From eb7480ba992aef3a4cd7398658a50e2ffa35a79b Mon Sep 17 00:00:00 2001
From: Logan Johnson <loganj@squareup.com>
Date: Fri, 9 Oct 2026 18:14:17 -0400
Subject: [PATCH] feat(relay): channel labels as t tags on group-state events

A channel can carry up to 8 labels that group channels across channel
types. kind:9007 sets them with ["t", <label>] tags. On kind:9002 the t
tags replace the whole set, a lone ["t", ""] clears it, and an edit
without t tags leaves the set unchanged. Only an owner or admin may change
labels.

The relay refuses, before storage, a label that is not 1-64 characters
from a-z, 0-9, '.', ':' and '-', a label equal to a channel type name, an
empty label mixed with other labels, and more than 8 distinct labels.

Migration 0061 adds channels.labels (TEXT[], default empty, at most 8).
The relay publishes each label as a t tag after the channel type tag on
kinds 39000, 39001 and 39002, and buzz-admin reconcile does the same.
Clients read the first t value as the type; the CLI and buzz-acp parsers
used the last one and now use the first.

Signed-off-by: Logan Johnson <loganj@squareup.com>
Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz>
---
 NOSTR.md                                      |  17 +-
 crates/buzz-acp/src/relay.rs                  |  15 +-
 crates/buzz-admin/src/main.rs                 |   3 +
 crates/buzz-cli/src/commands/channels.rs      |  16 +-
 crates/buzz-core/src/channel.rs               | 168 ++++++++++++--
 crates/buzz-db/src/runtime/migration.rs       |   4 +-
 crates/buzz-db/src/runtime/tests.rs           |  33 ++-
 crates/buzz-db/src/store/channel.rs           | 100 +++++++-
 crates/buzz-db/src/store/channel_members.rs   |  16 +-
 crates/buzz-db/src/store/dm.rs                |   7 +-
 .../buzz-db/src/store/relay_admin_actions.rs  |   1 +
 crates/buzz-db/src/store/replaceable.rs       |   1 +
 crates/buzz-db/src/store/thread.rs            |   3 +
 crates/buzz-relay/src/api/bridge.rs           |   2 +
 .../handlers/group_state_postgres_tests.rs    | 215 ++++++++++++++++++
 crates/buzz-relay/src/handlers/ingest.rs      |   7 +-
 .../buzz-relay/src/handlers/side_effects.rs   |  77 ++++++-
 migrations/0061_channel_labels.sql            |  13 ++
 schema/tables/public/channels.sql             |   4 +
 19 files changed, 647 insertions(+), 55 deletions(-)
 create mode 100644 migrations/0061_channel_labels.sql

diff --git a/NOSTR.md b/NOSTR.md
index 042a6ce288..d3772a185c 100644
--- a/NOSTR.md
+++ b/NOSTR.md
@@ -50,10 +50,10 @@ PGPASSWORD=buzz_dev psql -h localhost -U buzz -d buzz -c \
 | **Reactions (kind:7)** | ✅ | Standard NIP-25; channel derived from target event's `#e` tag (client `#h` ignored) |
 | **Deletions (kind:5)** | ✅ | Standard NIP-09; self-authored only. `#h` optional, `#e` required |
 | **User profiles (kind:0)** | ✅ | NIP-01 metadata; synced to users table (display_name, avatar, about, NIP-05). NIP-05 handles must canonicalize to this relay's domain — off-domain or invalid handles are silently cleared. If a NIP-05 handle collides with another user's (UNIQUE constraint), the handle is skipped but other profile fields (display_name, avatar, about) are still synced. |
-| **Group creation (kind:9007)** | ✅ | NIP-29; include `name` tag, optional `visibility` and `channel_type` |
+| **Group creation (kind:9007)** | ✅ | NIP-29; include `name` tag, optional `visibility`, `channel_type` and label `t` tags |
 | **Add user (kind:9000)** | ✅ | Open: any user, subject to target's `channel_add_policy` (`owner_only`/`nobody` can block). Private: owner/admin only. Self-add bypasses agent policy but not private-channel auth. |
 | **Remove user (kind:9001)** | ✅ | Self-remove allowed (with last-owner guard). Removing others: owner/admin only. |
-| **Edit group metadata (kind:9002)** | ✅ | `name`/`about` tags: owner/admin. `topic`/`purpose` tags: any member. |
+| **Edit group metadata (kind:9002)** | ✅ | `name`/`about`/label `t` tags: owner/admin. `topic`/`purpose` tags: any member. |
 | **Admin delete event (kind:9005)** | ✅ | Event author can always delete own. Otherwise owner/admin required. Target must be in same channel. |
 | **Group deletion (kind:9008)** | ✅ | Owner only. |
 | **Leave group (kind:9022)** | ✅ | Any member. Last-owner guard prevents orphaned groups. |
@@ -112,7 +112,9 @@ All discovery events include a `d` tag set to the channel UUID (NIP-29 addressab
 | **39001** | `d=<uuid>`, `t=<channel_type>`, `P=<creator>`, `p` tags with role label (`owner`, `admin`) | Admin list |
 | **39002** | `d=<uuid>`, `t=<channel_type>`, `P=<creator>`, `p` tags for all members | Member list |
 
-On all three kinds the channel type `t` tag comes first, then `P`. `P` is
+On all three kinds the channel type `t` tag comes first, then one `t` tag
+per channel label, then `P`. Clients read the first `t` value as the
+channel type. `P` is
 the public key that signed the channel's kind:9007. The relay writes it
 from the database, and it does not change when ownership moves. Uppercase
 `P` follows NIP-22, NIP-34 and NIP-72, where it names the author of the root
@@ -123,6 +125,15 @@ kind:39000 also carries `["created_at", <unix seconds>]`: the time the
 channel was created. The event's own `created_at` is the time of the last
 edit, so use the tag to find the older of two channels.
 
+**Channel labels.** A label groups channels across channel types, for
+example `["t", "workspace"]`. Set labels with `["t", <label>]` tags on
+kind:9007. On kind:9002 the `t` tags replace the whole set, and a lone
+`["t", ""]` clears it; a kind:9002 without `t` tags leaves the labels as
+they are. Only an owner or admin may change labels. The relay refuses a
+label set with more than 8 labels, a label that is not 1-64 characters
+from `a-z`, `0-9`, `.`, `:` and `-`, or a label equal to a channel type
+name (`stream`, `forum`, `dm`, `workflow`, `system`).
+
 Events are stored **channel-scoped** so access control applies — private channel member lists are
 only visible to members. Discover groups via historical REQ:
 
diff --git a/crates/buzz-acp/src/relay.rs b/crates/buzz-acp/src/relay.rs
index e1046c4d4a..5587682d0b 100644
--- a/crates/buzz-acp/src/relay.rs
+++ b/crates/buzz-acp/src/relay.rs
@@ -149,7 +149,10 @@ pub(crate) fn channel_type_from_tags(tags: &[serde_json::Value]) -> String {
             match arr.first().and_then(|v| v.as_str()) {
                 Some("hidden") => is_hidden = true,
                 Some("private") => is_private = true,
-                Some("t") => declared_type = arr.get(1).and_then(|v| v.as_str()),
+                // The first `t` is the channel type; later `t` tags are labels.
+                Some("t") if declared_type.is_none() => {
+                    declared_type = arr.get(1).and_then(|v| v.as_str())
+                }
                 _ => {}
             }
         }
@@ -4189,6 +4192,16 @@ mod recovery_tests;
 mod tests {
     use super::*;
 
