/handlers/side_effects.rs
+++ b/crates/buzz-relay/src/handlers/side_effects.rs
@@ -1059,8 +1059,12 @@ pub fn emit_live_thread_summary(
 
 /// Emit a relay-signed membership notification event stored globally (channel_id = None).
 ///
-/// kind:44100 = member added, kind:44101 = member removed. System channels
-/// emit none.
+/// kind:44100 = member added, kind:44101 = member removed. Every notice
+/// carries its channel's type as `["t", <channel_type>]` (NIP-CL). This is
+/// the only place that reads the channel type for notices. Every read and live
+/// path shows a notice only to a filter that knows its type
+/// (`buzz_core::filter::notice_visible`), so a client never sees a notice
+/// about a type it does not know, such as a system channel.
 /// The p tag addresses the target pubkey; the h tag carries the channel UUID as metadata.
 /// Stored with channel_id = None so global subscribers receive it via slow-path fan-out.
 pub async fn emit_membership_notification(
@@ -1071,16 +1075,16 @@ pub async fn emit_membership_notification(
     actor_pubkey: &[u8],
     notification_kind: u32,
 ) -> anyhow::Result<()> {
-    // A system channel is left out of clients' channel lists, so it sends no
-    // membership notifications: a client that receives one would show it.
-    if !state
+    // No channel row means no type to tag. Send nothing rather than an
+    // untagged notice, which every client would treat as a legacy type.
+    let Some(channel_type) = state
         .db
-        .system_channel_ids_among(tenant.community(), &[channel_id])
+        .channel_type_of(tenant.community(), channel_id)
         .await?
-        .is_empty()
-    {
+    else {
+        warn!(%channel_id, "membership notice skipped: channel not found");
         return Ok(());
-    }
+    };
     let target_hex = hex::encode(target_pubkey);
     let actor_hex = hex::encode(actor_pubkey);
     let channel_id_str = channel_id.to_string();
@@ -1107,8 +1111,10 @@ pub async fn emit_membership_notification(
     })
     .to_string();
 
+    let type_tag = Tag::parse([buzz_core::filter::NOTICE_CHANNEL_TYPE_TAG, &channel_type])
+        .map_err(|e| anyhow::anyhow!("failed to build channel type tag: {e}"))?;
     let event = EventBuilder::new(Kind::Custom(notification_kind as u16), content)
-        .tags([p_tag, h_tag])
+        .tags([p_tag, h_tag, type_tag])
         .sign_with_keys(&state.relay_keypair)
         .map_err(|e| anyhow::anyhow!("failed to sign membership notification: {e}"))?;
 
diff --git a/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs b/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
index d99ddb748e..a74644e21e 100644
--- a/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
+++ b/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
@@ -175,7 +175,7 @@ fn bridge_count(body: Option<Value>) -> u64 {
     })
 }
 
-fn sorted(mut ids: Vec<String>) -> Vec<String> {
+fn sorted<T: Ord>(mut ids: Vec<T>) -> Vec<T> {
     ids.sort();
     ids
 }
@@ -428,17 +428,77 @@ async fn named_channels_missing_from_the_cache_are_confirmed_together() {
     assert!(readable_system.is_empty());
 }
 
