From cc6336d9851983ca341d40cf2332052e9394a4f2 Mon Sep 17 00:00:00 2001
From: Logan Johnson <loganj@squareup.com>
Date: Mon, 19 Oct 2026 16:29:32 -0400
Subject: [PATCH] feat(relay): tag every membership notice with its channel
 type (#8406)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🤖
## Summary
- When someone is added to or removed from a system channel, the relay
now sends them the usual "you were added / removed" notice. Before, it
sent nothing, so a client could learn about a new system channel only by
rereading every channel.
- **A client sees a notice only if it knows the channel's type.** Every
membership notice now carries its channel type. Clients that do not send
`#t` (every client today) see only the types that existed before system
channels, so they see no change. A type that Buzz adds later is hidden
from them by default.
- The notices are stored like every other membership notice, so a client
that was offline can catch up with `since` instead of rereading all its
channels.

## Details
- Every kind:44100 (added) and kind:44101 (removed) notice now carries
`["t", <channel_type>]`, for example `["t","stream"]` or
`["t","system"]`.
- **One place reads the channel type:** `emit_membership_notification`
in `side_effects.rs`, where the relay signs the notice. A channel's type
is set when it is created and no code path changes it, so the tag stays
correct. If the channel row is missing, the relay sends no notice rather
than an untagged one.
- **The rule (NIP-CL):**
- a filter with `#t` matches a notice only when the notice's type is one
of its `#t` values;
- a filter without `#t` matches only the **legacy types**: `stream`,
`forum`, `dm`, `workflow`. This list is frozen
(`LEGACY_NOTICE_CHANNEL_TYPES`), so a new type never joins it;
- a notice without a `t` tag was stored before this change. It is always
a legacy type, so the relay treats it as one, and replay across the
upgrade stays complete.
- **Fails closed.** The rule lives in two shared places, and both
default to the legacy types. A read path that is not updated behaves as
it does today:
- `filters_match` / `notice_visible` (buzz-core). Live fan-out, the REQ
history post-filter, COUNT, the HTTP bridge and push all match through
it.
- `EventQuery::notice_channel_types` (buzz-db). Its SQL keeps only
visible notices before `LIMIT`, so page limits and COUNT stay exact.
`None` means legacy types. Only `filter_to_query_params` sets it, from
the filter's `#t`.
- A client that knows every current type sends one filter:
`{"kinds":[44100,44101],"#p":[<me>],"#t":["stream","forum","dm","workflow","system"]}`.
NIP-CL and NOSTR.md describe this.
- **Only the target receives a notice.** A notice names the target, the
channel and who made the change, and the relay signs it, so knowing its
id is not permission to read it. 44100/44101 are now in
`RESULT_GATED_KINDS`, the one list used by the `ids` exemption check,
the per-result reader check (WS and HTTP history, push), live fan-out
(same pod and Redis) and COUNT. This also closes the same id lookup for
ordinary channels' notices.
- No migration: 44100/44101 are already excluded from search indexing.

## Testing
- `buzz-core`: a table test covers untagged, `stream`, `system` and a
future type against filters without `#t`, with `#t` for one type, and
with `#t` for every type. Other kinds keep the plain `#t` match.
- Postgres tests (`system_channel_postgres_tests.rs`): live fan-out, REQ
history, COUNT and the HTTP bridge, for a filter without `#t`, a
`#t:["system"]` filter and an all-types filter; an untagged legacy
notice; a non-target with an `ids` filter on each path; and a raw
`EventQuery` that does not set the field.
- I broke each part on purpose and the tests failed: no type tag on the
notice, no rule in `filters_match`, no SQL rule, and no untagged clause
in the SQL.
- End to end: I built a relay container from f24f8e7ba and ran
buzz-app's `container-relay.e2e.test.ts` (block/buzz-app#1290) against
it. The live system channel test passed 5 of 5 runs.

Paired client change: block/buzz-app#1290. It works unchanged against
this relay.

---------

Signed-off-by: Logan Johnson <loganj@squareup.com>
Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz>
---
 NOSTR.md                                      |  10 +-
 crates/buzz-core/src/filter.rs                | 163 +++++++-
 crates/buzz-core/src/kind.rs                  |  17 +-
 crates/buzz-db/src/store/channel_members.rs   |  34 +-
 crates/buzz-db/src/store/event.rs             |  58 +++
 crates/buzz-relay/src/handlers/count.rs       |   2 +-
 crates/buzz-relay/src/handlers/event.rs       |  13 +-
 crates/buzz-relay/src/handlers/req.rs         |  48 ++-
 .../buzz-relay/src/handlers/side_effects.rs   |  26 +-
 .../handlers/system_channel_postgres_tests.rs | 395 ++++++++++++++++--
 docs/nips/NIP-CL.md                           |  49 ++-
 11 files changed, 736 insertions(+), 79 deletions(-)

diff --git a/NOSTR.md b/NOSTR.md
index 62e438d30d..96ccb0edc0 100644
--- a/NOSTR.md
+++ b/NOSTR.md
@@ -152,7 +152,10 @@ out unless they ask for it:
   combine with OR, so `#t:["system", <label>]` does not mean "a system
   channel with this label".
 
-Push and kind:44100/44101 membership notifications skip system channels.
+Push notifications skip system channels. Every kind:44100/44101 membership
+notification carries its channel type as `t`, and a filter without `#t` sees
+only the legacy types, so system channel notices reach only a filter with
+`#t:["system"]` (see NIP-CL).
 
 Events are stored **channel-scoped** so access control applies — private channel member lists are
 only visible to members. Discover groups via historical REQ:
@@ -178,6 +181,11 @@ The relay emits relay-signed notifications when members are added or removed:
 | **44100** | Member added | `p` = target pubkey, `h` = channel UUID | Community-global |
 | **44101** | Member removed | `p` = target pubkey, `h` = channel UUID | Community-global |
 
+Each notice also has `t` = the channel type (`stream`, `forum`, `dm`,
+`workflow`, `system`). A filter with `#t` gets only the types it names. A
+filter without `#t` gets only `stream`, `forum`, `dm` and `workflow`, and so
+does an untagged notice stored before the tag existed (NIP-CL).
+
 Stored community-globally (`channel_id = None` inside the connected community) so agents and clients can subscribe without knowing channel
 UUIDs in advance. Client-submitted kind:44100/44101 events are rejected — only the relay keypair
 may sign these.
diff --git a/crates/buzz-core/src/filter.rs b/crates/buzz-core/src/filter.rs
index 32e3a7ad16..43753df94d 100644
--- a/crates/buzz-core/src/filter.rs
+++ b/crates/buzz-core/src/filter.rs
@@ -12,9 +12,9 @@ pub fn filters_match(filters: &[Filter], event: &StoredEvent) -> bool {
 }
 