+    #[test]
+    fn channel_type_comes_from_the_first_t_tag_not_a_label() {
+        let tags = vec![
+            serde_json::json!(["d", "c"]),
+            serde_json::json!(["t", "dm"]),
+            serde_json::json!(["t", "workspace"]),
+        ];
+        assert_eq!(channel_type_from_tags(&tags), "dm");
+    }
+
     async fn nip11_test_client(
         responses: HashMap<String, (u16, String)>,
     ) -> (
diff --git a/crates/buzz-admin/src/main.rs b/crates/buzz-admin/src/main.rs
index da337acdc6..7b9a8f90ef 100644
--- a/crates/buzz-admin/src/main.rs
+++ b/crates/buzz-admin/src/main.rs
@@ -842,6 +842,7 @@ async fn reconcile_channels(
                 tags.push(Tag::parse(["closed"])?);
                 tags.extend(group_state_identity_tags(
                     &channel.channel_type,
+                    &channel.labels,
                     &channel.created_by,
                 )?);
                 tags.push(channel_created_at_tag(channel.created_at.timestamp())?);
@@ -859,6 +860,7 @@ async fn reconcile_channels(
                 let mut tags: Vec<Tag> = vec![Tag::parse(["d", &channel_id_str])?];
                 tags.extend(group_state_identity_tags(
                     &channel.channel_type,
+                    &channel.labels,
                     &channel.created_by,
                 )?);
                 for m in members
@@ -882,6 +884,7 @@ async fn reconcile_channels(
             let mut tags: Vec<Tag> = vec![Tag::parse(["d", &channel_id_str])?];
             tags.extend(group_state_identity_tags(
                 &channel.channel_type,
+                &channel.labels,
                 &channel.created_by,
             )?);
             for m in &members {
diff --git a/crates/buzz-cli/src/commands/channels.rs b/crates/buzz-cli/src/commands/channels.rs
index f956d0f7f9..31de6035e2 100644
--- a/crates/buzz-cli/src/commands/channels.rs
+++ b/crates/buzz-cli/src/commands/channels.rs
@@ -192,7 +192,8 @@ impl ChannelSummary {
             match key {
                 "d" => channel_id = val.map(str::to_string),
                 "name" => name = val.map(str::to_string),
-                "t" => channel_type = val.map(str::to_string),
+                // The first `t` is the channel type; later `t` tags are labels.
+                "t" if channel_type.is_none() => channel_type = val.map(str::to_string),
                 // NIP-29 emits both `private` and `public` (Buzz adds the latter).
                 // The presence of either tag is the source of truth; tag value is unused.
                 "private" => visibility = Some("private".to_string()),
@@ -2008,6 +2009,19 @@ mod tests {
         }
     }
 
+    #[test]
+    fn from_event_reads_the_type_from_the_first_t_tag() {
+        let ev = event(json!([
+            ["d", "11111111-1111-1111-1111-111111111111"],
+            ["name", "labeled"],
+            ["t", "forum"],
+            ["t", "workspace"],
+            ["P", "ab".repeat(32)],
+        ]));
+        let s = ChannelSummary::from_event(&ev).expect("parse");
+        assert_eq!(s.channel_type.as_deref(), Some("forum"));
+    }
+
     #[test]
     fn from_event_extracts_known_tags() {
         let ev = event(json!([
diff --git a/crates/buzz-core/src/channel.rs b/crates/buzz-core/src/channel.rs
index 055d32faaf..1a3f4e60aa 100644
--- a/crates/buzz-core/src/channel.rs
+++ b/crates/buzz-core/src/channel.rs
@@ -17,26 +17,108 @@ pub fn canonical_channel_name(name: &str) -> &str {
         .trim_end()
 }
 
+/// Maximum number of labels on one channel.
+pub const MAX_CHANNEL_LABELS: usize = 8;
+
+/// Maximum length of one channel label, in bytes.
+pub const MAX_CHANNEL_LABEL_LEN: usize = 64;
+
+/// Names a label may not take, because the channel type uses the same `t`
+/// tag. A label equal to one of these could make a channel look like
+/// another type. The list includes types that a later relay may add.
+pub const RESERVED_CHANNEL_LABELS: &[&str] = &["stream", "forum", "dm", "workflow", "system"];
+
+/// Why a set of channel labels was refused.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+pub enum ChannelLabelError {
+    /// More than [`MAX_CHANNEL_LABELS`] distinct labels.
+    #[error("too many labels: at most {MAX_CHANNEL_LABELS} are allowed")]
+    TooMany,
+    /// A label is not 1–64 characters from `a-z`, `0-9`, `.`, `:` and `-`.
+    #[error("invalid label {0:?}: use 1-{MAX_CHANNEL_LABEL_LEN} characters from a-z, 0-9, '.', ':' and '-'")]
+    Invalid(String),
+    /// A label equals a channel type name.
+    #[error("invalid label {0:?}: a label cannot be a channel type name")]
+    Reserved(String),
+    /// The clear marker `""` was combined with other labels.
+    #[error("an empty label clears all labels and cannot be combined with other labels")]
+    ClearWithOthers,
+}
+
+/// Validate the values of a channel's `["t", <label>]` tags and return the
+/// label set to store, in first-seen order without duplicates.
+///
+/// A single `""` means "no labels" and returns an empty set; kind:9002 uses
+/// it to clear the labels, the same convention as `["ttl", ""]`.
+pub fn parse_channel_labels<'a>(
+    values: impl IntoIterator<Item = &'a str>,
+) -> Result<Vec<String>, ChannelLabelError> {
+    let values: Vec<&str> = values.into_iter().collect();
+    if values.contains(&"") {
+        return if values.iter().all(|value| value.is_empty()) {
+            Ok(Vec::new())
+        } else {
+            Err(ChannelLabelError::ClearWithOthers)
+        };
+    }
+    let mut labels: Vec<String> = Vec::with_capacity(values.len());
+    for value in values {
+        let valid = value.len() <= MAX_CHANNEL_LABEL_LEN
+            && value.bytes().all(|byte| {
+                byte.is_ascii_lowercase() || byte.is_ascii_digit() || b".:-".contains(&byte)
+            });
+        if !valid {
+            return Err(ChannelLabelError::Invalid(value.to_owned()));
+        }
+        if RESERVED_CHANNEL_LABELS.contains(&value) {
+            return Err(ChannelLabelError::Reserved(value.to_owned()));
+        }
+        if !labels.iter().any(|label| label == value) {
+            labels.push(value.to_owned());
+        }
+    }
+    if labels.len() > MAX_CHANNEL_LABELS {
+        return Err(ChannelLabelError::TooMany);
+    }
+    Ok(labels)
+}
+
 /// Tags that identify a channel on every NIP-29 group-state event the relay
 /// signs (kinds 39000–39003), in this order:
 ///
 /// 1. `["t", <channel_type>]`. It comes first, so a client that reads the
 ///    first `t` tag gets the channel type.
-/// 2. `["P", <creator hex>]`: the key that signed the channel's kind:9007.
+/// 2. `["t", <label>]` for each label, in stored order.
+/// 3. `["P", <creator hex>]`: the key that signed the channel's kind:9007.
 ///    It comes from the database and does not change when ownership moves.
 ///    Uppercase `P` names the author of the root object, as in NIP-22,
 ///    NIP-34 and NIP-72; lowercase `p` already means members and DM
 ///    participants on these kinds.
 ///
-/// Filters such as `{kinds:[39000], #P:[<key>]}` select by these tags.
+/// Filters such as `{kinds:[39000], #P:[<key>], #t:[<label>]}` select by
+/// these tags.
 pub fn group_state_identity_tags(
     channel_type: &str,
+    labels: &[String],
     created_by: &[u8],
 ) -> Result<Vec<nostr::Tag>, nostr::event::tag::Error> {
-    Ok(vec![
-        nostr::Tag::parse(["t", channel_type])?,
-        nostr::Tag::parse(["P", &hex::encode(created_by)])?,
-    ])
+    let mut tags = Vec::with_capacity(labels.len() + 2);
+    tags.push(nostr::Tag::parse(["t", channel_type])?);
+    for label in labels {
+        tags.push(nostr::Tag::parse(["t", label.as_str()])?);
+    }
+    tags.push(nostr::Tag::parse(["P", &hex::encode(created_by)])?);
+    Ok(tags)
+}
+
+/// Return the channel type from group-state tags: the value of the first
+/// `t` tag. Later `t` tags are labels.
+pub fn channel_type_from_group_state_tags<'a>(
+    tags: impl IntoIterator<Item = &'a nostr::Tag>,
+) -> Option<&'a str> {
+    tags.into_iter()
+        .find(|tag| tag.kind() == nostr::TagKind::t())
+        .and_then(|tag| tag.content())
 }
 