-/// Adding a member to a system channel sends no kind:44100 notification,
-/// which an existing client would show as a new channel. An ordinary
-/// channel still sends one, so the check is not vacuous.
-/// Mutation: drop the system check in `emit_membership_notification` → RED.
+/// Every membership notice is a stored kind:44100/44101 tagged with its
+/// channel type (`["t","stream"]`, `["t","system"]`). A filter sees a notice
+/// only when it knows the type: a filter without `#t` (every client today)
+/// sees the legacy types, and a filter with `#t` sees the types it names. One
+/// filter can name all types. This holds on every path: live fan-out, REQ
+/// history, COUNT, and the HTTP bridge. An untagged notice stored before the
+/// tag existed counts as a legacy type.
+/// Mutation: drop the type tag in `emit_membership_notification` → RED;
+/// drop the `notice_visible` check in `filters_match` → RED (live and
+/// post-filtered reads show the system notice); drop the untagged clause in
+/// `push_notice_visibility` → RED (the legacy notice disappears).
 #[tokio::test]
 #[ignore = "requires Postgres and Redis"]
-async fn system_channels_send_no_membership_notifications() {
+async fn membership_notices_reach_only_filters_that_know_their_type() {
+    use buzz_core::kind::{KIND_MEMBER_ADDED_NOTIFICATION, KIND_MEMBER_REMOVED_NOTIFICATION};
     let f = fixture().await;
     let owner = Keys::generate();
     let member = Keys::generate();
     let member_hex = member.public_key().to_hex();
+    let kinds = [
+        KIND_MEMBER_ADDED_NOTIFICATION,
+        KIND_MEMBER_REMOVED_NOTIFICATION,
+    ];
+    let old = json!({"kinds": kinds, "#p": [member_hex]});
+    let asks = json!({"kinds": kinds, "#p": [member_hex], "#t": ["system"]});
+    let all = json!({
+        "kinds": kinds,
+        "#p": [member_hex],
+        "#t": ["stream", "forum", "dm", "workflow", "system"],
+    });
+
+    // The member's live global subscriptions: one as clients send today, one
+    // that asks for system notices, and one that names every type. An outsider also holds a subscription
+    // that asks. It is registered directly, as if some filter (for example a
+    // kindless `ids` lookup) had been admitted, so only the fan-out gate can
+    // keep the notices from it.
+    let register = |reader: &Keys, subs: &[(&str, &Value)]| {
+        let conn_id = Uuid::new_v4();
+        let (tx, rx) = tokio::sync::mpsc::channel(32);
+        f.state.conn_manager.register(
+            conn_id,
+            tx,
+            tokio::sync::mpsc::channel(4).0,
+            tokio::sync::mpsc::channel(1).0,
+            None,
+            tokio_util::sync::CancellationToken::new(),
+            f.tenant.community(),
+            Arc::new(std::sync::atomic::AtomicU8::new(0)),
+            Arc::new(tokio::sync::Mutex::new(Default::default())),
+            3,
+            crate::state::CommunityConnectionControl::new(
+                tokio_util::sync::CancellationToken::new(),
+            ),
+        );
+        f.state
+            .conn_manager
+            .set_authenticated_pubkey(conn_id, reader.public_key().to_bytes().to_vec());
+        for (sub, filter) in subs {
+            f.state.sub_registry.register_scoped(
+                f.tenant.community(),
+                conn_id,
+                (*sub).into(),
+                vec![serde_json::from_value((*filter).clone()).expect("filter")],
+                None,
+            );
+        }
+        rx
+    };
+    let mut rx = register(&member, &[("old", &old), ("asks", &asks), ("all", &all)]);
+    let outsider = Keys::generate();
+    let mut outsider_rx = register(&outsider, &[("outsider", &json!({"#t": ["system"]}))]);
 