 /// Result-level read authorization for relay-signed events whose content is
-/// private to a single viewer. Currently gates `KIND_DM_VISIBILITY` and
-/// `KIND_AGENT_TURN_METRIC`: the reader MUST equal the event's `#p` tag
-/// (owner). Returns `true` for every other kind.
+/// private to a single viewer: the kinds in
+/// [`crate::kind::RESULT_GATED_KINDS`]. The reader MUST equal the event's
+/// `#p` tag (owner). Returns `true` for every other kind.
 ///
 /// This guards every delivery surface — WS historical pull (`req.rs`), HTTP
 /// bridge (`bridge.rs`), and live fan-out (`event.rs`) — so a query that
@@ -22,7 +22,7 @@ pub fn filters_match(filters: &[Filter], event: &StoredEvent) -> bool {
 /// a known event id) still cannot read another user's private event.
 pub fn reader_authorized_for_event(event: &nostr::Event, reader_pubkey_hex: &str) -> bool {
     let kind = crate::kind::event_kind_u32(event);
-    if kind != crate::kind::KIND_DM_VISIBILITY && kind != crate::kind::KIND_AGENT_TURN_METRIC {
+    if !crate::kind::RESULT_GATED_KINDS.contains(&kind) {
         return true;
     }
     let p = nostr::SingleLetterTag::lowercase(nostr::Alphabet::P);
@@ -32,7 +32,77 @@ pub fn reader_authorized_for_event(event: &nostr::Event, reader_pubkey_hex: &str
         .any(|t| t.content() == Some(reader_pubkey_hex))
 }
 
+/// The membership notice kinds (44100 added, 44101 removed). Only the relay
+/// signs them, and it tags each one with its channel's type:
+/// `["t", <channel_type>]` (NIP-CL).
+pub const MEMBERSHIP_NOTICE_KINDS: [u32; 2] = [
+    crate::kind::KIND_MEMBER_ADDED_NOTIFICATION,
+    crate::kind::KIND_MEMBER_REMOVED_NOTIFICATION,
+];
+
+/// The tag name that carries a membership notice's channel type.
+pub const NOTICE_CHANNEL_TYPE_TAG: &str = "t";
+
+/// The channel types that clients knew before NIP-CL typed membership
+/// notices. A filter without `#t` sees notices only about these types, and a
+/// notice without a type tag (stored before NIP-CL) counts as all of them.
+///
+/// Frozen. Do not add a type here: a type added later stays hidden from every
+/// client that does not name it in `#t`.
+pub const LEGACY_NOTICE_CHANNEL_TYPES: [&str; 4] = ["stream", "forum", "dm", "workflow"];
+
+/// Whether `event` is a membership notice (kind 44100/44101).
+pub fn is_membership_notice(event: &nostr::Event) -> bool {
+    MEMBERSHIP_NOTICE_KINDS.contains(&crate::kind::event_kind_u32(event))
+}
+
+/// The channel types whose membership notices `filter` may see: its `#t`
+/// values, or [`LEGACY_NOTICE_CHANNEL_TYPES`] when it has no `#t`.
+///
+/// This is the one rule for notice visibility (NIP-CL). [`filters_match`]
+/// applies it, and `EventQuery::notice_channel_types` applies it in SQL.
+pub fn notice_channel_types(filter: &Filter) -> Option<Vec<String>> {
+    filter
+        .generic_tags
+        .get(&nostr::SingleLetterTag::lowercase(nostr::Alphabet::T))
+        .map(|values| values.iter().map(ToString::to_string).collect())
+}
+
+/// Whether a filter whose visible types are `visible` (see
+/// [`notice_channel_types`]) may see membership notice `event`.
+///
+/// A tagged notice matches when one of its types is visible. An untagged
+/// notice is a legacy type, so it matches when a legacy type is visible.
+pub fn notice_visible(visible: Option<&[String]>, event: &nostr::Event) -> bool {
+    let is_visible = |channel_type: &str| match visible {
+        Some(types) => types.iter().any(|t| t == channel_type),
+        None => LEGACY_NOTICE_CHANNEL_TYPES.contains(&channel_type),
+    };
+    let mut tagged = false;
+    for tag in event.tags.iter() {
+        let tag = tag.as_slice();
+        if tag.first().map(String::as_str) != Some(NOTICE_CHANNEL_TYPE_TAG) {
+            continue;
+        }
+        tagged = true;
+        if tag
+            .get(1)
+            .is_some_and(|channel_type| is_visible(channel_type))
+        {
+            return true;
+        }
+    }
+    !tagged && LEGACY_NOTICE_CHANNEL_TYPES.iter().any(|t| is_visible(t))
+}
+
 fn filter_match_one(f: &Filter, ev: &StoredEvent) -> bool {
+    // A membership notice's `#t` is its channel type, matched by the notice
+    // rule above instead of the plain tag match below.
+    let notice = is_membership_notice(&ev.event);
+    if notice && !notice_visible(notice_channel_types(f).as_deref(), &ev.event) {
+        return false;
+    }
+
     if let Some(kinds) = &f.kinds {
         if !kinds.contains(&ev.event.kind) {
             return false;
@@ -67,6 +137,9 @@ fn filter_match_one(f: &Filter, ev: &StoredEvent) -> bool {
 
     for (tag_key, tag_values) in f.generic_tags.iter() {
         let tag_key_str = tag_key.to_string();
+        if notice && tag_key_str == NOTICE_CHANNEL_TYPE_TAG {
+            continue;
+        }
         let has_match = tag_values.iter().any(|filter_val| {
             ev.event
                 .tags
@@ -119,6 +192,88 @@ mod tests {
         StoredEvent::with_received_at(event, Utc::now(), None, true)
     }
 