 /// Tag on kind:39000 that holds the channel's creation time in Unix seconds.
@@ -213,25 +295,85 @@ impl FromStr for MemberRole {
 
 #[cfg(test)]
 mod tests {
-    use super::{canonical_channel_name, group_state_identity_tags};
+    use super::{
+        canonical_channel_name, channel_type_from_group_state_tags, group_state_identity_tags,
+        parse_channel_labels, ChannelLabelError, MAX_CHANNEL_LABELS,
+    };
 
     #[test]
-    fn group_state_identity_tags_put_the_type_first_then_the_creator() {
+    fn group_state_identity_tags_put_the_type_first_then_labels_then_the_creator() {
         let creator = [0xab; 32];
-        let tags: Vec<Vec<String>> = group_state_identity_tags("forum", &creator)
-            .expect("valid tags")
-            .into_iter()
-            .map(|tag| tag.to_vec())
-            .collect();
+        let labels = vec!["workspace".to_string(), "team:core".to_string()];
+        let built = group_state_identity_tags("forum", &labels, &creator).expect("valid tags");
+        assert_eq!(channel_type_from_group_state_tags(&built), Some("forum"));
+        let tags: Vec<Vec<String>> = built.into_iter().map(|tag| tag.to_vec()).collect();
         assert_eq!(
             tags,
             vec![
                 vec!["t".to_string(), "forum".to_string()],
+                vec!["t".to_string(), "workspace".to_string()],
+                vec!["t".to_string(), "team:core".to_string()],
                 vec!["P".to_string(), "ab".repeat(32)],
             ]
         );
     }
 
+    #[test]
+    fn channel_labels_accept_the_allowed_alphabet_and_drop_duplicates() {
+        assert_eq!(
+            parse_channel_labels(["agent-attention", "v1.2:x", "agent-attention"]),
+            Ok(vec!["agent-attention".to_string(), "v1.2:x".to_string()])
+        );
+        assert_eq!(
+            parse_channel_labels(["a".repeat(64).as_str()]),
+            Ok(vec!["a".repeat(64)])
+        );
+    }
+
+    #[test]
+    fn channel_labels_refuse_bad_characters_lengths_and_type_names() {
+        for bad in ["Upper", "has space", "under_score", "emoji🙂"] {
+            assert_eq!(
+                parse_channel_labels([bad]),
+                Err(ChannelLabelError::Invalid(bad.to_string()))
+            );
+        }
+        let long = "a".repeat(65);
+        assert_eq!(
+            parse_channel_labels([long.as_str()]),
+            Err(ChannelLabelError::Invalid(long.clone()))
+        );
+        for reserved in ["stream", "forum", "dm", "workflow", "system"] {
+            assert_eq!(
+                parse_channel_labels([reserved]),
+                Err(ChannelLabelError::Reserved(reserved.to_string()))
+            );
+        }
+    }
+
+    #[test]
+    fn channel_labels_cap_the_distinct_count() {
+        let names: Vec<String> = (0..=MAX_CHANNEL_LABELS).map(|i| format!("l{i}")).collect();
+        assert_eq!(
+            parse_channel_labels(names.iter().map(String::as_str)),
+            Err(ChannelLabelError::TooMany)
+        );
+        assert_eq!(
+            parse_channel_labels(names[..MAX_CHANNEL_LABELS].iter().map(String::as_str))
+                .map(|labels| labels.len()),
+            Ok(MAX_CHANNEL_LABELS)
+        );
+    }
+
+    #[test]
+    fn a_lone_empty_label_clears_and_cannot_mix_with_labels() {
+        assert_eq!(parse_channel_labels([""]), Ok(Vec::new()));
+        assert_eq!(
+            parse_channel_labels(["", "workspace"]),
+            Err(ChannelLabelError::ClearWithOthers)
+        );
+    }
+
     #[test]
     fn channel_names_trim_whitespace_and_drop_all_leading_hashes() {
         assert_eq!(canonical_channel_name("channel"), "channel");
diff --git a/crates/buzz-db/src/runtime/migration.rs b/crates/buzz-db/src/runtime/migration.rs
index b6ead54e06..8c40861900 100644
--- a/crates/buzz-db/src/runtime/migration.rs
+++ b/crates/buzz-db/src/runtime/migration.rs
@@ -705,7 +705,7 @@ mod postgres_tests {
         let mut migrations: Vec<_> = MIGRATOR.iter().collect();
         migrations.sort_by_key(|migration| migration.version);
 
-        assert_eq!(migrations.len(), 60);
+        assert_eq!(migrations.len(), 61);
         assert_eq!(migrations[58].version, 59);
         assert!(migrations[58].sql.as_str().contains("buzz.push_enabled"));
         assert_eq!(migrations[59].version, 60);
@@ -713,6 +713,8 @@ mod postgres_tests {
             .sql
             .as_str()
             .contains("ALTER TABLE push_leases DROP COLUMN app_profile"));
+        assert_eq!(migrations[60].version, 61);
+        assert!(migrations[60].sql.as_str().contains("ADD COLUMN labels"));
         assert_eq!(migrations[55].version, 56);
         assert!(migrations[55]
             .sql
diff --git a/crates/buzz-db/src/runtime/tests.rs b/crates/buzz-db/src/runtime/tests.rs
index 2e0e260bd2..3fe785134c 100644
--- a/crates/buzz-db/src/runtime/tests.rs
+++ b/crates/buzz-db/src/runtime/tests.rs
@@ -874,6 +874,10 @@ async fn push_gateway_profile_migration_converges_brownfield_authority() {
 
