diff --git a/src/commands/doctor/shared/empty-allowlist-policy.test.ts b/src/commands/doctor/shared/empty-allowlist-policy.test.ts
index 54911d46a7a..0d9e1d9c9f8 100644
--- a/src/commands/doctor/shared/empty-allowlist-policy.test.ts
+++ b/src/commands/doctor/shared/empty-allowlist-policy.test.ts
@@ -28,7 +28,7 @@ describe("doctor empty allowlist policy warnings", () => {
     });
 
     expect(warnings).toEqual([
-      expect.stringContaining('channels.signal.dmPolicy is "allowlist" but allowFrom is empty'),
+      '- channels.signal.dmPolicy is "allowlist" but allowFrom is empty — all DMs will be blocked. Add sender IDs to channels.signal.allowFrom, or run "openclaw doctor --fix" to auto-migrate from pairing store when entries exist.',
     ]);
   });
 
@@ -41,7 +41,7 @@ describe("doctor empty allowlist policy warnings", () => {
     });
 
     expect(warnings).toEqual([
-      expect.stringContaining('channels.imessage.groupPolicy is "allowlist"'),
+      '- channels.imessage.groupPolicy is "allowlist" but groupAllowFrom is empty — this channel does not fall back to allowFrom, so all group messages will be silently dropped. Add sender IDs to channels.imessage.groupAllowFrom, or set groupPolicy to "open".',
     ]);
   });
 
diff --git a/src/commands/doctor/shared/empty-allowlist-scan.test.ts b/src/commands/doctor/shared/empty-allowlist-scan.test.ts
index 07d687f4a2b..1cf4ba49437 100644
--- a/src/commands/doctor/shared/empty-allowlist-scan.test.ts
+++ b/src/commands/doctor/shared/empty-allowlist-scan.test.ts
@@ -31,10 +31,8 @@ describe("doctor empty allowlist policy scan", () => {
     );
 
     expect(warnings).toEqual([
-      expect.stringContaining('channels.signal.dmPolicy is "allowlist" but allowFrom is empty'),
-      expect.stringContaining(
-        'channels.signal.accounts.work.dmPolicy is "allowlist" but allowFrom is empty',
-      ),
+      '- channels.signal.dmPolicy is "allowlist" but allowFrom is empty — all DMs will be blocked. Add sender IDs to channels.signal.allowFrom, or run "openclaw doctor --fix" to auto-migrate from pairing store when entries exist.',
+      '- channels.signal.accounts.work.dmPolicy is "allowlist" but allowFrom is empty — all DMs will be blocked. Add sender IDs to channels.signal.accounts.work.allowFrom, or run "openclaw doctor --fix" to auto-migrate from pairing store when entries exist.',
     ]);
   });
 
diff --git a/src/commands/doctor/shared/open-policy-allowfrom.test.ts b/src/commands/doctor/shared/open-policy-allowfrom.test.ts
index 287a6c1e189..440996175f9 100644
--- a/src/commands/doctor/shared/open-policy-allowfrom.test.ts
+++ b/src/commands/doctor/shared/open-policy-allowfrom.test.ts
@@ -136,8 +136,8 @@ describe("doctor open-policy allowFrom repair", () => {
     });
 
     expect(warnings).toEqual([
-      expect.stringContaining('channels.signal.allowFrom: set to ["*"]'),
-      expect.stringContaining('Run "openclaw doctor --fix"'),
+      '- channels.signal.allowFrom: set to ["*"] (required by dmPolicy="open")',
+      '- Run "openclaw doctor --fix" to add missing allowFrom wildcards.',
     ]);
   });
 });