+    #[test]
+    fn a_notice_matches_only_filters_that_know_its_channel_type() {
+        let relay = Keys::generate();
+        let member = Keys::generate().public_key();
+        let notice = |kind: u32, channel_type: Option<&str>| {
+            let mut tags = vec![
+                Tag::parse(["p", &member.to_hex()]).unwrap(),
+                Tag::parse(["h", "c"]).unwrap(),
+            ];
+            if let Some(channel_type) = channel_type {
+                tags.push(Tag::parse([NOTICE_CHANNEL_TYPE_TAG, channel_type]).unwrap());
+            }
+            let event = EventBuilder::new(Kind::Custom(kind as u16), "")
+                .tags(tags)
+                .sign_with_keys(&relay)
+                .expect("sign");
+            StoredEvent::with_received_at(event, Utc::now(), None, true)
+        };
+        let filter = |json: serde_json::Value| -> Filter { serde_json::from_value(json).unwrap() };
+        let p = member.to_hex();
+        let all = ["stream", "forum", "dm", "workflow", "system"];
+        // (filter, sees untagged, stream, system, a type added later)
+        let cases = [
+            (
+                serde_json::json!({"kinds": [44100, 44101], "#p": [p]}),
+                [true, true, false, false],
+            ),
+            (serde_json::json!({"#p": [p]}), [true, true, false, false]),
+            (serde_json::json!({}), [true, true, false, false]),
+            (
+                serde_json::json!({"#t": ["other"]}),
+                [false, false, false, false],
+            ),
+            (
+                serde_json::json!({"kinds": [44100, 44101], "#p": [p], "#t": all}),
+                [true, true, true, false],
+            ),
+            (
+                serde_json::json!({"#t": ["system"]}),
+                [false, false, true, false],
+            ),
+            (
+                serde_json::json!({"#t": ["dm"]}),
+                [true, false, false, false],
+            ),
+            (
+                serde_json::json!({"#t": ["future"]}),
+                [false, false, false, true],
+            ),
+        ];
+        for kind in MEMBERSHIP_NOTICE_KINDS {
+            let notices = [
+                notice(kind, None),
+                notice(kind, Some("stream")),
+                notice(kind, Some("system")),
+                notice(kind, Some("future")),
+            ];
+            for (json, expected) in &cases {
+                let f = filter(json.clone());
+                for (ev, expected) in notices.iter().zip(expected) {
+                    assert_eq!(
+                        filters_match(std::slice::from_ref(&f), ev),
+                        *expected,
+                        "kind {kind}, filter {json}, notice {:?}",
+                        ev.event.tags
+                    );
+                }
+            }
+        }
+        // Other kinds keep the plain `#t` match.
+        let other = notice(44200, Some("system"));
+        assert!(filters_match(&[filter(serde_json::json!({}))], &other));
+        assert!(filters_match(
+            &[filter(serde_json::json!({"#t": ["system"]}))],
+            &other
+        ));
+        assert!(!filters_match(
+            &[filter(serde_json::json!({"#t": ["stream"]}))],
+            &other
+        ));
+    }
+
     #[test]
     fn kind_author_since_until_tag_matching() {
         let keys = Keys::generate();
diff --git a/crates/buzz-core/src/kind.rs b/crates/buzz-core/src/kind.rs
index e645dea011..e9e2dfa5e7 100644
--- a/crates/buzz-core/src/kind.rs
+++ b/crates/buzz-core/src/kind.rs
@@ -169,9 +169,20 @@ pub fn k_tag_kinds(event: &nostr::Event) -> impl Iterator<Item = u32> + '_ {
 /// `#p` tag to receive the event. This closes the kindless `{ids:[…]}` read
 /// path for events whose existence must not be leaked.
 ///
-/// Used by `filter_can_match_result_gated_kinds` to force the per-event
-/// fallback path in COUNT rather than the fast SQL `count_events()`.
-pub const RESULT_GATED_KINDS: &[u32] = &[KIND_DM_VISIBILITY, KIND_AGENT_TURN_METRIC];
+/// Membership notices (44100/44101) are here because the relay signs them, so
+/// their id is not author-bound, and they name the target, the channel and
+/// the actor. A system channel's notice must not reach anyone but its target.
+///
+/// This is the one list every delivery surface reads: the filter-level `ids`
+/// exemption, `reader_authorized_for_event` (WS/HTTP history, push), live
+/// fan-out (same pod and Redis), and the COUNT fallback
+/// (`filter_can_match_result_gated_kinds`).
+pub const RESULT_GATED_KINDS: &[u32] = &[
+    KIND_DM_VISIBILITY,
+    KIND_AGENT_TURN_METRIC,
+    KIND_MEMBER_ADDED_NOTIFICATION,
+    KIND_MEMBER_REMOVED_NOTIFICATION,
+];
 
 /// Kinds whose stored events have `#p`-bound read access — readable only by
 /// subscribers whose pubkey appears in the event's `#p` tag.
diff --git a/crates/buzz-db/src/store/channel_members.rs b/crates/buzz-db/src/store/channel_members.rs
index 4855d32ccc..9e7679e0c3 100644
--- a/crates/buzz-db/src/store/channel_members.rs
+++ b/crates/buzz-db/src/store/channel_members.rs
@@ -1288,8 +1288,29 @@ pub async fn get_readable_system_channel_ids(
         .collect()
 }
 
+/// The type of channel `channel_id`, deleted or not, or `None` when no such
+/// channel exists. Membership notices carry it as their `t` tag (NIP-CL).
+pub async fn channel_type_of(
+    pool: &PgPool,
+    community_id: CommunityId,
+    channel_id: Uuid,
+) -> Result<Option<String>> {
+    let mut connection = crate::observability::acquire_writer(
+        pool,
+        crate::observability::WriterOperation::Authorization,
+    )
+    .await?;
+    Ok(sqlx::query_scalar(
+        "SELECT channel_type::text FROM channels WHERE community_id = $1 AND id = $2",
+    )
+    .bind(community_id.as_uuid())
+    .bind(channel_id)
+    .fetch_optional(&mut *connection)
+    .await?)
+}
+
 /// The IDs in `channel_ids` that name system channels, deleted or not.
-/// Push matching and membership notifications use it to skip them.
+/// Push matching uses it to skip them.
 pub async fn system_channel_ids_among(
     pool: &PgPool,
     community_id: CommunityId,
@@ -1954,6 +1975,17 @@ impl Db {
         get_readable_system_channel_ids(&self.pool, community_id, pubkey).await
     }
 
+    /// The type of channel `channel_id`, deleted or not, or `None` when no
+    /// such channel exists.
+    #[datastore_span(name = "channel_type_of", system = "postgresql")]
+    pub async fn channel_type_of(
+        &self,
+        community_id: CommunityId,
+        channel_id: Uuid,
+    ) -> Result<Option<String>> {
+        channel_type_of(&self.pool, community_id, channel_id).await
+    }
+
     /// The IDs in `channel_ids` that name system channels, deleted or not.
     #[datastore_span(name = "system_channel_ids_among", system = "postgresql")]
     pub async fn system_channel_ids_among(
diff --git a/crates/buzz-db/src/store/event.rs b/crates/buzz-db/src/store/event.rs
index 209f09e573..da685f6fe6 100644
--- a/crates/buzz-db/src/store/event.rs
+++ b/crates/buzz-db/src/store/event.rs
@@ -125,6 +125,12 @@ pub struct EventQuery {
     /// containment alone would also admit decoys like `["x","shared","true"]`.
     /// `event_visible_to_reader` remains the post-filter.
     pub shared_gated_reader: Option<Vec<u8>>,
+    /// The channel types whose membership notices (44100/44101) the query may
+    /// return: the filter's `#t` values
+    /// ([`buzz_core::filter::notice_channel_types`]). `None` means the legacy
+    /// types only, so a read path that does not set it never returns a notice
+    /// about a type added later, such as a system channel (NIP-CL).
+    pub notice_channel_types: Option<Vec<String>>,
 }
 