 /// Insert identical community + channel rows into a database so the same
 /// (community, channel) ids resolve in both writer and replica.
+///
+/// Raw SQL with only columns from the initial schema: some callers seed a
+/// scratch database migrated to an older version, which lacks columns that
+/// the current channel store writes (for example `labels`).
 async fn seed_community_channel(
     pool: &PgPool,
     community: Uuid,
@@ -886,19 +890,28 @@ async fn seed_community_channel(
         .execute(pool)
         .await
         .expect("insert community");
-    crate::channel::create_channel_with_id(
-        pool,
-        CommunityId::from_uuid(community),
-        channel,
-        &format!("replica-routing-{channel}"),
-        crate::channel::ChannelType::Stream,
-        crate::channel::ChannelVisibility::Open,
-        None,
-        author.public_key().to_bytes().as_slice(),
-        None,
+    let author = author.public_key().to_bytes();
+    sqlx::query(
+        "INSERT INTO channels (id, community_id, name, channel_type, visibility, created_by) \
+         VALUES ($1, $2, $3, 'stream', 'open', $4)",
     )
+    .bind(channel)
+    .bind(community)
+    .bind(format!("replica-routing-{channel}"))
+    .bind(author.as_slice())
+    .execute(pool)
     .await
     .expect("create channel");
+    sqlx::query(
+        "INSERT INTO channel_members (community_id, channel_id, pubkey, role, invited_by) \
+         VALUES ($1, $2, $3, 'owner', $3)",
+    )
+    .bind(community)
+    .bind(channel)
+    .bind(author.as_slice())
+    .execute(pool)
+    .await
+    .expect("add channel owner");
 }
 
 fn signed_event_at(keys: &nostr::Keys, content: &str, secs: u64) -> nostr::Event {
diff --git a/crates/buzz-db/src/store/channel.rs b/crates/buzz-db/src/store/channel.rs
index 46375595cf..09171277a5 100644
--- a/crates/buzz-db/src/store/channel.rs
+++ b/crates/buzz-db/src/store/channel.rs
@@ -97,6 +97,8 @@ pub struct ChannelRecord {
     pub ttl_seconds: Option<i32>,
     /// Deadline by which a new message must arrive or the channel is auto-archived.
     pub ttl_deadline: Option<DateTime<Utc>>,
+    /// Labels published as `["t", <label>]` after the channel type tag.
+    pub labels: Vec<String>,
 }
 
 impl ChannelRecord {
@@ -104,6 +106,7 @@ impl ChannelRecord {
     pub fn identity(&self) -> ChannelIdentity {
         ChannelIdentity {
             channel_type: self.channel_type.clone(),
+            labels: self.labels.clone(),
             created_by: self.created_by.clone(),
         }
     }
@@ -120,6 +123,7 @@ pub async fn create_channel(
     description: Option<&str>,
     created_by: &[u8],
     ttl_seconds: Option<i32>,
+    labels: &[String],
 ) -> Result<ChannelRecord> {
     if created_by.len() != 32 {
         return Err(DbError::InvalidData(format!(
@@ -139,9 +143,9 @@ pub async fn create_channel(
 
     sqlx::query(
         r#"
-        INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline)
+        INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline, labels)
         VALUES ($1, $2, $3, $4::channel_type, $5::channel_visibility, $6, $7, $8,
-                CASE WHEN $8 IS NOT NULL THEN NOW() + ($8 || ' seconds')::interval ELSE NULL END)
+                CASE WHEN $8 IS NOT NULL THEN NOW() + ($8 || ' seconds')::interval ELSE NULL END, $9)
         "#,
     )
     .bind(id)
@@ -152,6 +156,7 @@ pub async fn create_channel(
     .bind(description)
     .bind(created_by)
     .bind(ttl_seconds)
+    .bind(labels)
     .execute(&mut *tx)
     .await?;
 
@@ -180,7 +185,7 @@ pub async fn create_channel(
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
                purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline
+               ttl_seconds, ttl_deadline, labels
         FROM channels WHERE community_id = $1 AND id = $2
         "#,
     )
@@ -209,6 +214,7 @@ pub async fn create_channel_with_id(
     description: Option<&str>,
     created_by: &[u8],
     ttl_seconds: Option<i32>,
+    labels: &[String],
 ) -> Result<(ChannelRecord, bool)> {
     if created_by.len() != 32 {
         return Err(DbError::InvalidData(format!(
@@ -232,9 +238,9 @@ pub async fn create_channel_with_id(
 
     let rows_affected = sqlx::query(
         r#"
-        INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline)
+        INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline, labels)
         VALUES ($1, $2, $3, $4::channel_type, $5::channel_visibility, $6, $7, $8,
-                CASE WHEN $8 IS NOT NULL THEN NOW() + ($8 || ' seconds')::interval ELSE NULL END)
+                CASE WHEN $8 IS NOT NULL THEN NOW() + ($8 || ' seconds')::interval ELSE NULL END, $9)
         ON CONFLICT (community_id, id) DO NOTHING
         "#,
     )
@@ -246,6 +252,7 @@ pub async fn create_channel_with_id(
     .bind(description)
     .bind(created_by)
     .bind(ttl_seconds)
+    .bind(labels)
     .execute(&mut *tx)
     .await?
     .rows_affected();
@@ -280,7 +287,7 @@ pub async fn create_channel_with_id(
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
                purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline
+               ttl_seconds, ttl_deadline, labels
         FROM channels WHERE community_id = $1 AND id = $2
         "#,
     )
@@ -324,7 +331,7 @@ async fn get_channel_with_operation(
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
                purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline
+               ttl_seconds, ttl_deadline, labels
         FROM channels WHERE community_id = $1 AND id = $2 AND deleted_at IS NULL
         "#,
     )
@@ -406,7 +413,7 @@ async fn list_channels_with_operation(
                    nip29_group_id, topic_required, max_members,
                    topic, topic_set_by, topic_set_at,
                    purpose, purpose_set_by, purpose_set_at,
-                   ttl_seconds, ttl_deadline
+                   ttl_seconds, ttl_deadline, labels
             FROM channels
             WHERE community_id = $1 AND deleted_at IS NULL AND visibility::text = $2
             ORDER BY created_at DESC
@@ -426,7 +433,7 @@ async fn list_channels_with_operation(
                    nip29_group_id, topic_required, max_members,
                    topic, topic_set_by, topic_set_at,
                    purpose, purpose_set_by, purpose_set_at,
-                   ttl_seconds, ttl_deadline
+                   ttl_seconds, ttl_deadline, labels
             FROM channels
             WHERE community_id = $1 AND deleted_at IS NULL
             ORDER BY created_at DESC
@@ -490,6 +497,7 @@ pub(crate) fn row_to_channel_record(row: sqlx::postgres::PgRow) -> Result<Channe
         purpose_set_at,
         ttl_seconds,
         ttl_deadline,
+        labels: row.try_get("labels")?,
     })
 }
 
