diff --git a/migrations/000056_vault_chat_id.up.sql b/migrations/000056_vault_chat_id.up.sql
index a34edb82..15cd4020 100644
--- a/migrations/000056_vault_chat_id.up.sql
+++ b/migrations/000056_vault_chat_id.up.sql
@@ -27,40 +27,45 @@ WHERE vd.team_id = t.id
 -- in isolated-team search because the `searchChatFilter` predicate cannot
 -- distinguish them.
 --
--- Path layouts handled (ordered most-specific → most-general in COALESCE):
---   telegram/group_telegram_<chat>/...           (nested legacy)
---   <agent_key>/telegram/group_telegram_<chat>/. (agent-owned nested)
---   group_telegram_<chat>/...                    (bare legacy)
---   /telegram/<chat>/... or leading telegram/<chat>/...
---   tenants/<slug>/ws/<chat>/...                 (non-master tenant WS)
---   ws/<chat>/... or <agent_key>/ws/<chat>/...   (WS direct)
---   <agent_key>/delegate/<chat>/...              (delegated task)
---   <agent_key>/<botname>/group_<botname>_<chat>/... (legacy bot channel)
---   <agent_key>/<botname>/<chat>/...             (bot + numeric/ws chat)
+-- Subsystem vocabulary — any channel integration or delivery surface the
+-- gateway writes under. Must match the channel names used as path segments
+-- in internal/channels/* and workspace resolver (v2 + v3 layouts).
+--   Channels:  telegram | discord | zalo | feishu | lark | whatsapp | slack |
+--              line | messenger | wechat | viber
+--   Transports: ws (browser / WS direct) | api (HTTP) | delegate (subagent)
 --
--- Chat IDs can be numeric (Telegram), `system`, user handles, etc.
--- Only populate when chat_id IS NULL so interceptor-stamped values are preserved.
+-- Path layouts handled (in order of COALESCE priority):
+--   <subsystem>/group_<anything>_<chat>/...              (Telegram-style group prefix)
+--   <subsystem>/<chat>/...                               (bare legacy)
+--   <agent_key>/<subsystem>/group_<anything>_<chat>/...  (agent-owned group)
+--   <agent_key>/<subsystem>/<chat>/...                   (agent-owned direct)
+--   tenants/<slug>/<subsystem>/<chat>/...                (non-master tenant)
+--   <agent_key>/<botname>/group_<botname>_<chat>/...     (legacy bot channel)
+--   <agent_key>/<botname>/<chat>/...                     (bot + numeric/ws chat)
+--
+-- Chat IDs: numeric (Telegram/Discord/Zalo), oc_xxx (Feishu/Lark), sanitized
+-- JID (WhatsApp: "123_c_us"), `system`, user handles, UUIDs. Sanitizer
+-- (workspace_resolver.go) replaces everything outside [a-zA-Z0-9_-] with `_`,
+-- so the captured character class matches what's actually on disk.
+--
+-- Only populate when chat_id IS NULL so interceptor-stamped values survive.
 -- -----------------------------------------------------------------------------
 UPDATE vault_documents
 SET chat_id = COALESCE(
-    (regexp_match(path, '^telegram/group_telegram_(-?[0-9]+)/'))[1],
-    (regexp_match(path, '/telegram/group_telegram_(-?[0-9]+)/'))[1],
-    (regexp_match(path, '^group_telegram_(-?[0-9]+)/'))[1],
-    (regexp_match(path, '/group_telegram_(-?[0-9]+)/'))[1],
-    (regexp_match(path, '^telegram/(-?[0-9a-zA-Z_-]+)/'))[1],
-    (regexp_match(path, '/telegram/([a-zA-Z0-9_-]+)/'))[1],
-    (regexp_match(path, '^tenants/[^/]+/ws/([^/]+)/'))[1],
-    (regexp_match(path, '^ws/([^/]+)/'))[1],
-    (regexp_match(path, '^[^/]+/ws/([^/]+)/'))[1],
-    (regexp_match(path, '^[^/]+/delegate/([^/]+)/'))[1],
+    (regexp_match(path, '^(?:telegram|discord|zalo|feishu|lark|whatsapp|slack|line|messenger|wechat|viber)/group_[^/]+_(-?[0-9]+)/'))[1],
+    (regexp_match(path, '^(?:telegram|discord|zalo|feishu|lark|whatsapp|slack|line|messenger|wechat|viber|ws|delegate|api)/([a-zA-Z0-9_-]+)/'))[1],
+    (regexp_match(path, '^[^/]+/(?:telegram|discord|zalo|feishu|lark|whatsapp|slack|line|messenger|wechat|viber)/group_[^/]+_(-?[0-9]+)/'))[1],
+    (regexp_match(path, '^[^/]+/(?:telegram|discord|zalo|feishu|lark|whatsapp|slack|line|messenger|wechat|viber|ws|delegate|api)/([a-zA-Z0-9_-]+)/'))[1],
+    (regexp_match(path, '^tenants/[^/]+/(?:telegram|discord|zalo|feishu|lark|whatsapp|slack|line|messenger|wechat|viber|ws|delegate|api)/([a-zA-Z0-9_-]+)/'))[1],
+    (regexp_match(path, '^group_[^/]+_(-?[0-9]+)/'))[1],
     (regexp_match(path, '^[^/]+/[^/]+/group_[^/]+_(-?[0-9]+)/'))[1],
     (regexp_match(path, '^[^/]+/[^/]+/([a-zA-Z0-9_-]+)/'))[1]
 )
 WHERE chat_id IS NULL
   AND team_id IS NULL
   AND (
-    path ~ '(^|/)(group_telegram_|telegram/)'
-    OR path ~ '^(([^/]+/)?(tenants/[^/]+/)?)?ws/[^/]+/'
-    OR path ~ '^[^/]+/delegate/[^/]+/'
+    path ~ '^(?:[^/]+/)?(?:telegram|discord|zalo|feishu|lark|whatsapp|slack|line|messenger|wechat|viber|ws|delegate|api)/[^/]+/'
+    OR path ~ '^tenants/[^/]+/(?:telegram|discord|zalo|feishu|lark|whatsapp|slack|line|messenger|wechat|viber|ws|delegate|api)/[^/]+/'
+    OR path ~ '^group_[^/]+_-?[0-9]+/'
     OR path ~ '^[^/]+/[^/]+/(group_[^/]+_-?[0-9]+|[0-9]+)/'
   );