 impl EventQuery {
@@ -158,6 +164,7 @@ impl EventQuery {
             channel_ids_include_global: true,
             max_limit: None,
             shared_gated_reader: None,
+            notice_channel_types: None,
         }
     }
 }
@@ -655,6 +662,7 @@ fn build_query_events_sql(q: &EventQuery) -> QueryBuilder<sqlx::Postgres> {
         let table = if q.p_tag_hex.is_some() { "e" } else { "events" };
         qb.push(format!(" AND NOT ({table}.kind = 45010 AND NOT EXISTS (SELECT 1 FROM artifact_heads ah WHERE ah.community_id={table}.community_id AND ah.event_id={table}.id))"));
     }
+    push_notice_visibility(&mut qb, col_prefix, q);
 
     if let Some(ch) = q.channel_id {
         qb.push(format!(" AND {col_prefix}channel_id = "))
@@ -912,6 +920,55 @@ fn push_tag_value_filters(
     }
 }
 
+/// Return only membership notices whose channel type the query may see
+/// (NIP-CL), as [`buzz_core::filter::notice_visible`] does in `filters_match`:
+/// `AND (kind NOT IN (44100, 44101) OR <type tag in visible types>
+/// [OR <no type tag>])`. An untagged notice is a legacy type, so it is kept
+/// only when a legacy type is visible. Pushed before `LIMIT` so hidden rows
+/// cannot take page slots. Skipped when the query's kinds cannot match a
+/// notice.
+fn push_notice_visibility(qb: &mut QueryBuilder<sqlx::Postgres>, col_prefix: &str, q: &EventQuery) {
+    use buzz_core::filter::{
+        LEGACY_NOTICE_CHANNEL_TYPES, MEMBERSHIP_NOTICE_KINDS, NOTICE_CHANNEL_TYPE_TAG,
+    };
+    if let Some(kinds) = q.kinds.as_deref() {
+        if !kinds
+            .iter()
+            .any(|kind| MEMBERSHIP_NOTICE_KINDS.contains(&(*kind as u32)))
+        {
+            return;
+        }
+    }
+    let visible: Vec<String> = match &q.notice_channel_types {
+        Some(types) => types.clone(),
+        None => LEGACY_NOTICE_CHANNEL_TYPES
+            .iter()
+            .map(|t| (*t).to_owned())
+            .collect(),
+    };
+    let untagged_visible = visible
+        .iter()
+        .any(|t| LEGACY_NOTICE_CHANNEL_TYPES.contains(&t.as_str()));
+    let [added, removed] = MEMBERSHIP_NOTICE_KINDS;
+    qb.push(format!(
+        " AND ({col_prefix}kind NOT IN ({added}, {removed}) OR "
+    ));
+    if visible.is_empty() {
+        qb.push("FALSE");
+    } else {
+        push_exact_tag_match(qb, col_prefix, NOTICE_CHANNEL_TYPE_TAG, &visible);
+    }
+    if untagged_visible {
+        qb.push(format!(
+            " OR NOT EXISTS (SELECT 1 FROM jsonb_array_elements({col_prefix}tags) AS tag \
+             WHERE tag->>0 = "
+        ))
+        .push_bind(NOTICE_CHANNEL_TYPE_TAG.to_owned())
+        .push(")");
+    }
+    qb.push(")");
+}
+
 /// Match `#d` on artifact rows before `LIMIT` while leaving other kinds to the
 /// caller's post-filter: `(kind NOT IN (artifact kinds) OR <exact d match>)`.
 fn push_artifact_d_tag_predicate(
@@ -1030,6 +1087,7 @@ pub(crate) async fn count_events_on(conn: &mut sqlx::PgConnection, q: &EventQuer
         let table = if q.p_tag_hex.is_some() { "e" } else { "events" };
         qb.push(format!(" AND NOT ({table}.kind = 45010 AND NOT EXISTS (SELECT 1 FROM artifact_heads ah WHERE ah.community_id={table}.community_id AND ah.event_id={table}.id))"));
     }
+    push_notice_visibility(&mut qb, col_prefix, q);
 
     if let Some(ch) = q.channel_id {
         qb.push(format!(" AND {col_prefix}channel_id = "))
diff --git a/crates/buzz-relay/src/handlers/count.rs b/crates/buzz-relay/src/handlers/count.rs
index 733449d925..6f97271cf4 100644
--- a/crates/buzz-relay/src/handlers/count.rs
+++ b/crates/buzz-relay/src/handlers/count.rs
@@ -154,7 +154,7 @@ pub async fn handle_count(
         // shared-tag check. A fast count over those kinds would include foreign
         // unshared events, leaking the existence of private agent activity.
         let needs_shared_gate_filtering = filter_can_match_shared_gated_kinds(filter);
-        // Determine if this filter can match result-gated kinds (44200, 30622)
+        // Determine if this filter can match result-gated kinds (`RESULT_GATED_KINDS`)
         // that require a per-event owner check. When the fast SQL path would
         // count matching rows without calling reader_authorized_for_event, a
         // non-owner learns the existence of events they are not allowed to see.
diff --git a/crates/buzz-relay/src/handlers/event.rs b/crates/buzz-relay/src/handlers/event.rs
index f57c10b150..3222f896b4 100644
--- a/crates/buzz-relay/src/handlers/event.rs
+++ b/crates/buzz-relay/src/handlers/event.rs
@@ -174,14 +174,13 @@ pub async fn filter_fanout_by_access(
         matches
     };
 