@@ -507,6 +515,9 @@ pub struct ChannelUpdate {
     /// ephemeral TTL (channel becomes permanent), `Some(Some(secs))` sets it.
     /// On any change the `ttl_deadline` is reset to `NOW() + ttl_seconds`.
     pub ttl_seconds: Option<Option<i32>>,
+    /// Replacement label set (empty clears it), or `None` to leave unchanged.
+    /// Callers validate with `buzz_core::channel::parse_channel_labels`.
+    pub labels: Option<Vec<String>>,
 }
 
 /// Updates channel metadata dynamically.
@@ -523,6 +534,7 @@ pub async fn update_channel(
         && updates.description.is_none()
         && updates.visibility.is_none()
         && updates.ttl_seconds.is_none()
+        && updates.labels.is_none()
     {
         return Err(DbError::InvalidData(
             "at least one field must be provided for update".to_string(),
@@ -564,6 +576,10 @@ pub async fn update_channel(
             None => set_parts.push("ttl_deadline = NULL".to_string()),
         }
     }
+    if updates.labels.is_some() {
+        set_parts.push(format!("labels = ${param_idx}"));
+        param_idx += 1;
+    }
     let channel_param_idx = param_idx + 1;
     let sql = format!(
         "UPDATE channels SET {}, updated_at = NOW() WHERE community_id = ${param_idx} AND id = ${channel_param_idx} AND deleted_at IS NULL",
@@ -583,6 +599,9 @@ pub async fn update_channel(
     if let Some(ref ttl) = updates.ttl_seconds {
         q = q.bind(*ttl);
     }
+    if let Some(ref labels) = updates.labels {
+        q = q.bind(labels);
+    }
     q = q.bind(community_id.as_uuid());
     q = q.bind(channel_id);
 
@@ -842,6 +861,7 @@ impl Db {
             description,
             created_by,
             ttl_seconds,
+            &[],
         )
         .await
     }
@@ -872,6 +892,68 @@ impl Db {
             description,
             created_by,
             ttl_seconds,
+            &[],
+        )
+        .await
+    }
+
+    /// Creates a channel with a client-supplied UUID and an initial label set.
+    ///
+    /// The same as [`Db::create_channel_with_id`], plus `labels`, which the
+    /// caller has validated with `buzz_core::channel::parse_channel_labels`.
+    #[allow(clippy::too_many_arguments)]
+    #[datastore_span(name = "create_labeled_channel_with_id", system = "postgresql")]
+    pub async fn create_labeled_channel_with_id(
+        &self,
+        community_id: CommunityId,
+        channel_id: Uuid,
+        name: &str,
+        channel_type: ChannelType,
+        visibility: ChannelVisibility,
+        description: Option<&str>,
+        created_by: &[u8],
+        ttl_seconds: Option<i32>,
+        labels: &[String],
+    ) -> Result<(ChannelRecord, bool)> {
+        create_channel_with_id(
+            &self.pool,
+            community_id,
+            channel_id,
+            name,
+            channel_type,
+            visibility,
+            description,
+            created_by,
+            ttl_seconds,
+            labels,
+        )
+        .await
+    }
+
+    /// Creates a channel with a relay-chosen UUID and an initial label set.
+    #[allow(clippy::too_many_arguments)]
+    #[datastore_span(name = "create_labeled_channel", system = "postgresql")]
+    pub async fn create_labeled_channel(
+        &self,
+        community_id: CommunityId,
+        name: &str,
+        channel_type: ChannelType,
+        visibility: ChannelVisibility,
+        description: Option<&str>,
+        created_by: &[u8],
+        ttl_seconds: Option<i32>,
+        labels: &[String],
+    ) -> Result<ChannelRecord> {
+        create_channel(
+            &self.pool,
+            community_id,
+            name,
+            channel_type,
+            visibility,
+            description,
+            created_by,
+            ttl_seconds,
+            labels,
         )
         .await
     }
diff --git a/crates/buzz-db/src/store/channel_members.rs b/crates/buzz-db/src/store/channel_members.rs
index cf54d93f04..ed7845f2a8 100644
--- a/crates/buzz-db/src/store/channel_members.rs
+++ b/crates/buzz-db/src/store/channel_members.rs
@@ -307,6 +307,8 @@ pub async fn insert_auto_membership_in_transaction(
 pub struct ChannelIdentity {
     /// Channel type string (e.g. `"stream"`, `"forum"`, `"dm"`).
     pub channel_type: String,
+    /// Labels, published as `t` tags after the channel type.
+    pub labels: Vec<String>,
     /// Public key bytes of the channel creator (the kind:9007 signer).
     pub created_by: Vec<u8>,
 }
@@ -316,7 +318,7 @@ pub struct ChannelIdentity {
 pub struct LockedMemberSnapshot {
     /// Canonical active members captured behind the lock.
     pub members: Vec<MemberRecord>,
-    /// The channel's type and creator, read on the same connection, so the
+    /// The channel's type, labels and creator, read on the same connection, so the
     /// roster carries the same identity tags as the channel's other
     /// group-state events. `None` when no channel row exists.
     pub identity: Option<ChannelIdentity>,
@@ -491,15 +493,16 @@ pub async fn lock_member_snapshot(
         .into_iter()
         .map(row_to_member_record)
         .collect::<Result<Vec<_>>>()?;
-    let identity = sqlx::query_as::<_, (String, Vec<u8>)>(
-        "SELECT channel_type::text, created_by FROM channels WHERE community_id = $1 AND id = $2",
+    let identity = sqlx::query_as::<_, (String, Vec<String>, Vec<u8>)>(
+        "SELECT channel_type::text, labels, created_by FROM channels WHERE community_id = $1 AND id = $2",
     )
     .bind(community_id.as_uuid())
     .bind(channel_id)
     .fetch_optional(tx.conn())
     .await?
-    .map(|(channel_type, created_by)| ChannelIdentity {
+    .map(|(channel_type, labels, created_by)| ChannelIdentity {
         channel_type,
+        labels,
         created_by,
     });
     Ok(LockedMemberSnapshot {
@@ -1260,7 +1263,7 @@ async fn get_channel_tx(
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
                purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline
+               ttl_seconds, ttl_deadline, labels
         FROM channels WHERE community_id = $1 AND id = $2 AND deleted_at IS NULL
         "#,
     )
@@ -1356,7 +1359,7 @@ pub async fn get_accessible_channels(
                c.nip29_group_id, c.topic_required, c.max_members,
                c.topic, c.topic_set_by, c.topic_set_at,
                c.purpose, c.purpose_set_by, c.purpose_set_at,
-               c.ttl_seconds, c.ttl_deadline,
+               c.ttl_seconds, c.ttl_deadline, c.labels,
                (cm.channel_id IS NOT NULL) AS is_member
         FROM channels c
         LEFT JOIN channel_members cm
@@ -3481,6 +3484,7 @@ mod postgres_tests {
             None,
             author.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("create channel");
diff --git a/crates/buzz-db/src/store/dm.rs b/crates/buzz-db/src/store/dm.rs
index 89e4a0e522..bd9b944f10 100644
--- a/crates/buzz-db/src/store/dm.rs
+++ b/crates/buzz-db/src/store/dm.rs
@@ -76,7 +76,7 @@ pub async fn find_dm_by_participants(
                created_by, created_at, updated_at, archived_at, deleted_at,
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
-               purpose, purpose_set_by, purpose_set_at
+               purpose, purpose_set_by, purpose_set_at, labels
         FROM channels
         WHERE community_id = $1
           AND participant_hash = $2
@@ -137,7 +137,7 @@ pub async fn create_dm(
                created_by, created_at, updated_at, archived_at, deleted_at,
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
-               purpose, purpose_set_by, purpose_set_at
+               purpose, purpose_set_by, purpose_set_at, labels
         FROM channels
         WHERE community_id = $1
           AND participant_hash = $2
@@ -207,7 +207,7 @@ pub async fn create_dm(
                created_by, created_at, updated_at, archived_at, deleted_at,
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
-               purpose, purpose_set_by, purpose_set_at
+               purpose, purpose_set_by, purpose_set_at, labels
         FROM channels WHERE community_id = $1 AND id = $2
         "#,
     )
@@ -513,6 +513,7 @@ fn row_to_channel_record(row: sqlx::postgres::PgRow) -> Result<ChannelRecord> {
         purpose_set_at: row.try_get("purpose_set_at").unwrap_or(None),
         ttl_seconds: row.try_get("ttl_seconds").unwrap_or(None),
         ttl_deadline: row.try_get("ttl_deadline").unwrap_or(None),
+        labels: row.try_get("labels")?,
     })
 }
 