     let system = create_channel(&f.state, &f.tenant, &owner, &[&["channel_type", "system"]]).await;
     let ordinary = create_channel(&f.state, &f.tenant, &owner, &[]).await;
@@ -452,36 +512,309 @@ async fn system_channels_send_no_membership_notifications() {
         )
         .await;
     }
-    // Notifications are written after the reply; give the task a moment.
-    let mut notified = Vec::new();
-    for _ in 0..50 {
-        notified = f
-            .state
-            .db
-            .query_events(&EventQuery {
-                kinds: Some(vec![buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION as i32]),
-                p_tag_hex: Some(member_hex.clone()),
-                ..EventQuery::for_community(f.tenant.community())
-            })
+    publish(
+        &f,
+        &owner,
+        9001,
+        "",
+        &[&["h", &system.to_string()], &["p", &member_hex]],
+    )
+    .await;
+
+    // Notifications are sent after the reply; collect the six frames.
+    let mut live = Vec::new();
+    let mut ids = std::collections::HashMap::new();
+    while live.len() < 6 {
+        let frame = tokio::time::timeout(std::time::Duration::from_secs(5), rx.recv())
             .await
-            .expect("query notifications")
-            .into_iter()
-            .map(|stored| {
-                stored
-                    .event
-                    .tags
-                    .iter()
-                    .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
-                    .and_then(|tag| tag.as_slice().get(1).cloned())
-                    .expect("h tag")
-            })
-            .collect::<Vec<_>>();
-        if !notified.is_empty() {
+            .unwrap_or_else(|_| panic!("notices so far: {live:?}"))
+            .expect("connection open");
+        let axum::extract::ws::Message::Text(text) = frame else {
+            continue;
+        };
+        let message: Value = serde_json::from_str(&text).expect("relay frame");
+        if message[0] != "EVENT" {
+            continue;
+        }
+        let event: nostr::Event = serde_json::from_value(message[2].clone()).expect("event");
+        assert_eq!(
+            event.pubkey,
+            f.state.relay_keypair.public_key(),
+            "relay-signed"
+        );
+        let h = event
+            .tags
+            .iter()
+            .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
+            .and_then(|tag| tag.as_slice().get(1).cloned())
+            .expect("h tag");
+        let channel_type = event
+            .tags
+            .iter()
+            .find(|tag| tag.as_slice().first().map(String::as_str) == Some("t"))
+            .and_then(|tag| tag.as_slice().get(1).cloned());
+        let expected_type = if h == system.to_string() {
+            "system"
+        } else {
+            "stream"
+        };
+        assert_eq!(channel_type.as_deref(), Some(expected_type), "type tag");
+        let kind = u32::from(event.kind.as_u16());
+        ids.insert((kind, h.clone()), event.id.to_hex());
+        live.push((message[1].as_str().expect("sub id").to_owned(), kind, h));
+    }
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(200), rx.recv())
+            .await
+            .is_err(),
+        "no seventh notice"
+    );
+    assert_eq!(
+        sorted(live),
+        sorted(vec![
+            (
+                "asks".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "asks".into(),
+                KIND_MEMBER_REMOVED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "old".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                ordinary.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_REMOVED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                ordinary.to_string()
+            ),
+        ])
+    );
+    let ordinary_added = ids[&(KIND_MEMBER_ADDED_NOTIFICATION, ordinary.to_string())].clone();
+    let system_notices = sorted(vec![
+        ids[&(KIND_MEMBER_ADDED_NOTIFICATION, system.to_string())].clone(),
+        ids[&(KIND_MEMBER_REMOVED_NOTIFICATION, system.to_string())].clone(),
+    ]);
+
+    // History: the system notices are stored, and only the asking filter
+    // reads them.
+    assert_eq!(
+        req(&f, &member, old.clone()).await,
+        std::slice::from_ref(&ordinary_added)
+    );
+    assert_eq!(count(&f, &member, old.clone()).await, 1);
+    assert_eq!(
+        bridge_ids(bridge(&f, &member, "/query", json!([old])).await),
+        std::slice::from_ref(&ordinary_added)
+    );
+    assert_eq!(
+        bridge_count(bridge(&f, &member, "/count", json!([old])).await),
+        1
+    );
+    assert_eq!(sorted(req(&f, &member, asks.clone()).await), system_notices);
+    assert_eq!(count(&f, &member, asks.clone()).await, 2);
+    assert_eq!(
+        sorted(bridge_ids(
+            bridge(&f, &member, "/query", json!([asks])).await
+        )),
+        system_notices
+    );
+    // Replay with `since` works for the asking filter.
+    let mut since = asks.clone();
+    since["since"] = json!(0);
+    assert_eq!(sorted(req(&f, &member, since).await), system_notices);
+    // One filter that names every type reads all three notices.
+    let every_notice = {
+        let mut ids = system_notices.clone();
+        ids.push(ordinary_added.clone());
+        sorted(ids)
+    };
+    assert_eq!(sorted(req(&f, &member, all.clone()).await), every_notice);
+    assert_eq!(count(&f, &member, all.clone()).await, 3);
+    assert_eq!(
+        sorted(bridge_ids(
+            bridge(&f, &member, "/query", json!([all])).await
+        )),
+        every_notice
+    );
+
+    // A notice stored before notices had a type tag counts as a legacy type:
+    // filters without `#t`, and filters that name a legacy type, read it.