-    // Owner-only kinds (kind:30622 DM visibility, kind:44200 agent turn
-    // metrics) reach only the pubkey named in their `p` tag. Same predicate as
-    // the pull paths, applied here so local and Redis delivery share it — a
-    // kindless `ids:[…]` subscription can otherwise match these events.
+    // Owner-only kinds (`RESULT_GATED_KINDS`: DM visibility, agent turn
+    // metrics, membership notices) reach only the pubkey named in their `p`
+    // tag. Same predicate as the pull paths, applied here so local and Redis
+    // delivery share it — a kindless `ids:[…]` subscription can otherwise
+    // match these events.
     let kind = event_kind_u32(&stored_event.event);
-    let matches = if kind == buzz_core::kind::KIND_DM_VISIBILITY
-        || kind == buzz_core::kind::KIND_AGENT_TURN_METRIC
-    {
+    let matches = if buzz_core::kind::RESULT_GATED_KINDS.contains(&kind) {
         matches
             .into_iter()
             .filter(|(conn_id, _)| {
diff --git a/crates/buzz-relay/src/handlers/req.rs b/crates/buzz-relay/src/handlers/req.rs
index 3180f227e3..9c6b5d70a6 100644
--- a/crates/buzz-relay/src/handlers/req.rs
+++ b/crates/buzz-relay/src/handlers/req.rs
@@ -7,9 +7,8 @@ use tracing::{debug, warn};
 
 use buzz_core::filter::filters_match;
 use buzz_core::kind::{
-    is_unshared_gated_event, AUTHOR_ONLY_KINDS, KIND_AGENT_ENGRAM, KIND_AGENT_TURN_METRIC,
-    KIND_DELETION, KIND_DM_VISIBILITY, KIND_HUDDLE_LIVENESS, P_GATED_KINDS, RESULT_GATED_KINDS,
-    SHARED_GATED_KINDS,
+    is_unshared_gated_event, AUTHOR_ONLY_KINDS, KIND_AGENT_ENGRAM, KIND_DELETION,
+    KIND_HUDDLE_LIVENESS, P_GATED_KINDS, RESULT_GATED_KINDS, SHARED_GATED_KINDS,
 };
 use buzz_core::tenant::TenantContext;
 use buzz_db::EventQuery;
@@ -1254,8 +1253,12 @@ fn filter_to_query_params(
         .map(|values| values.iter().map(|v| v.to_string()).collect());
 
     let tag_values = group_state_tag_values(filter);
+    // NIP-CL: a membership notice's `#t` is its channel type. SQL keeps only
+    // the types this filter may see; a filter without `#t` sees legacy types.
+    let notice_channel_types = buzz_core::filter::notice_channel_types(filter);
 
     EventQuery {
+        notice_channel_types,
         channel_id,
         kinds,
         pubkey,
@@ -1656,13 +1659,14 @@ pub(crate) fn p_gated_filters_authorized(filters: &[Filter], authed_pubkey_hex:
         // when `ids` is present. KIND_AGENT_TURN_METRIC events are long-lived
         // and their cleartext envelope (pubkey, agent tag, created_at) leaks
         // turn-activity metadata — knowing an event id is NOT authorization
-        // (NIP-AM §Relay Behavior). Only filters that explicitly name the kind
-        // lose the exemption — a kindless `ids` lookup is unaffected.
+        // (NIP-AM §Relay Behavior). Membership notices are relay-signed and
+        // name the target and channel. All of these are RESULT_GATED_KINDS.
+        // Only filters that explicitly name the kind lose the exemption — a
+        // kindless `ids` lookup is admitted and then gated per result by
+        // `reader_authorized_for_event`.
         let explicitly_no_ids_exemption = filter.kinds.as_ref().is_some_and(|ks| {
-            ks.iter().any(|kind| {
-                let k = kind.as_u16() as u32;
-                k == KIND_DM_VISIBILITY || k == KIND_AGENT_TURN_METRIC
-            })
+            ks.iter()
+                .any(|kind| RESULT_GATED_KINDS.contains(&(kind.as_u16() as u32)))
         });
         if !explicitly_no_ids_exemption && filter.ids.as_ref().is_some_and(|ids| !ids.is_empty()) {
             return true;
@@ -1761,8 +1765,7 @@ pub(crate) fn filter_can_match_shared_gated_kinds(filter: &Filter) -> bool {
 
 /// Returns `true` if the filter CAN match result-gated kinds — meaning it
 /// either has no `kinds` constraint (wildcard) or includes at least one kind
-/// that carries a per-event result-level read gate (currently
-/// `KIND_DM_VISIBILITY` and `KIND_AGENT_TURN_METRIC`).
+/// that carries a per-event result-level read gate (`RESULT_GATED_KINDS`).
 ///
 /// Used by the COUNT handler to force the per-event fallback path instead of
 /// the fast SQL `count_events()`, which cannot enforce the owner-only result
@@ -2952,13 +2955,22 @@ mod tests {
         let owner = Filter::new().kind(dm_vis).custom_tags(p_tag, [authed]);
         assert!(p_gated_filters_authorized(&[owner], authed));
 
-        // The ids exemption still applies to other p-gated kinds (member notifs).
-        let member_notif_ids = Filter::new()
-            .kind(nostr::Kind::Custom(
-                buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION as u16,
-            ))
-            .id(nostr::EventId::from_hex(snapshot_id).unwrap());
-        assert!(p_gated_filters_authorized(&[member_notif_ids], authed));
+        // Membership notices are relay-signed too: knowing one's id is not
+        // authorization (a system channel's notice names a hidden channel).
+        for kind in [
+            buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION,
+            buzz_core::kind::KIND_MEMBER_REMOVED_NOTIFICATION,
+        ] {
+            let ids_only = Filter::new()
+                .kind(nostr::Kind::Custom(kind as u16))
+                .id(nostr::EventId::from_hex(snapshot_id).unwrap());
+            assert!(!p_gated_filters_authorized(&[ids_only], authed));
+            let own = Filter::new()
+                .kind(nostr::Kind::Custom(kind as u16))
+                .id(nostr::EventId::from_hex(snapshot_id).unwrap())
+                .custom_tags(p_tag, [authed]);
+            assert!(p_gated_filters_authorized(&[own], authed));
+        }
     }
 
     /// NIP-AM: kind 44200 must deny `{kinds:[44200], ids:[...]}` by non-owner.
diff --git a/crates/buzz-relay/src/handlers/side_effects.rs b/crates/buzz-relay/src/handlers/side_effects.rs
index 38d035910b..f5b55410d3 100644
--- a/crates/buzz-relay/src/handlers/side_effects.rs
+++ b/crates/buzz-relay/src/handlers/side_effects.rs
@@ -1059,8 +1059,12 @@ pub fn emit_live_thread_summary(
 