diff --git a/crates/buzz-db/src/store/relay_admin_actions.rs b/crates/buzz-db/src/store/relay_admin_actions.rs
index 0a876beb2a..e44bb08a3c 100644
--- a/crates/buzz-db/src/store/relay_admin_actions.rs
+++ b/crates/buzz-db/src/store/relay_admin_actions.rs
@@ -3176,6 +3176,7 @@ mod postgres_tests {
             None,
             keys.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("channel");
diff --git a/crates/buzz-db/src/store/replaceable.rs b/crates/buzz-db/src/store/replaceable.rs
index 1bce5766a4..5cb76d7262 100644
--- a/crates/buzz-db/src/store/replaceable.rs
+++ b/crates/buzz-db/src/store/replaceable.rs
@@ -739,6 +739,7 @@ mod postgres_tests {
             None,
             author.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("create channel");
diff --git a/crates/buzz-db/src/store/thread.rs b/crates/buzz-db/src/store/thread.rs
index 5b30f5df83..7b5c89555a 100644
--- a/crates/buzz-db/src/store/thread.rs
+++ b/crates/buzz-db/src/store/thread.rs
@@ -1284,6 +1284,7 @@ mod postgres_tests {
                 None,
                 author.public_key().to_bytes().as_slice(),
                 None,
+                &[],
             )
             .await
             .expect("channel");
@@ -1358,6 +1359,7 @@ mod postgres_tests {
             None,
             author.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("create community A channel");
@@ -1371,6 +1373,7 @@ mod postgres_tests {
             None,
             author.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("create community B channel");
diff --git a/crates/buzz-relay/src/api/bridge.rs b/crates/buzz-relay/src/api/bridge.rs
index 09c0e31c2b..4446c29d3b 100644
--- a/crates/buzz-relay/src/api/bridge.rs
+++ b/crates/buzz-relay/src/api/bridge.rs
@@ -7667,6 +7667,7 @@ pub(crate) mod postgres_tests {
                     None,
                     author.public_key().to_bytes().as_slice(),
                     None,
+                    &[],
                 )
                 .await
                 .expect("create channel");
@@ -7905,6 +7906,7 @@ pub(crate) mod postgres_tests {
                 None,
                 author.public_key().to_bytes().as_slice(),
                 None,
+                &[],
             )
             .await
             .expect("create channel");
diff --git a/crates/buzz-relay/src/handlers/group_state_postgres_tests.rs b/crates/buzz-relay/src/handlers/group_state_postgres_tests.rs
index 2df126d097..9a51da1ee8 100644
--- a/crates/buzz-relay/src/handlers/group_state_postgres_tests.rs
+++ b/crates/buzz-relay/src/handlers/group_state_postgres_tests.rs
@@ -238,3 +238,218 @@ async fn creator_tag_survives_ownership_transfer() {
         );
     }
 }
+
+/// Ingest a kind:9002 that `keys` signs for `channel_id` with `tags`.
+async fn edit_channel(
+    state: &Arc<AppState>,
+    tenant: &TenantContext,
+    keys: &Keys,
+    channel_id: Uuid,
+    tags: &[&[&str]],
+) -> Result<(), String> {
+    let mut built = vec![Tag::parse(["h", &channel_id.to_string()]).unwrap()];
+    for tag in tags {
+        built.push(Tag::parse(tag.iter().copied()).unwrap());
+    }
+    let event = EventBuilder::new(Kind::Custom(9002), "")
+        .tags(built)
+        .sign_with_keys(keys)
+        .expect("sign 9002");
+    match ingest_event(state, tenant, event, http_auth(keys)).await {
+        Ok(result) if result.accepted => Ok(()),
+        Ok(result) => Err(result.message),
+        Err(error) => Err(format!("{error:?}")),
+    }
+}
+
+/// The `t` values of a group-state event, in tag order.
+async fn t_values(
+    state: &AppState,
+    tenant: &TenantContext,
+    channel_id: Uuid,
+    kind: i32,
+) -> Vec<String> {
+    group_state_tags(state, tenant, channel_id, kind)
+        .await
+        .into_iter()
+        .filter(|tag| tag[0] == "t")
+        .map(|tag| tag[1].clone())
+        .collect()
+}
+
+/// Labels from kind:9007 follow the type tag on every group-state kind,
+/// in the order given, without duplicates, and the creator `P` stays.
+/// Mutation: publish labels before the type, or drop them from 39002 → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn create_publishes_labels_after_the_type() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-labels").await;
+    let creator = Keys::generate();
+    let channel_id = create_channel(
+        &state,
+        &tenant,
+        &creator,
+        &[
+            &["channel_type", "forum"],
+            &["t", "workspace"],
+            &["t", "team:core"],
+            &["t", "workspace"],
+        ],
+    )
+    .await;
+
+    let record = state
+        .db
+        .get_channel(tenant.community(), channel_id)
+        .await
+        .expect("channel");
+    assert_eq!(record.labels, vec!["workspace", "team:core"]);
+    for kind in [39000, 39001, 39002] {
+        assert_eq!(
+            t_values(&state, &tenant, channel_id, kind).await,
+            vec!["forum", "workspace", "team:core"],
+            "kind:{kind}"
+        );
+        let tags = group_state_tags(&state, &tenant, channel_id, kind).await;
+        assert!(
+            tags.iter()
+                .any(|tag| tag[0] == "P" && tag[1] == creator.public_key().to_hex()),
+            "kind:{kind} keeps the creator: {tags:?}"
+        );
+    }
+}
+
+/// kind:9002 `t` tags replace the whole set, a lone `["t", ""]` clears
+/// it, and an edit without `t` tags leaves it alone.
+/// Mutation: append instead of replace, or treat `""` as a label → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn edit_replaces_and_clears_labels() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-label-edit").await;
+    let owner = Keys::generate();
+    let channel_id = create_channel(&state, &tenant, &owner, &[&["t", "old"]]).await;
+
+    edit_channel(
+        &state,
+        &tenant,
+        &owner,
+        channel_id,
+        &[&["t", "new-a"], &["t", "new-b"]],
+    )
+    .await
+    .expect("replace labels");
+    for kind in [39000, 39001, 39002] {
+        assert_eq!(
+            t_values(&state, &tenant, channel_id, kind).await,
+            vec!["stream", "new-a", "new-b"],
+            "kind:{kind} after replace"
+        );
+    }
+
+    edit_channel(&state, &tenant, &owner, channel_id, &[&["about", "x"]])
+        .await
+        .expect("edit about");
+    assert_eq!(
+        t_values(&state, &tenant, channel_id, 39000).await,
+        vec!["stream", "new-a", "new-b"],
+        "an edit without t tags keeps the labels"
+    );
+
+    edit_channel(&state, &tenant, &owner, channel_id, &[&["t", ""]])
+        .await
+        .expect("clear labels");
+    for kind in [39000, 39001, 39002] {
+        assert_eq!(
+            t_values(&state, &tenant, channel_id, kind).await,
+            vec!["stream"],
+            "kind:{kind} after clear"
+        );
+    }
+}
+
+/// Bad label sets are refused before storage, on create and on edit.
+/// Mutation: skip validation in either path → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn invalid_labels_are_refused() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-label-invalid").await;
+    let owner = Keys::generate();
+
+    for bad in [vec!["t", "Upper"], vec!["t", "forum"], vec!["t"]] {
+        let channel_id = Uuid::new_v4();
+        let event = EventBuilder::new(Kind::Custom(9007), "")
+            .tags([
+                Tag::parse(["h", &channel_id.to_string()]).unwrap(),
+                Tag::parse(["name", "bad-labels"]).unwrap(),
+                Tag::parse(bad.clone()).unwrap(),
+            ])
+            .sign_with_keys(&owner)
+            .unwrap();
+        let accepted = ingest_event(&state, &tenant, event, http_auth(&owner))
+            .await
+            .is_ok_and(|result| result.accepted);
+        assert!(!accepted, "create with {bad:?} must fail");
+        assert!(
+            state
+                .db
+                .get_channel(tenant.community(), channel_id)
+                .await
+                .is_err(),
+            "no channel row for {bad:?}"
+        );
+    }
+
+    let channel_id = create_channel(&state, &tenant, &owner, &[&["t", "keep"]]).await;
+    let nine: Vec<String> = (0..9).map(|i| format!("l{i}")).collect();
+    let too_many: Vec<[&str; 2]> = nine.iter().map(|l| ["t", l.as_str()]).collect();
+    let too_many: Vec<&[&str]> = too_many.iter().map(|t| t.as_slice()).collect();
+    for tags in [
+        vec![&["t", "workflow"][..]],
+        vec![&["t", ""][..], &["t", "x"][..]],
+        too_many,
+    ] {
+        assert!(
+            edit_channel(&state, &tenant, &owner, channel_id, &tags)
+                .await
+                .is_err(),
+            "edit with {tags:?} must fail"
+        );
+    }
+    assert_eq!(
+        t_values(&state, &tenant, channel_id, 39000).await,
+        vec!["stream", "keep"]
+    );
+}
+
+/// Only an owner or admin may change labels; a plain member may not.
+/// Mutation: drop `t` from the privileged tag list → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn members_cannot_change_labels() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-label-auth").await;
+    let owner = Keys::generate();
+    let member = Keys::generate();
+    let channel_id = create_channel(&state, &tenant, &owner, &[&["t", "keep"]]).await;
+    let join = EventBuilder::new(Kind::Custom(9021), "")
+        .tags([Tag::parse(["h", &channel_id.to_string()]).unwrap()])
+        .sign_with_keys(&member)
+        .unwrap();
+    ingest_event(&state, &tenant, join, http_auth(&member))
+        .await
+        .expect("member joins");
+
+    assert!(
+        edit_channel(&state, &tenant, &member, channel_id, &[&["t", "mine"]])
+            .await
+            .is_err(),
+        "a member must not set labels"
+    );
+    assert_eq!(
+        t_values(&state, &tenant, channel_id, 39000).await,
+        vec!["stream", "keep"]
+    );
+}
diff --git a/crates/buzz-relay/src/handlers/ingest.rs b/crates/buzz-relay/src/handlers/ingest.rs
index d4dcbaaece..a18ec42e57 100644
--- a/crates/buzz-relay/src/handlers/ingest.rs
+++ b/crates/buzz-relay/src/handlers/ingest.rs
@@ -3078,6 +3078,10 @@ async fn ingest_event_inner(
             channel_type_str.parse().map_err(|_| {
                 IngestError::Rejected(format!("invalid channel_type: {channel_type_str}"))
             })?;
+        let labels = super::side_effects::channel_labels_from_tags(&event)
+            .transpose()
+            .map_err(|e| IngestError::Rejected(format!("invalid: {e}")))?
+            .unwrap_or_default();
 