+    let legacy_channel = Uuid::new_v4().to_string();
+    let legacy = nostr::EventBuilder::new(
+        nostr::Kind::Custom(KIND_MEMBER_ADDED_NOTIFICATION as u16),
+        "",
+    )
+    .tags([
+        nostr::Tag::parse(["p", &member_hex]).unwrap(),
+        nostr::Tag::parse(["h", &legacy_channel]).unwrap(),
+    ])
+    .sign_with_keys(&f.state.relay_keypair)
+    .expect("sign");
+    f.state
+        .db
+        .insert_event(f.tenant.community(), &legacy, None)
+        .await
+        .expect("store legacy notice");
+    let legacy_id = legacy.id.to_hex();
+    let with_legacy = |ids: &[String]| {
+        let mut ids = ids.to_vec();
+        ids.push(legacy_id.clone());
+        sorted(ids)
+    };
+    assert_eq!(
+        sorted(req(&f, &member, old.clone()).await),
+        with_legacy(std::slice::from_ref(&ordinary_added))
+    );
+    assert_eq!(count(&f, &member, old.clone()).await, 2);
+    assert_eq!(
+        sorted(req(&f, &member, all.clone()).await),
+        with_legacy(&every_notice)
+    );
+    assert_eq!(count(&f, &member, all.clone()).await, 4);
+    assert_eq!(sorted(req(&f, &member, asks.clone()).await), system_notices);
+
+    // Knowing a notice's id is not authorization: only its target reads,
+    // counts or receives it, with or without `kinds`.
+    // Mutation: drop 44100/44101 from RESULT_GATED_KINDS → RED.
+    assert!(
+        outsider_rx.try_recv().is_err(),
+        "live fan-out reached a non-target"
+    );
+    let by_id = |with_kinds: bool| {
+        let mut filter = json!({"ids": system_notices, "#t": ["system"]});
+        if with_kinds {
+            filter["kinds"] = json!(kinds);
+        }
+        filter
+    };
+    for with_kinds in [true, false] {
+        let filter = by_id(with_kinds);
+        assert!(
+            req(&f, &outsider, filter.clone()).await.is_empty(),
+            "{filter}"
+        );
+        assert_eq!(count(&f, &outsider, filter.clone()).await, 0, "{filter}");
+        assert!(
+            bridge_ids(bridge(&f, &outsider, "/query", json!([filter])).await).is_empty(),
+            "{filter}"
+        );
+        assert_eq!(
+            bridge_count(bridge(&f, &outsider, "/count", json!([filter])).await),
+            0,
+            "{filter}"
+        );
+    }
+    // The target's own kindless id lookup still works.
+    assert_eq!(sorted(req(&f, &member, by_id(false)).await), system_notices);
+}
+
+/// The database returns only legacy-type notices unless the query names
+/// other types, so a read path that builds its own `EventQuery` and forgets
+/// the rule still hides system notices.
+/// Mutation: drop `push_notice_visibility` → RED.
+#[tokio::test]
+#[ignore = "requires Postgres and Redis"]
+async fn the_database_returns_only_legacy_type_notices_by_default() {
+    use buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION;
+    let f = fixture().await;
+    let owner = Keys::generate();
+    let member = Keys::generate();
+    let member_hex = member.public_key().to_hex();
+    let system = create_channel(&f.state, &f.tenant, &owner, &[&["channel_type", "system"]]).await;
+    let ordinary = create_channel(&f.state, &f.tenant, &owner, &[]).await;
+    for channel in [system, ordinary] {
+        publish(
+            &f,
+            &owner,
+            9000,
+            "",
+            &[&["h", &channel.to_string()], &["p", &member_hex]],
+        )
+        .await;
+    }
+    // Kindless, but global only: the notices are the only global events
+    // that mention the member.
+    let base = EventQuery {
+        p_tag_hex: Some(member_hex.clone()),
+        global_only: true,
+        ..EventQuery::for_community(f.tenant.community())
+    };
+    let channels_of = |events: Vec<buzz_core::StoredEvent>| {
+        sorted(
+            events
+                .into_iter()
+                .map(|stored| {
+                    stored
+                        .event
+                        .tags
+                        .iter()
+                        .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
+                        .and_then(|tag| tag.as_slice().get(1).cloned())
+                        .expect("h tag")
+                })
+                .collect(),
+        )
+    };
+    // Notifications are written after the reply; wait for both.
+    let mut all = Vec::new();
+    for _ in 0..50 {
+        all = channels_of(
+            f.state
+                .db
+                .query_events(&EventQuery {
+                    notice_channel_types: Some(vec!["stream".into(), "system".into()]),
+                    ..base.clone()
+                })
+                .await
+                .expect("query"),
+        );
+        if all.len() == 2 {
             break;
         }
         tokio::time::sleep(std::time::Duration::from_millis(20)).await;
     }
-    assert_eq!(sorted(notified), vec![ordinary.to_string()]);
+    assert_eq!(all, sorted(vec![system.to_string(), ordinary.to_string()]));
+
+    for query in [
+        base.clone(),
+        EventQuery {
+            kinds: Some(vec![KIND_MEMBER_ADDED_NOTIFICATION as i32]),
+            ..base.clone()
+        },
+    ] {
+        assert_eq!(
+            channels_of(f.state.db.query_events(&query).await.expect("query")),
+            [ordinary.to_string()]
+        );
+        assert_eq!(f.state.db.count_events(&query).await.expect("count"), 1);
+    }
+    let only_system = EventQuery {
+        notice_channel_types: Some(vec!["system".into()]),
+        ..base.clone()
+    };
+    assert_eq!(
+        channels_of(f.state.db.query_events(&only_system).await.expect("query")),
+        [system.to_string()]
+    );
+    assert_eq!(
+        f.state.db.count_events(&only_system).await.expect("count"),
+        1
+    );
 }
 