 /// Emit a relay-signed membership notification event stored globally (channel_id = None).
 ///
-/// kind:44100 = member added, kind:44101 = member removed. System channels
-/// emit none.
+/// kind:44100 = member added, kind:44101 = member removed. Every notice
+/// carries its channel's type as `["t", <channel_type>]` (NIP-CL). This is
+/// the only place that reads the channel type for notices. Every read and live
+/// path shows a notice only to a filter that knows its type
+/// (`buzz_core::filter::notice_visible`), so a client never sees a notice
+/// about a type it does not know, such as a system channel.
 /// The p tag addresses the target pubkey; the h tag carries the channel UUID as metadata.
 /// Stored with channel_id = None so global subscribers receive it via slow-path fan-out.
 pub async fn emit_membership_notification(
@@ -1071,16 +1075,16 @@ pub async fn emit_membership_notification(
     actor_pubkey: &[u8],
     notification_kind: u32,
 ) -> anyhow::Result<()> {
-    // A system channel is left out of clients' channel lists, so it sends no
-    // membership notifications: a client that receives one would show it.
-    if !state
+    // No channel row means no type to tag. Send nothing rather than an
+    // untagged notice, which every client would treat as a legacy type.
+    let Some(channel_type) = state
         .db
-        .system_channel_ids_among(tenant.community(), &[channel_id])
+        .channel_type_of(tenant.community(), channel_id)
         .await?
-        .is_empty()
-    {
+    else {
+        warn!(%channel_id, "membership notice skipped: channel not found");
         return Ok(());
-    }
+    };
     let target_hex = hex::encode(target_pubkey);
     let actor_hex = hex::encode(actor_pubkey);
     let channel_id_str = channel_id.to_string();
@@ -1107,8 +1111,10 @@ pub async fn emit_membership_notification(
     })
     .to_string();
 
+    let type_tag = Tag::parse([buzz_core::filter::NOTICE_CHANNEL_TYPE_TAG, &channel_type])
+        .map_err(|e| anyhow::anyhow!("failed to build channel type tag: {e}"))?;
     let event = EventBuilder::new(Kind::Custom(notification_kind as u16), content)
-        .tags([p_tag, h_tag])
+        .tags([p_tag, h_tag, type_tag])
         .sign_with_keys(&state.relay_keypair)
         .map_err(|e| anyhow::anyhow!("failed to sign membership notification: {e}"))?;
 
diff --git a/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs b/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
index d99ddb748e..a74644e21e 100644
--- a/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
+++ b/crates/buzz-relay/src/handlers/system_channel_postgres_tests.rs
@@ -175,7 +175,7 @@ fn bridge_count(body: Option<Value>) -> u64 {
     })
 }
 
-fn sorted(mut ids: Vec<String>) -> Vec<String> {
+fn sorted<T: Ord>(mut ids: Vec<T>) -> Vec<T> {
     ids.sort();
     ids
 }
@@ -428,17 +428,77 @@ async fn named_channels_missing_from_the_cache_are_confirmed_together() {
     assert!(readable_system.is_empty());
 }
 
-/// Adding a member to a system channel sends no kind:44100 notification,
-/// which an existing client would show as a new channel. An ordinary
-/// channel still sends one, so the check is not vacuous.
-/// Mutation: drop the system check in `emit_membership_notification` → RED.
+/// Every membership notice is a stored kind:44100/44101 tagged with its
+/// channel type (`["t","stream"]`, `["t","system"]`). A filter sees a notice
+/// only when it knows the type: a filter without `#t` (every client today)
+/// sees the legacy types, and a filter with `#t` sees the types it names. One
+/// filter can name all types. This holds on every path: live fan-out, REQ
+/// history, COUNT, and the HTTP bridge. An untagged notice stored before the
+/// tag existed counts as a legacy type.
+/// Mutation: drop the type tag in `emit_membership_notification` → RED;
+/// drop the `notice_visible` check in `filters_match` → RED (live and
+/// post-filtered reads show the system notice); drop the untagged clause in
+/// `push_notice_visibility` → RED (the legacy notice disappears).
 #[tokio::test]
 #[ignore = "requires Postgres and Redis"]
-async fn system_channels_send_no_membership_notifications() {
+async fn membership_notices_reach_only_filters_that_know_their_type() {
+    use buzz_core::kind::{KIND_MEMBER_ADDED_NOTIFICATION, KIND_MEMBER_REMOVED_NOTIFICATION};
     let f = fixture().await;
     let owner = Keys::generate();
     let member = Keys::generate();
     let member_hex = member.public_key().to_hex();
+    let kinds = [
+        KIND_MEMBER_ADDED_NOTIFICATION,
+        KIND_MEMBER_REMOVED_NOTIFICATION,
+    ];
+    let old = json!({"kinds": kinds, "#p": [member_hex]});
+    let asks = json!({"kinds": kinds, "#p": [member_hex], "#t": ["system"]});
+    let all = json!({
+        "kinds": kinds,
+        "#p": [member_hex],
+        "#t": ["stream", "forum", "dm", "workflow", "system"],
+    });
+
+    // The member's live global subscriptions: one as clients send today, one
+    // that asks for system notices, and one that names every type. An outsider also holds a subscription
+    // that asks. It is registered directly, as if some filter (for example a
+    // kindless `ids` lookup) had been admitted, so only the fan-out gate can
+    // keep the notices from it.
+    let register = |reader: &Keys, subs: &[(&str, &Value)]| {
+        let conn_id = Uuid::new_v4();
+        let (tx, rx) = tokio::sync::mpsc::channel(32);
+        f.state.conn_manager.register(
+            conn_id,
+            tx,
+            tokio::sync::mpsc::channel(4).0,
+            tokio::sync::mpsc::channel(1).0,
+            None,
+            tokio_util::sync::CancellationToken::new(),
+            f.tenant.community(),
+            Arc::new(std::sync::atomic::AtomicU8::new(0)),
+            Arc::new(tokio::sync::Mutex::new(Default::default())),
+            3,
+            crate::state::CommunityConnectionControl::new(
+                tokio_util::sync::CancellationToken::new(),
+            ),
+        );
+        f.state
+            .conn_manager
+            .set_authenticated_pubkey(conn_id, reader.public_key().to_bytes().to_vec());
+        for (sub, filter) in subs {
+            f.state.sub_registry.register_scoped(
+                f.tenant.community(),
+                conn_id,
+                (*sub).into(),
+                vec![serde_json::from_value((*filter).clone()).expect("filter")],
+                None,
+            );
+        }
+        rx
+    };
+    let mut rx = register(&member, &[("old", &old), ("asks", &asks), ("all", &all)]);
+    let outsider = Keys::generate();
+    let mut outsider_rx = register(&outsider, &[("outsider", &json!({"#t": ["system"]}))]);
 