         if let Some(client_uuid) = channel_id {
             let name = create_name.unwrap_or_default();
@@ -3096,7 +3100,7 @@ async fn ingest_event_inner(
             let actor_bytes = event.pubkey.to_bytes().to_vec();
             let (_, was_created) = state
                 .db
-                .create_channel_with_id(
+                .create_labeled_channel_with_id(
                     tenant.community(),
                     client_uuid,
                     name,
@@ -3105,6 +3109,7 @@ async fn ingest_event_inner(
                     description.as_deref(),
                     &actor_bytes,
                     ttl_seconds,
+                    &labels,
                 )
                 .await
                 .map_err(|e| IngestError::Internal(format!("error: {e}")))?;
diff --git a/crates/buzz-relay/src/handlers/side_effects.rs b/crates/buzz-relay/src/handlers/side_effects.rs
index 8db4847080..6396a71af5 100644
--- a/crates/buzz-relay/src/handlers/side_effects.rs
+++ b/crates/buzz-relay/src/handlers/side_effects.rs
@@ -576,6 +576,7 @@ pub async fn validate_admin_event(
                 "purpose",
                 "visibility",
                 "ttl",
+                "t",
             ];
             let has_recognized = event
                 .tags
@@ -583,7 +584,7 @@ pub async fn validate_admin_event(
                 .any(|t| RECOGNIZED_TAGS.contains(&t.kind().to_string().as_str()));
             if !has_recognized {
                 return Err(anyhow::anyhow!(
-                    "kind:9002 must include at least one metadata tag (name, about, archived, topic, purpose, visibility, ttl)"
+                    "kind:9002 must include at least one metadata tag (name, about, archived, topic, purpose, visibility, ttl, t)"
                 ));
             }
 
@@ -662,11 +663,21 @@ pub async fn validate_admin_event(
                 }
             }
 