 /// A group-state filter with `#t:["system"]` or any `#P` finds the system
diff --git a/docs/nips/NIP-CL.md b/docs/nips/NIP-CL.md
index 662e88fa94..b7c415a73d 100644
--- a/docs/nips/NIP-CL.md
+++ b/docs/nips/NIP-CL.md
@@ -186,9 +186,52 @@ a system channel stays an ordinary NIP-29 group.
 The relay decides this for each filter. A filter that names a system channel
 does not add it to another filter in the same request.
 
-The relay MUST NOT send push notifications or kind:44100/44101 membership
-notifications for system channels. A client that received one would show the
-channel.
+The relay MUST NOT send push notifications for system channels.
+
+### Membership notices carry the channel type
+
+Every kind:44100 (added) and kind:44101 (removed) notice has one more tag,
+`["t", <channel_type>]`, for example `["t", "stream"]` or `["t", "system"]`.
+The relay sets it from the channel type when it sends the notice. A channel's
+type does not change. The relay stores the notice like any other 44100/44101.
+
+A client sees a notice only if it knows the notice's channel type. Old
+clients do not know types added later, such as `system`, and would show the
+channel from such a notice. So the relay MUST apply this rule:
+
+- **A filter with `#t`** matches a notice only when the notice's type is one
+  of the `#t` values.
+- **A filter without `#t`** matches a notice only when its type is one of the
+  **legacy types**: `stream`, `forum`, `dm`, `workflow`. This list is fixed.
+  A type added later is never on it, so old clients never see its notices.
+- **A notice without a `t` tag** was stored before this rule. Every such
+  notice is about a legacy type, so the relay treats it as all of them: it
+  matches a filter without `#t`, and a filter whose `#t` has a legacy type.
+  On these two kinds, this replaces the plain NIP-01 `#t` match.
+
+The rule applies on every path: REQ history, live delivery, COUNT, and any
+relay-specific query API. Existing clients do not send `#t` on these kinds,
+so they see no change.
+
+A client that knows every current type sends one filter:
+
+```json
+{"kinds": [44100, 44101], "#p": ["<me>"], "#t": ["stream", "forum", "dm", "workflow", "system"]}
+```
+
+When Buzz adds a type, a client adds its value to `#t` when it supports that
+type.
+
+The `#p` rule for 44100/44101 still applies: it must be the reader's own
+pubkey. An `ids` filter does not lift it: the relay returns, counts or
+delivers a 44100/44101 only to the pubkey in its `p` tag, even to a reader
+who knows the event id.
+
+Because the notices are stored, a client that reconnects can set `since` to
+the newest notice it has seen. One subscription then returns the notices it
+missed and the new ones, so no change falls between a read and a
+subscription. A notice is a hint: the channel's group-state events decide
+membership.
 
 ### Asking for system channels