     let system = create_channel(&f.state, &f.tenant, &owner, &[&["channel_type", "system"]]).await;
     let ordinary = create_channel(&f.state, &f.tenant, &owner, &[]).await;
@@ -452,36 +512,309 @@ async fn system_channels_send_no_membership_notifications() {
         )
         .await;
     }
-    // Notifications are written after the reply; give the task a moment.
-    let mut notified = Vec::new();
-    for _ in 0..50 {
-        notified = f
-            .state
-            .db
-            .query_events(&EventQuery {
-                kinds: Some(vec![buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION as i32]),
-                p_tag_hex: Some(member_hex.clone()),
-                ..EventQuery::for_community(f.tenant.community())
-            })
+    publish(
+        &f,
+        &owner,
+        9001,
+        "",
+        &[&["h", &system.to_string()], &["p", &member_hex]],
+    )
+    .await;
+
+    // Notifications are sent after the reply; collect the six frames.
+    let mut live = Vec::new();
+    let mut ids = std::collections::HashMap::new();
+    while live.len() < 6 {
+        let frame = tokio::time::timeout(std::time::Duration::from_secs(5), rx.recv())
             .await
-            .expect("query notifications")
-            .into_iter()
-            .map(|stored| {
-                stored
-                    .event
-                    .tags
-                    .iter()
-                    .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
-                    .and_then(|tag| tag.as_slice().get(1).cloned())
-                    .expect("h tag")
-            })
-            .collect::<Vec<_>>();
-        if !notified.is_empty() {
+            .unwrap_or_else(|_| panic!("notices so far: {live:?}"))
+            .expect("connection open");
+        let axum::extract::ws::Message::Text(text) = frame else {
+            continue;
+        };
+        let message: Value = serde_json::from_str(&text).expect("relay frame");
+        if message[0] != "EVENT" {
+            continue;
+        }
+        let event: nostr::Event = serde_json::from_value(message[2].clone()).expect("event");
+        assert_eq!(
+            event.pubkey,
+            f.state.relay_keypair.public_key(),
+            "relay-signed"
+        );
+        let h = event
+            .tags
+            .iter()
+            .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
+            .and_then(|tag| tag.as_slice().get(1).cloned())
+            .expect("h tag");
+        let channel_type = event
+            .tags
+            .iter()
+            .find(|tag| tag.as_slice().first().map(String::as_str) == Some("t"))
+            .and_then(|tag| tag.as_slice().get(1).cloned());
+        let expected_type = if h == system.to_string() {
+            "system"
+        } else {
+            "stream"
+        };
+        assert_eq!(channel_type.as_deref(), Some(expected_type), "type tag");
+        let kind = u32::from(event.kind.as_u16());
+        ids.insert((kind, h.clone()), event.id.to_hex());
+        live.push((message[1].as_str().expect("sub id").to_owned(), kind, h));
+    }
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(200), rx.recv())
+            .await
+            .is_err(),
+        "no seventh notice"
+    );
+    assert_eq!(
+        sorted(live),
+        sorted(vec![
+            (
+                "asks".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "asks".into(),
+                KIND_MEMBER_REMOVED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "old".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                ordinary.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_REMOVED_NOTIFICATION,
+                system.to_string()
+            ),
+            (
+                "all".into(),
+                KIND_MEMBER_ADDED_NOTIFICATION,
+                ordinary.to_string()
+            ),
+        ])
+    );
+    let ordinary_added = ids[&(KIND_MEMBER_ADDED_NOTIFICATION, ordinary.to_string())].clone();
+    let system_notices = sorted(vec![
+        ids[&(KIND_MEMBER_ADDED_NOTIFICATION, system.to_string())].clone(),
+        ids[&(KIND_MEMBER_REMOVED_NOTIFICATION, system.to_string())].clone(),
+    ]);
+
+    // History: the system notices are stored, and only the asking filter
+    // reads them.
+    assert_eq!(
+        req(&f, &member, old.clone()).await,
+        std::slice::from_ref(&ordinary_added)
+    );
+    assert_eq!(count(&f, &member, old.clone()).await, 1);
+    assert_eq!(
+        bridge_ids(bridge(&f, &member, "/query", json!([old])).await),
+        std::slice::from_ref(&ordinary_added)
+    );
+    assert_eq!(
+        bridge_count(bridge(&f, &member, "/count", json!([old])).await),
+        1
+    );
+    assert_eq!(sorted(req(&f, &member, asks.clone()).await), system_notices);
+    assert_eq!(count(&f, &member, asks.clone()).await, 2);
+    assert_eq!(
+        sorted(bridge_ids(
+            bridge(&f, &member, "/query", json!([asks])).await
+        )),
+        system_notices
+    );
+    // Replay with `since` works for the asking filter.
+    let mut since = asks.clone();
+    since["since"] = json!(0);
+    assert_eq!(sorted(req(&f, &member, since).await), system_notices);
+    // One filter that names every type reads all three notices.
+    let every_notice = {
+        let mut ids = system_notices.clone();
+        ids.push(ordinary_added.clone());
+        sorted(ids)
+    };
+    assert_eq!(sorted(req(&f, &member, all.clone()).await), every_notice);
+    assert_eq!(count(&f, &member, all.clone()).await, 3);
+    assert_eq!(
+        sorted(bridge_ids(
+            bridge(&f, &member, "/query", json!([all])).await
+        )),
+        every_notice
+    );
+
+    // A notice stored before notices had a type tag counts as a legacy type:
+    // filters without `#t`, and filters that name a legacy type, read it.
+    let legacy_channel = Uuid::new_v4().to_string();
+    let legacy = nostr::EventBuilder::new(
+        nostr::Kind::Custom(KIND_MEMBER_ADDED_NOTIFICATION as u16),
+        "",
+    )
+    .tags([
+        nostr::Tag::parse(["p", &member_hex]).unwrap(),
+        nostr::Tag::parse(["h", &legacy_channel]).unwrap(),
+    ])
+    .sign_with_keys(&f.state.relay_keypair)
+    .expect("sign");
+    f.state
+        .db
+        .insert_event(f.tenant.community(), &legacy, None)
+        .await
+        .expect("store legacy notice");
+    let legacy_id = legacy.id.to_hex();
+    let with_legacy = |ids: &[String]| {
+        let mut ids = ids.to_vec();
+        ids.push(legacy_id.clone());
+        sorted(ids)
+    };
+    assert_eq!(
+        sorted(req(&f, &member, old.clone()).await),
+        with_legacy(std::slice::from_ref(&ordinary_added))
+    );
+    assert_eq!(count(&f, &member, old.clone()).await, 2);
+    assert_eq!(
+        sorted(req(&f, &member, all.clone()).await),
+        with_legacy(&every_notice)
+    );
+    assert_eq!(count(&f, &member, all.clone()).await, 4);
+    assert_eq!(sorted(req(&f, &member, asks.clone()).await), system_notices);
+
+    // Knowing a notice's id is not authorization: only its target reads,
+    // counts or receives it, with or without `kinds`.
+    // Mutation: drop 44100/44101 from RESULT_GATED_KINDS → RED.
+    assert!(
+        outsider_rx.try_recv().is_err(),
+        "live fan-out reached a non-target"
+    );
+    let by_id = |with_kinds: bool| {
+        let mut filter = json!({"ids": system_notices, "#t": ["system"]});
+        if with_kinds {
+            filter["kinds"] = json!(kinds);
+        }
+        filter
+    };
+    for with_kinds in [true, false] {
+        let filter = by_id(with_kinds);
+        assert!(
+            req(&f, &outsider, filter.clone()).await.is_empty(),
+            "{filter}"
+        );
+        assert_eq!(count(&f, &outsider, filter.clone()).await, 0, "{filter}");
+        assert!(
+            bridge_ids(bridge(&f, &outsider, "/query", json!([filter])).await).is_empty(),
+            "{filter}"
+        );
+        assert_eq!(
+            bridge_count(bridge(&f, &outsider, "/count", json!([filter])).await),
+            0,
+            "{filter}"
+        );
+    }
+    // The target's own kindless id lookup still works.
+    assert_eq!(sorted(req(&f, &member, by_id(false)).await), system_notices);
+}
+
+/// The database returns only legacy-type notices unless the query names
+/// other types, so a read path that builds its own `EventQuery` and forgets
+/// the rule still hides system notices.
+/// Mutation: drop `push_notice_visibility` → RED.
+#[tokio::test]
+#[ignore = "requires Postgres and Redis"]
+async fn the_database_returns_only_legacy_type_notices_by_default() {
+    use buzz_core::kind::KIND_MEMBER_ADDED_NOTIFICATION;
+    let f = fixture().await;
+    let owner = Keys::generate();
+    let member = Keys::generate();
+    let member_hex = member.public_key().to_hex();
+    let system = create_channel(&f.state, &f.tenant, &owner, &[&["channel_type", "system"]]).await;
+    let ordinary = create_channel(&f.state, &f.tenant, &owner, &[]).await;
+    for channel in [system, ordinary] {
+        publish(
+            &f,
+            &owner,
+            9000,
+            "",
+            &[&["h", &channel.to_string()], &["p", &member_hex]],
+        )
+        .await;
+    }
+    // Kindless, but global only: the notices are the only global events
+    // that mention the member.
+    let base = EventQuery {
+        p_tag_hex: Some(member_hex.clone()),
+        global_only: true,
+        ..EventQuery::for_community(f.tenant.community())
+    };
+    let channels_of = |events: Vec<buzz_core::StoredEvent>| {
+        sorted(
+            events
+                .into_iter()
+                .map(|stored| {
+                    stored
+                        .event
+                        .tags
+                        .iter()
+                        .find(|tag| tag.as_slice().first().map(String::as_str) == Some("h"))
+                        .and_then(|tag| tag.as_slice().get(1).cloned())
+                        .expect("h tag")
+                })
+                .collect(),
+        )
+    };
+    // Notifications are written after the reply; wait for both.
+    let mut all = Vec::new();
+    for _ in 0..50 {
+        all = channels_of(
+            f.state
+                .db
+                .query_events(&EventQuery {
+                    notice_channel_types: Some(vec!["stream".into(), "system".into()]),
+                    ..base.clone()
+                })
+                .await
+                .expect("query"),
+        );
+        if all.len() == 2 {
             break;
         }
         tokio::time::sleep(std::time::Duration::from_millis(20)).await;
     }
-    assert_eq!(sorted(notified), vec![ordinary.to_string()]);
+    assert_eq!(all, sorted(vec![system.to_string(), ordinary.to_string()]));
+
+    for query in [
+        base.clone(),
+        EventQuery {
+            kinds: Some(vec![KIND_MEMBER_ADDED_NOTIFICATION as i32]),
+            ..base.clone()
+        },
+    ] {
+        assert_eq!(
+            channels_of(f.state.db.query_events(&query).await.expect("query")),
+            [ordinary.to_string()]
+        );
+        assert_eq!(f.state.db.count_events(&query).await.expect("count"), 1);
+    }
+    let only_system = EventQuery {
+        notice_channel_types: Some(vec!["system".into()]),
+        ..base.clone()
+    };
+    assert_eq!(
+        channels_of(f.state.db.query_events(&only_system).await.expect("query")),
+        [system.to_string()]
+    );
+    assert_eq!(
+        f.state.db.count_events(&only_system).await.expect("count"),
+        1
+    );
 }
 