-            // name/about/archived/visibility/ttl require owner/admin;
+            // Validate label (`t`) values before storage.
+            if let Some(labels) = channel_labels_from_tags(event) {
+                labels.map_err(|e| anyhow::anyhow!("{e}"))?;
+            }
+
+            // name/about/archived/visibility/ttl/labels require owner/admin;
             // topic/purpose allow any member.
             let has_privileged_tag = event.tags.iter().any(|t| {
                 let k = t.kind().to_string();
-                k == "name" || k == "about" || k == "archived" || k == "visibility" || k == "ttl"
+                k == "name"
+                    || k == "about"
+                    || k == "archived"
+                    || k == "visibility"
+                    || k == "ttl"
+                    || k == "t"
             });
             if has_privileged_tag {
                 let members = state.db.get_members(tenant.community(), channel_id).await?;
@@ -688,7 +699,7 @@ pub async fn validate_admin_event(
                             return Ok(());
                         }
                         Err(anyhow::anyhow!(
-                            "actor not authorized for name/about/archived/visibility/ttl changes"
+                            "actor not authorized for name/about/archived/visibility/ttl/label changes"
                         ))
                     }
                 }
@@ -1115,12 +1126,13 @@ async fn emit_addressable_discovery_event(
 }
 
 /// Tags that identify the channel on every relay-signed group-state event:
-/// the channel type `t` first, then the creator `P`.
+/// the channel type `t` first, then one `t` per label, then the creator `P`.
 fn group_state_identity_tags(
     identity: &buzz_db::channel::ChannelIdentity,
 ) -> anyhow::Result<Vec<Tag>> {
     Ok(buzz_core::channel::group_state_identity_tags(
         &identity.channel_type,
+        &identity.labels,
         &identity.created_by,
     )?)
 }
@@ -1825,6 +1837,23 @@ async fn handle_edit_metadata(
         }
     }
 
+    // All `t` tags together form the new label set, so they are applied
+    // once after the loop. `["t", ""]` alone clears the set.
+    if let Some(labels) = channel_labels_from_tags(event) {
+        let labels = labels.map_err(|e| anyhow::anyhow!("{e}"))?;
+        state
+            .db
+            .update_channel(
+                tenant.community(),
+                channel_id,
+                buzz_db::channel::ChannelUpdate {
+                    labels: Some(labels),
+                    ..Default::default()
+                },
+            )
+            .await?;
+    }
+
     if let Err(e) = emit_group_discovery_events(tenant, state, channel_id).await {
         warn!(channel = %channel_id, error = %e, "NIP-29 group discovery emission failed");
     }
@@ -1832,6 +1861,33 @@ async fn handle_edit_metadata(
     Ok(())
 }
 
+/// The channel label set named by an event's `["t", <label>]` tags, or
+/// `None` when the event has no `t` tag. kind:9007 uses it for the initial
+/// labels and kind:9002 for a replacement set. A `t` tag without a value is
+/// refused.
+pub(crate) fn channel_labels_from_tags(
+    event: &Event,
+) -> Option<Result<Vec<String>, buzz_core::channel::ChannelLabelError>> {
+    let mut values = Vec::new();
+    for tag in event.tags.iter() {
+        if tag.kind() == nostr::TagKind::t() {
+            match tag.content() {
+                Some(value) => values.push(value),
+                None => {
+                    return Some(Err(buzz_core::channel::ChannelLabelError::Invalid(
+                        String::new(),
+                    )))
+                }
+            }
+        }
+    }
+    if values.is_empty() {
+        None
+    } else {
+        Some(buzz_core::channel::parse_channel_labels(values))
+    }
+}
+
 async fn handle_delete_event_side_effect(
     tenant: &TenantContext,
     event: &Event,
@@ -1954,6 +2010,10 @@ async fn handle_create_group(
     let actor_bytes = event.pubkey.to_bytes().to_vec();
     let description = extract_tag_value(event, "about");
     let ttl_seconds = super::resolve_ttl(event, state.config.ephemeral_ttl_override);
+    let labels = channel_labels_from_tags(event)
+        .transpose()
+        .map_err(|e| anyhow::anyhow!("{e}"))?
+        .unwrap_or_default();
 
     // If the event has an h-tag UUID, ingest_event() already created the channel
     // via create_channel_with_id(). Fetch it rather than creating a duplicate.
@@ -1978,7 +2038,7 @@ async fn handle_create_group(
                 // but fall back to creation to stay resilient.
                 let ch = state
                     .db
-                    .create_channel(
+                    .create_labeled_channel(
                         tenant.community(),
                         &name,
                         channel_type,
@@ -1986,6 +2046,7 @@ async fn handle_create_group(
                         description.as_deref(),
                         &actor_bytes,
                         ttl_seconds,
+                        &labels,
                     )
                     .await?;
                 metrics::counter!(
@@ -2000,7 +2061,7 @@ async fn handle_create_group(
     } else {
         let ch = state
             .db
-            .create_channel(
+            .create_labeled_channel(
                 tenant.community(),
                 &name,
                 channel_type,
@@ -2008,6 +2069,7 @@ async fn handle_create_group(
                 description.as_deref(),
                 &actor_bytes,
                 ttl_seconds,
+                &labels,
             )
             .await?;
         metrics::counter!(
@@ -3971,6 +4033,7 @@ mod tests {
 
         let identity = buzz_db::channel::ChannelIdentity {
             channel_type: "forum".to_string(),
+            labels: Vec::new(),
             created_by: vec![0xab; 32],
         };
         let tags = group_members_tags(&channel_id.to_string(), Some(&identity), &members)
diff --git a/migrations/0061_channel_labels.sql b/migrations/0061_channel_labels.sql
new file mode 100644
index 0000000000..c30287c9f1
--- /dev/null
+++ b/migrations/0061_channel_labels.sql
@@ -0,0 +1,13 @@
+-- Channel labels: creator- or admin-chosen tags that group channels across
+-- channel types. The relay publishes each label as a ["t", <label>] tag on
+-- the channel's group-state events (kinds 39000-39003), after the channel
+-- type tag. kind:9007 sets them and kind:9002 replaces them; the relay
+-- validates their shape (1-64 of a-z 0-9 . : -, not a channel type name).
+--
+-- Additive: existing channels get an empty set and look as before. The
+-- CHECK bounds the set even if a writer skips the relay's validation.
+-- No index yet: label lookups match the GIN-indexed tags of the relay-signed
+-- group-state events, not this column.
+ALTER TABLE channels
+    ADD COLUMN labels TEXT[] NOT NULL DEFAULT '{}'
+        CONSTRAINT channels_labels_bounded CHECK (cardinality(labels) <= 8);
diff --git a/schema/tables/public/channels.sql b/schema/tables/public/channels.sql
index 5fe5659cfb..ef5e25cbb5 100644
--- a/schema/tables/public/channels.sql
+++ b/schema/tables/public/channels.sql
@@ -32,6 +32,10 @@ CREATE TABLE channels (
     participant_hash BYTEA,
     ttl_seconds     INT,
     ttl_deadline    TIMESTAMPTZ,
+    -- Labels, published as ["t", <label>] after the channel type tag on the
+    -- relay-signed group-state events. The relay validates their shape.
+    labels          TEXT[] NOT NULL DEFAULT '{}'
+        CONSTRAINT channels_labels_bounded CHECK (cardinality(labels) <= 8),
     PRIMARY KEY (community_id, id),
     CONSTRAINT chk_channels_id_not_nil CHECK (id <> '00000000-0000-0000-0000-000000000000'::uuid)
 );