 /// A group-state filter with `#t:["system"]` or any `#P` finds the system
diff --git a/docs/nips/NIP-CL.md b/docs/nips/NIP-CL.md
index 662e88fa94..b7c415a73d 100644
--- a/docs/nips/NIP-CL.md
+++ b/docs/nips/NIP-CL.md
@@ -186,9 +186,52 @@ a system channel stays an ordinary NIP-29 group.
 The relay decides this for each filter. A filter that names a system channel
 does not add it to another filter in the same request.
 
-The relay MUST NOT send push notifications or kind:44100/44101 membership
-notifications for system channels. A client that received one would show the
-channel.
+The relay MUST NOT send push notifications for system channels.
+
+### Membership notices carry the channel type
+
+Every kind:44100 (added) and kind:44101 (removed) notice has one more tag,
+`["t", <channel_type>]`, for example `["t", "stream"]` or `["t", "system"]`.
+The relay sets it from the channel type when it sends the notice. A channel's
+type does not change. The relay stores the notice like any other 44100/44101.
+
+A client sees a notice only if it knows the notice's channel type. Old
+clients do not know types added later, such as `system`, and would show the
+channel from such a notice. So the relay MUST apply this rule:
+
+- **A filter with `#t`** matches a notice only when the notice's type is one
+  of the `#t` values.
+- **A filter without `#t`** matches a notice only when its type is one of the
+  **legacy types**: `stream`, `forum`, `dm`, `workflow`. This list is fixed.
+  A type added later is never on it, so old clients never see its notices.
+- **A notice without a `t` tag** was stored before this rule. Every such
+  notice is about a legacy type, so the relay treats it as all of them: it
+  matches a filter without `#t`, and a filter whose `#t` has a legacy type.
+  On these two kinds, this replaces the plain NIP-01 `#t` match.
+
+The rule applies on every path: REQ history, live delivery, COUNT, and any
+relay-specific query API. Existing clients do not send `#t` on these kinds,
+so they see no change.
+
+A client that knows every current type sends one filter:
+
+```json
+{"kinds": [44100, 44101], "#p": ["<me>"], "#t": ["stream", "forum", "dm", "workflow", "system"]}
+```
+
+When Buzz adds a type, a client adds its value to `#t` when it supports that
+type.
+
+The `#p` rule for 44100/44101 still applies: it must be the reader's own
+pubkey. An `ids` filter does not lift it: the relay returns, counts or
+delivers a 44100/44101 only to the pubkey in its `p` tag, even to a reader
+who knows the event id.
+
+Because the notices are stored, a client that reconnects can set `since` to
+the newest notice it has seen. One subscription then returns the notices it
+missed and the new ones, so no change falls between a read and a
+subscription. A notice is a hint: the channel's group-state events decide
+membership.
 
 ### Asking for system channels